| author | Andy Paicu <andypaicu@chromium.org> |
| Fri, 30 Nov 2018 18:05:14 +0000 | |
| changeset 450035 | f3893f5aedbba43201bdcd4e54971add7bf6c261 |
| parent 450034 | a60945f649386c3119755ae78dbd6bb8248684b2 |
| child 450036 | 011406a72554d1154955602fbf2592866dbfc59e |
| push id | 110435 |
| push user | james@hoppipolla.co.uk |
| push date | Tue, 11 Dec 2018 15:53:47 +0000 |
| treeherder | mozilla-inbound@add833a587f5 [default view] [failures only] |
| perfherder | [talos] [build metrics] [platform microbench] (compared to previous push) |
| reviewers | testonly |
| bugs | 1509857, 14233, 694525, 1350889, 611638 |
| milestone | 66.0a1 |
| first release with | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
| last release without | nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
|
new file mode 100644 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/inheritance/iframe-srcdoc-inheritance.html @@ -0,0 +1,34 @@ +<!DOCTYPE html> +<head> + <meta http-equiv="Content-Security-Policy" content="img-src 'self'"> + <script src="/resources/testharness.js"></script> + <script src="/resources/testharnessreport.js"></script> +</head> +<body> + <script> + var t1 = async_test("First image should be blocked"); + var t2 = async_test("Second image should be blocked"); + window.onmessage = t1.step_func_done(function(e) { + if (e.data == "img blocked") { + frames[0].frames[0].frameElement.srcdoc = + `<script> + window.addEventListener('securitypolicyviolation', function(e) { + if (e.violatedDirective == 'img-src') { + top.postMessage('img blocked', '*'); + } + }) + </scr` + `ipt> + <img src='/content-security-policy/support/fail.png' + onload='top.postMessage("img loaded", "*")'/>`; + window.onmessage = t2.step_func_done(function(e) { + if (e.data != "img blocked") + assert_true(false, "The second image should have been blocked"); + }); + } else { + assert_true(false, "The first image should have been blocked"); + } + }); + </script> + <iframe src="support/srcdoc-child-frame.html"></iframe> +</body> +</html>
new file mode 100644 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/inheritance/support/srcdoc-child-frame.html @@ -0,0 +1,19 @@ +<head> + <meta http-equiv="Content-Security-Policy" content="img-src 'none'"> +</head> +<body> + <script> + var i = document.createElement('iframe'); + i.srcdoc=`<script> + window.addEventListener('securitypolicyviolation', function(e) { + if (e.violatedDirective == 'img-src') { + top.postMessage('img blocked', '*'); + } + }) + </scr` + `ipt> + <img src='/content-security-policy/support/fail.png' + onload='top.postMessage("img loaded", "*")'/>`; + i.id = "srcdoc-frame"; + document.body.appendChild(i); + </script> +</body>