dom/u2f/tests/frame_appid_facet.html
author ffxbld <ffxbld@mozilla.com>
Mon, 10 Aug 2020 10:14:10 +0000
changeset 605814 7bf8ce68eb7981796d4e06fc6c75b3c9ffd5c2a1
parent 555809 3b3c5e0e1bc4a58d8a7d5718745cc41153e06a76
permissions -rw-r--r--
No Bug, mozilla-release repo-update remote-settings - a=repo-update r=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D86531

<!DOCTYPE html>
<meta charset=utf-8>
<head>
  <script type="text/javascript" src="frame_utils.js"></script>
  <script type="text/javascript" src="u2futil.js"></script>
</head>
<body>
<p>AppID / Facet checks</p>
<script class="testbody" type="text/javascript">
"use strict";

async function doTests() {
  let version = "U2F_V2";
  let challenge = new Uint8Array(16);
  window.crypto.getRandomValues(challenge);

  local_is(window.location.origin, "https://example.com", "Is loaded correctly");

  // Ensure the SpecialPowers push worked properly
  local_isnot(window.u2f, undefined, "U2F API endpoint must exist");

  await promiseU2FRegister(null, [{
      version,
      challenge: bytesToBase64UrlSafe(challenge),
    }], [], function(res){
      local_is(res.errorCode, 0, "Null AppID should work.");
  });

  await promiseU2FRegister("", [{
      version,
      challenge: bytesToBase64UrlSafe(challenge),
    }], [], function(res){
      local_is(res.errorCode, 0, "Empty AppID should work.");
  });

  // Test: Correct TLD, but incorrect scheme
  await promiseU2FRegister("http://example.com/appId", [{
      version,
      challenge: bytesToBase64UrlSafe(challenge),
    }], [], function(res){
      local_isnot(res.errorCode, 0, "HTTP scheme is disallowed");
  });

  // Test: Correct TLD, and also HTTPS
  await promiseU2FRegister("https://example.com/appId", [{
      version,
      challenge: bytesToBase64UrlSafe(challenge),
    }], [], function(res){
      local_is(res.errorCode, 0, "HTTPS origin for example.com should work");
  });

  // Test: Sub-domain
  await promiseU2FRegister("https://test2.example.com/appId", [{
      version,
      challenge: bytesToBase64UrlSafe(challenge),
    }], [], function(res){
      local_is(res.errorCode, 0, "HTTPS origin for test2.example.com should work");
  });

  // Test: Sub-sub-domain
  await promiseU2FRegister("https://sub.test2.example.com/appId", [{
      version,
      challenge: bytesToBase64UrlSafe(challenge),
    }], [], function(res){
      local_is(res.errorCode, 0, "HTTPS origin for sub.test2.example.com should work");
  });

  // Test: TLD
  await promiseU2FRegister("https://com/crazyAppID", [{
      version,
      challenge: bytesToBase64UrlSafe(challenge),
    }], [], function(res){
      local_is(res.errorCode, 2, "HTTPS origin of the TLD should not work");
  });

  // Test: Dynamic origin
  await promiseU2FRegister(window.location.origin + "/otherAppId", [{
      version,
      challenge: bytesToBase64UrlSafe(challenge),
    }], [], function(res){
      local_is(res.errorCode, 0, "Direct window origin should work");
  });
  local_finished();
};

doTests();
</script>
</body>
</html>