зеркало из https://github.com/mozilla/gecko-dev.git
79 строки
2.4 KiB
JavaScript
79 строки
2.4 KiB
JavaScript
// custom *.sjs for Bug 1122236
|
|
// CSP: 'block-all-mixed-content'
|
|
|
|
const HEAD =
|
|
"<!DOCTYPE HTML>" +
|
|
'<html><head><meta charset="utf-8">' +
|
|
"<title>Bug 1122236 - CSP: Implement block-all-mixed-content</title>" +
|
|
"</head>";
|
|
|
|
const CSP_ALLOW =
|
|
'<meta http-equiv="Content-Security-Policy" content="img-src *">';
|
|
|
|
const CSP_BLOCK =
|
|
'<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">';
|
|
|
|
const BODY =
|
|
"<body>" +
|
|
'<img id="testimage" src="http://mochi.test:8888/tests/image/test/mochitest/blue.png"></img>' +
|
|
'<script type="application/javascript">' +
|
|
' var myImg = document.getElementById("testimage");' +
|
|
" myImg.onload = function(e) {" +
|
|
' window.parent.postMessage({result: "img-loaded"}, "*");' +
|
|
" };" +
|
|
" myImg.onerror = function(e) {" +
|
|
' window.parent.postMessage({result: "img-blocked"}, "*");' +
|
|
" };" +
|
|
"</script>" +
|
|
"</body>" +
|
|
"</html>";
|
|
|
|
// We have to use this special code fragment, in particular '?nocache' to trigger an
|
|
// actual network load rather than loading the image from the cache.
|
|
const BODY_CSPRO =
|
|
"<body>" +
|
|
'<img id="testimage" src="http://mochi.test:8888/tests/image/test/mochitest/blue.png?nocache"></img>' +
|
|
'<script type="application/javascript">' +
|
|
' var myImg = document.getElementById("testimage");' +
|
|
" myImg.onload = function(e) {" +
|
|
' window.parent.postMessage({result: "img-loaded"}, "*");' +
|
|
" };" +
|
|
" myImg.onerror = function(e) {" +
|
|
' window.parent.postMessage({result: "img-blocked"}, "*");' +
|
|
" };" +
|
|
"</script>" +
|
|
"</body>" +
|
|
"</html>";
|
|
|
|
function handleRequest(request, response) {
|
|
// avoid confusing cache behaviors
|
|
response.setHeader("Cache-Control", "no-cache", false);
|
|
|
|
var queryString = request.queryString;
|
|
|
|
if (queryString === "csp-block") {
|
|
response.write(HEAD + CSP_BLOCK + BODY);
|
|
return;
|
|
}
|
|
if (queryString === "csp-allow") {
|
|
response.write(HEAD + CSP_ALLOW + BODY);
|
|
return;
|
|
}
|
|
if (queryString === "no-csp") {
|
|
response.write(HEAD + BODY);
|
|
return;
|
|
}
|
|
if (queryString === "cspro-block") {
|
|
// CSP RO is not supported in meta tag, let's use the header
|
|
response.setHeader(
|
|
"Content-Security-Policy-Report-Only",
|
|
"block-all-mixed-content",
|
|
false
|
|
);
|
|
response.write(HEAD + BODY_CSPRO);
|
|
return;
|
|
}
|
|
// we should never get here but just in case return something unexpected
|
|
response.write("do'h");
|
|
}
|