Bug 1370468 - Tests for userpass in frame ancestor added draft
authorvinoth <cegvinoth@gmail.com>
Fri, 01 Sep 2017 17:49:45 +0200
changeset 657524 9f702a7dde2df2de6235709e8e7af725785003f6
parent 655915 ca16d3d6a98cec9ade36972392ac7727a1c1d86e
child 658461 c7a53893c9674d5d8b0894e8209840ec9bc867d2
push id77548
push userbmo:cegvinoth@gmail.com
push dateFri, 01 Sep 2017 15:53:21 +0000
bugs1370468
milestone57.0a1
Bug 1370468 - Tests for userpass in frame ancestor added MozReview-Commit-ID: 8lsXOszop8e
dom/security/test/csp/file_frame_a.html
dom/security/test/csp/file_frame_b.html
dom/security/test/csp/file_frame_c.html
dom/security/test/csp/file_frame_c.html^headers^
dom/security/test/csp/file_frame_d.html
dom/security/test/csp/file_frame_d.html^headers^
dom/security/test/csp/file_frameancestors_userpass.html
dom/security/test/csp/file_frameancestors_userpass.js
dom/security/test/csp/file_frameancestors_userpass.sjs
dom/security/test/csp/mochitest.ini
dom/security/test/csp/test_frameancestors_userpass.html
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frame_a.html
@@ -0,0 +1,14 @@
+<html>
+  <head>
+    <title>Nested frame</title>
+    <script>
+          parent.parent.postMessage({call: "frameLoaded", testname: "frame_a", uri: window.location.toString()}, "*");
+    </script>
+  </head>
+  <body>
+
+    <tt>  IFRAME C</tt><br/>
+    <iframe src='http://sampleuser:samplepass@mochi.test:8888/tests/dom/security/test/csp/file_frame_c.html'></iframe><br/>
+
+  </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frame_b.html
@@ -0,0 +1,14 @@
+<html>
+  <head>
+    <title>Nested frame</title>
+    <script>
+          parent.parent.postMessage({call: "frameLoaded", testname: "frame_b", uri: window.location.toString()}, "*");
+    </script>
+  </head>
+  <body>
+
+    <tt>  IFRAME D</tt><br/>
+    <iframe src='http://sampleuser:samplepass@example.com/tests/dom/security/test/csp/file_frame_d.html'></iframe><br/>
+
+  </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frame_c.html
@@ -0,0 +1,8 @@
+<html>
+  <head>
+    <title>Nested frame</title>
+  </head>
+  <body>
+         nested frame C content
+  </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frame_c.html^headers^
@@ -0,0 +1,1 @@
+Content-Security-Policy: default-src 'none'; frame-ancestors http://mochi.test:8888/ ; script-src 'self';
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frame_d.html
@@ -0,0 +1,8 @@
+<html>
+  <head>
+    <title>Nested frame</title>
+  </head>
+  <body>
+         nested frame D content
+  </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frame_d.html^headers^
@@ -0,0 +1,1 @@
+Content-Security-Policy: default-src 'none'; frame-ancestors http://sampleuser:samplepass@example.com/ ; script-src 'self';
--- a/dom/security/test/csp/file_frameancestors_userpass.html
+++ b/dom/security/test/csp/file_frameancestors_userpass.html
@@ -1,33 +1,15 @@
 <html>
   <head>
     <title>CSP frame ancestors tests</title>
 
-    <!-- this page shouldn't have a CSP, just the sub-pages. -->
-    <script src='file_frameancestors_userpass.js'></script>
-
   </head>
   <body>
 
-<!-- These iframes will get populated by the attached javascript. -->
-
-<tt>  aba_allow:    /* innermost frame allows b,a */</tt><br/>
-<iframe id='aba_allow'></iframe><br/>
-
-<tt>  aba_block:    /* innermost frame denies b */</tt><br/>
-<iframe id='aba_block'></iframe><br/>
+<tt>  IFRAME A</tt><br/>
+<iframe src='http://sampleuser:samplepass@mochi.test:8888/tests/dom/security/test/csp/file_frame_a.html'></iframe><br/>
 
-<tt>  aba2_block:   /* innermost frame denies a */</tt><br/>
-<iframe id='aba2_block'></iframe><br/>
-
-<tt>  abb_allow:    /* innermost frame allows b,a */</tt><br/>
-<iframe id='abb_allow'></iframe><br/>
-
-<tt>  abb_block:    /* innermost frame denies b */</tt><br/>
-<iframe id='abb_block'></iframe><br/>
-
-<tt>  abb2_block:   /* innermost frame denies a */</tt><br/>
-<iframe id='abb2_block'></iframe><br/>
-
+<tt>  IFRAME B</tt><br/>
+<iframe src='http://sampleuser:samplepass@example.com/tests/dom/security/test/csp/file_frame_b.html'></iframe><br/>
 
