content/base/test/csp/test_bothCSPheaders.html
author Garrett Robinson <grobinson@mozilla.com>
Wed, 04 Jun 2014 17:53:58 -0700
changeset 207033 9a9020972cc49338612f54b908d224cf2f04847a
parent 207020 content/base/test/xcsp/test_bothCSPheaders.html@d9a7b9a18ab4759a96e7a726e4a403ebda6ca0f0
child 207263 413ea58159cf6b333798351ba1824122d98eb5cc
permissions -rw-r--r--
Backed out changeset d9a7b9a18ab4 (Bug 988616) on a CLOSED TREE

<!DOCTYPE HTML>
<html>
<head>
  <title>Test for Correctly Handling Both Pre-1.0 and 1.0 Content Security Policy Headers</title>
  <!-- When both headers are present, we should ignore the pre-1.0 header and
       only recognize the 1.0 spec-compliant header. -->
  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<p id="display"></p>
<div id="content" style="display: none">
</div>

<iframe style="width:200px;height:200px;" id='cspframe'></iframe>
<script class="testbody" type="text/javascript">

var prefixedHeaderImgURL = "http://example.org/prefixed.jpg";
var unprefixedHeaderImgURL = "http://mochi.test:8888/unprefixed.jpg";
var testsRun = 0;
var totalTests = 2;

// This is used to watch the blocked data bounce off CSP and allowed data
// get sent out to the wire.
function examiner() {
  SpecialPowers.addObserver(this, "csp-on-violate-policy", false);
  SpecialPowers.addObserver(this, "specialpowers-http-notify-request", false);
}
examiner.prototype  = {
  observe: function(subject, topic, data) {
    if (topic === "specialpowers-http-notify-request") {
      var allowedUri = data;
      if (allowedUri == prefixedHeaderImgURL || allowedUri == unprefixedHeaderImgURL) {
        is(allowedUri, unprefixedHeaderImgURL, "Load was allowed - should be allowed by unprefixed header (blocked by prefixed)");
        testRan();
      }
    }

    if (topic === "csp-on-violate-policy") {
      // the load was blocked, this is a pass, the Content-Security-Policy
      // header doesn't allow the load, but the X-Content-Security-Header does
      var asciiSpec = SpecialPowers.getPrivilegedProps(SpecialPowers.do_QueryInterface(subject, "nsIURI"), "asciiSpec");
      if (asciiSpec == prefixedHeaderImgURL || asciiSpec == unprefixedHeaderImgURL) {
        is(asciiSpec, prefixedHeaderImgURL, "Load was blocked - the Content-Security-Policy header doesn't allow the load, the X-Content-Security-Header does but should have been ignored");
        testRan();
      }
    }
  },

  // must eventually call this to remove the listener,
  // or mochitests might get borked.
  remove: function() {
    SpecialPowers.removeObserver(this, "csp-on-violate-policy");
    SpecialPowers.removeObserver(this, "specialpowers-http-notify-request");
  }
}

window.examiner = new examiner();
SimpleTest.waitForExplicitFinish();

function testRan() {
  testsRun++;
  if (testsRun == totalTests) {
    window.examiner.remove();
    SimpleTest.finish();
  }
}

SpecialPowers.pushPrefEnv(
  {'set':[["security.csp.speccompliant", true]]},
  function loadTestRequests() {
    var cspframe = document.getElementById('cspframe');
    cspframe.src = 'file_bothCSPheaders.html';
  }
);
</script>
</pre>
</body>
</html>