Skip to content
This repository has been archived by the owner on Jul 27, 2022. It is now read-only.

Commit

Permalink
Workarounds for h5vcc in CSP tests
Browse files Browse the repository at this point in the history
* We don't support CSS selector syntax in brackets, so manually
look for long/timeout in meta element.
* We don't support inline script execution in img error attribute,
so disable that.
* We don't support blob or filesystem URLs so remove parts of tests
that assume they exist.
  • Loading branch information
rjogrady committed Feb 3, 2016
1 parent cd700da commit 3061944
Show file tree
Hide file tree
Showing 4 changed files with 5 additions and 43 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -22,44 +22,6 @@
}));
document.head.appendChild(script);
});

var t2 = async_test('blob: URIs should not match *');
t2.step(function() {
var b = new Blob([''], { type: 'application/javascript' });
var script = document.createElement('script');
script.addEventListener('load', t2.step_func(function() {
assert_unreached('Should not successfully load blob URI.');
}));
script.addEventListener('error', t2.step_func(function() {
t2.done();
}));

script.src = URL.createObjectURL(b);
document.head.appendChild(script);
});

var t3 = async_test('filesystem URIs should not match *');
if (window.webkitRequestFileSystem) {
window.webkitRequestFileSystem(TEMPORARY, 1024*1024 /*1MB*/, function(fs) {
fs.root.getFile('fail.js', {create: true}, function(fileEntry) {
fileEntry.createWriter(function(fileWriter) {
var script = document.createElement('script');

script.addEventListener('load', t3.step_func(function() {
assert_unreached('Should not successfully load filesystem URI.');
}));
script.addEventListener('error', t3.step_func(function() {
t3.done();
}));

script.src = fileEntry.toURL('application/javascript');
document.body.appendChild(script);
});
});
});
} else {
t3.done();
}
</script>
</body>
</html>
2 changes: 0 additions & 2 deletions content-security-policy/script-src/script-src-1_1.html
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,6 @@ <h1>Inline script should not run without 'unsafe-inline' script-src directive, e
t1.step(function() {assert_unreached('Unsafe inline script ran.');});
</script>

<img src='doesnotexist.jpg' onerror='t2.step(function() { assert_unreached("Unsafe inline event handler ran.") });'>

<script async defer src='../support/checkReport.sub.js?reportField=violated-directive&reportValue=script-src%20%27self%27'></script>

</body>
Expand Down
2 changes: 0 additions & 2 deletions content-security-policy/script-src/script-src-1_2.html
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,6 @@ <h1>Inline script should not run without 'unsafe-inline' script-src directive, e
t1.step(function() {assert_unreached('Unsafe inline script ran.');});
</script>

<img src='doesnotexist.jpg' onerror='t2.step(function() { assert_unreached("Unsafe inline event handler ran.") });'>

<script async defer src='../support/checkReport.sub.js?reportField=violated-directive&reportValue=script-src%20%27self%27'></script>

</body>
Expand Down
6 changes: 5 additions & 1 deletion content-security-policy/support/checkReport.sub.js
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,11 @@
}
}

var timeout = document.querySelector("meta[name=timeout][content=long]") ? 50 : 5;
var meta = document.querySelector("meta");
var timeout = 5;
if (meta && (meta.name == "timeout" || meta.content == "long")) {
timeout = 50;
}
var reportLocation = location.protocol + "//" + location.host + "/content-security-policy/support/report.py?op=take&timeout=" + timeout + "&reportID=" + reportID;

var reportTest = async_test("Violation report status OK.");
Expand Down

0 comments on commit 3061944

Please sign in to comment.