   </body>
 </html>
deleted file mode 100644
--- a/dom/security/test/csp/file_frameancestors_userpass.js
+++ /dev/null
@@ -1,52 +0,0 @@
-// Script to populate the test frames in the frame ancestors mochitest.
-//
-function setupFrames() {
-
-  var $ = function(v) { return document.getElementById(v); }
-  var base = {
-        self: '/tests/dom/security/test/csp/file_frameancestors_userpass.sjs',
-        a: 'http://sampleuser:samplepass@mochi.test:8888/tests/dom/security/test/csp/file_frameancestors_userpass.sjs',
-        b: 'http://sampleuser:samplepass@example.com/tests/dom/security/test/csp/file_frameancestors_userpass.sjs'
-  };
-
-  // In both cases (base.a, base.b) the path starts with /tests/. Let's make sure this
-  // path within the CSP policy is completely ignored when enforcing frame ancestors.
-  // To test this behavior we use /foo/ and /bar/ as dummy values for the path.
-  var host = { a: 'http://mochi.test:8888/foo/', b: 'http://example.com:80/bar/' };
-
-  var innerframeuri = null;
-  var elt = null;
-
-   /* .... two-level framing */
-  elt = $('aba_allow');
-  innerframeuri = base.a + "?testid=aba_allow&double=1&internalframe=aba_a&csp=" +
-                  escape("default-src 'none'; frame-ancestors " + host.a + " " + host.b + "; script-src 'self'");
-  elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
-
-  elt = $('aba_block');
-  innerframeuri = base.a + "?testid=aba_allow&double=1&internalframe=aba_b&csp=" +
-                  escape("default-src 'none'; frame-ancestors " + host.a + "; script-src 'self'");
-  elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
-
-  elt = $('aba2_block');
-  innerframeuri = base.a + "?testid=aba_allow&double=1&internalframe=aba2_b&csp=" +
-                  escape("default-src 'none'; frame-ancestors " + host.b + "; script-src 'self'");
-  elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
-
-  elt = $('abb_allow');
-  innerframeuri = base.b + "?testid=abb_allow&double=1&internalframe=abb_a&csp=" +
-                  escape("default-src 'none'; frame-ancestors " + host.a + " " + host.b + "; script-src 'self'");
-  elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
-
-  elt = $('abb_block');
-  innerframeuri = base.b + "?testid=abb_allow&double=1&internalframe=abb_b&csp=" +
-                  escape("default-src 'none'; frame-ancestors " + host.a + "; script-src 'self'");
-  elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
-
-  elt = $('abb2_block');
-  innerframeuri = base.b + "?testid=abb_allow&double=1&internalframe=abb2_b&csp=" +
-                  escape("default-src 'none'; frame-ancestors " + host.b + "; script-src 'self'");
-  elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
-}
-
-window.addEventListener('load', setupFrames);
deleted file mode 100644
--- a/dom/security/test/csp/file_frameancestors_userpass.sjs
+++ /dev/null
@@ -1,54 +0,0 @@
-// SJS file for CSP frame ancestor mochitests
-function handleRequest(request, response)
-{
-  var query = {};
-  request.queryString.split('&').forEach(function (val) {
-    var [name, value] = val.split('=');
-    query[name] = unescape(value);
-  });
-
-  var isPreflight = request.method == "OPTIONS";
-
-  //avoid confusing cache behaviors
-  response.setHeader("Cache-Control", "no-cache", false);
-
-  // grab the desired policy from the query, and then serve a page
-  if (query['csp'])
-    response.setHeader("Content-Security-Policy",
-                        unescape(query['csp']),
-                        false);
-  if (query['scriptedreport']) {
-    // spit back a script that records that the page loaded
-    response.setHeader("Content-Type", "text/javascript", false);
-    if (query['double'])
-      response.write('window.parent.parent.parent.postMessage({call: "frameLoaded", testname: "' + query['scriptedreport'] + '", uri: window.location.toString()}, "*");');
-    else
-      response.write('window.parent.parent.postMessage({call: "frameLoaded", testname: "' + query['scriptedreport'] + '", uri: window.location.toString()}, "*");');
-  } else if (query['internalframe']) {
-    // spit back an internal iframe (one that might be blocked)
-    response.setHeader("Content-Type", "text/html", false);
-    response.write('<html><head>');
-    if (query['double'])
-      response.write('<script src="file_frameancestors_userpass.sjs?double=1&scriptedreport=' + query['testid'] + '"></script>');
-    else
-      response.write('<script src="file_frameancestors_userpass.sjs?scriptedreport=' + query['testid'] + '"></script>');
-    response.write('</head><body>');
-    response.write(unescape(query['internalframe']));
-    response.write('</body></html>');
-  } else if (query['externalframe']) {
-    // spit back an internal iframe (one that won't be blocked, and probably
-    // has no CSP)
-    response.setHeader("Content-Type", "text/html", false);
-    response.write('<html><head>');
-  //  response.write('<script src="file_frameancestors_userpass.sjs?double=1&scriptedreport=' + query['externalframe'] + '"></script>');
-    response.write('</head><body>');
-    response.write(unescape(query['externalframe']));
-    response.write('</body></html>');
-  } else {
-    // default case: error.
-    response.setHeader("Content-Type", "text/html", false);
-    response.write('<html><body>');
-    response.write("ERROR: not sure what to serve.");
-    response.write('</body></html>');
-  }
-}
--- a/dom/security/test/csp/mochitest.ini
+++ b/dom/security/test/csp/mochitest.ini
@@ -27,18 +27,22 @@ support-files =
   file_evalscript_main.html
   file_evalscript_main.html^headers^
   file_evalscript_main_allowed.html
   file_evalscript_main_allowed.html^headers^
   file_frameancestors_main.html
   file_frameancestors_main.js
   file_frameancestors.sjs
   file_frameancestors_userpass.html
-  file_frameancestors_userpass.js
-  file_frameancestors_userpass.sjs
+  file_frame_a.html
+  file_frame_b.html
+  file_frame_c.html
+  file_frame_c.html^headers^
+  file_frame_d.html
+  file_frame_d.html^headers^
   file_inlinescript.html
   file_inlinestyle_main.html
   file_inlinestyle_main.html^headers^
   file_inlinestyle_main_allowed.html
   file_inlinestyle_main_allowed.html^headers^
   file_invalid_source_expression.html
   file_main.html
   file_main.html^headers^
--- a/dom/security/test/csp/test_frameancestors_userpass.html
+++ b/dom/security/test/csp/test_frameancestors_userpass.html
@@ -1,59 +1,30 @@
 <!DOCTYPE HTML>
 <html>
 <head>
-  <title>Test for Content Security Policy Frame Ancestors directive</title>
+  <title>Test for Userpass in Frame Ancestors directive</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
 <body>
 <p id="display"></p>
 <div id="content" style="display: none">
 </div>
 <iframe style="width:100%;height:300px;" id='cspframe'></iframe>
 <script class="testbody" type="text/javascript">
 
