dom/security/test/csp/test_referrerdirective.html
author Kate McKinley <kmckinley@mozilla.com>
Tue, 15 Nov 2016 10:52:45 +0900
changeset 322557 aa7ad663977bbded0b6d64b1cbd6df88bd6d8065
parent 302369 0bed705c143059e74abd71b5af404dbb599af88f
child 329664 7b434711753b98a87603453caaa0945791ffe12b
permissions -rw-r--r--
Bug 1317115 turn off HSTS priming to suppress perma-orange a=test-only MozReview-Commit-ID: I1bNquP4yT7

<!--
  Any copyright is dedicated to the Public Domain.
  http://creativecommons.org/publicdomain/zero/1.0/
-->
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=965727
-->
<head>
  <meta charset="utf-8">
  <title>Test for Content Security Policy referrer Directive (Bug 965727)</title>
  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<div id="content" style="display: none">

</div>
<pre id="test">
<script class="testbody" type="application/javascript">
/*
 * This tests various referrer policies and the referrer-sending behavior when
 * requesting scripts in different ways:
 *  - cross-origin (https://example.com -> https://test2.example.com)
 *  - same-origin (https://example.com -> https://example.com)
 *  - downgrade (https://example.com -> http://example.com)
 *
 * Each test creates an iframe that loads scripts for each of the checks.  If
 * the scripts are blocked, the test fails (they should run).  When loaded,
 * each script updates a results object in the test page, and then when the
 * test page has finished loading all the scripts, it postMessages back to this
 * page.  Once all tests are done, the results are checked.
 */

var testData = {
  'default': { 'csp': "script-src * 'unsafe-inline'; referrer default",
          'expected': {  'sameorigin': 'full',
                        'crossorigin': 'full',
                          'downgrade': 'none' }},

  'origin':  { 'csp': "script-src * 'unsafe-inline'; referrer origin",
          'expected': {  'sameorigin': 'origin',
                        'crossorigin': 'origin',
                          'downgrade': 'origin' }},

  'origin-when-cross-origin':  { 'csp': "script-src * 'unsafe-inline'; referrer origin-when-cross-origin",
          'expected': {  'sameorigin': 'full',
                        'crossorigin': 'origin',
                          'downgrade': 'origin' }},

  'unsafe-url':  { 'csp': "script-src * 'unsafe-inline'; referrer unsafe-url",
          'expected': {  'sameorigin': 'full',
                        'crossorigin': 'full',
                          'downgrade': 'full' }},

  'none':   { 'csp': "script-src * 'unsafe-inline'; referrer no-referrer",
          'expected': {  'sameorigin': 'none',
                        'crossorigin': 'none',
                          'downgrade': 'none' }},

  // referrer delivered through CSPRO should be ignored
  'ignore-cspro':  { 'cspro': "script-src * 'unsafe-inline'; referrer origin",
          'expected': {  'sameorigin': 'full',
                        'crossorigin': 'full',
                          'downgrade': 'none' }},

  // referrer delivered through CSPRO should be ignored
  'ignore-cspro2':   { 'csp'  : "script-src * 'unsafe-inline'; referrer no-referrer",
                       'cspro': "script-src * 'unsafe-inline'; referrer origin",
         'expected': {  'sameorigin': 'none',
                        'crossorigin': 'none',
                          'downgrade': 'none' }},
  };

var referrerDirectiveTests = {
  // called via postMessage when one of the iframes is done running.
  onIframeComplete: function(event) {
    try {
      var results = JSON.parse(event.data);
      ok(results.hasOwnProperty('id'), "'id' property required in posted message " + event.data);

      ok(testData.hasOwnProperty(results['id']), "Test " + results['id'] + " must be expected.");

      // check all the various load types' referrers.
      var expected = testData[results['id']].expected;
      for (var t in expected) {
        is(results.results[t], expected[t],
          " referrer must match expected for " + t + " in " + results['id']);
      }
      testData[results['id']]['complete'] = true;

    } catch(e) {
      // fail -- should always be JSON
      ok(false, "failed to parse posted message + " + event.data);
      // have to end as well since not all messages were valid.
      SimpleTest.finish();
    }

    referrerDirectiveTests.checkForCompletion();
  },

  // checks to see if all the parallel tests are done and validates results.
  checkForCompletion: function() {
    for (var id in testData) {
      if (!testData[id].hasOwnProperty('complete')) {
        return;
      }
    }
    SimpleTest.finish();
  }
};

SimpleTest.waitForExplicitFinish();
// have to disable mixed content blocking to test https->http referrers.
SpecialPowers.pushPrefEnv({
    'set': [['security.mixed_content.block_active_content',   false],
            ['security.mixed_content.block_display_content',  false],
            ['security.mixed_content.send_hsts_priming',  false],
            ['security.mixed_content.use_hsts',  false],
    ]
    },
    function() {
      // each of the iframes we create will call us back when its contents are loaded.
      window.addEventListener("message", referrerDirectiveTests.onIframeComplete.bind(window), false);

      // one iframe created for each test case
      for (var id in testData) {
        var elt = document.createElement("iframe");
        var src = "https://example.com/tests/dom/security/test/csp/file_testserver.sjs?id=" + id;
        if (testData[id]['csp']) {
          src += "&csp=" + escape(testData[id]['csp']);
        }
        if (testData[id]['cspro']) {
          src += "&cspro=" + escape(testData[id]['cspro']);
        }
        src += "&file=tests/dom/security/test/csp/file_referrerdirective.html";
        elt.src = src;
        document.getElementById("content").appendChild(elt);
      }
    });
</script>
</pre>
</body>
</html>