 // These are test results: -1 means it hasn't run,
 // true/false is the pass/fail result.
 var framesThatShouldLoad = {
-  //aa_allow: -1,    /* innermost frame allows a *
-  //aa_block: -1,    /* innermost frame denies a */
-  //ab_allow: -1,    /* innermost frame allows a */
-  //ab_block: -1,    /* innermost frame denies a */
-  aba_allow: -1,   /* innermost frame allows b,a */
-  //aba_block: -1,   /* innermost frame denies b */
-  //aba2_block: -1,  /* innermost frame denies a */
-//  abb_allow: -1,   /* innermost frame allows b,a */
-  //abb_block: -1,   /* innermost frame denies b */
-  //abb2_block: -1,  /* innermost frame denies a */
+  frame_a: -1,    /* frame a allowed */
+  frame_b: -1,    /* frame b allowed */
 };
 
-// we normally expect _6_ violations (6 test cases that cause blocks), but many
-// of the cases cause violations due to the // origin of the test harness (same
-// as 'a'). When the violation is cross-origin, the URI passed to the observers
-// is null (see bug 846978).  This means we can't tell if it's part of the test
-// case or if it is the test harness frame (also origin 'a').
-// As a result, we'll get an extra violation for the following cases:
-//  ab_block    "frame-ancestors 'none'" (outer frame and test harness)
-//  aba2_block  "frame-ancestors b" (outer frame and test harness)
-//  abb2_block   "frame-ancestors b" (outer frame and test harness)
-//
-// and while we can detect the test harness check for this one case since
-// the violations are not cross-origin and we get the URI:
-//  aba2_block  "frame-ancestors b" (outer frame and test harness)
-//
-// we can't for these other ones:
-//  ab_block    "frame-ancestors 'none'" (outer frame and test harness)
-//  abb2_block   "frame-ancestors b" (outer frame and test harness)
-//
-// so that results in 2 extra violation notifications due to the test harness.
-// expected = 6, total = 8
-//
-// Number of tests that pass for this file should be 12 (8 violations 4 loads)
+// Number of tests that pass for this file should be 1
 var expectedViolationsLeft = 1;
 
 // This is used to watch the blocked data bounce off CSP and allowed data
 // get sent out to the wire.
 function examiner() {
   SpecialPowers.addObserver(this, "csp-on-violate-policy");
 }
 examiner.prototype  = {
@@ -116,17 +87,25 @@ var frameLoaded = function(testname, uri
     }
   }
   checkTestResults();
 }
 
 // called when a frame is blocked
 // -- we can't determine *which* frame was blocked, but at least we can count them
 var frameBlocked = function(uri, policy) {
-  //ok(true, 'a CSP policy blocked frame from being loaded: ' + policy);
+
+  //Check if @ symbol is there in URI or in csp policy.
+  if(policy.includes('@') || uri.includes('@'))
+  {
+    ok(false, ' a CSP policy blocked frame from being loaded. But contains userpass. Policy is: ' + policy + ';URI is: ' + uri );
+  }
+  else {
+    ok(true, ' a CSP policy blocked frame from being loaded. Doesn\'t contain userpass. Policy is: ' + policy + ';URI is: ' + uri );
+  }
   expectedViolationsLeft--;
   checkTestResults();
 }
 
 
 // Check to see if all the tests have run
 var checkTestResults = function() {
   // if any test is incomplete, keep waiting