forked from mozilla/gecko-dev
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge mozilla-inbound to mozilla-central. a=merge
- Loading branch information
Showing
89 changed files
with
2,586 additions
and
2,391 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| "use strict"; | ||
|
|
||
| const TEST_PATH = getRootDirectory(gTestPath).replace("chrome://mochitests/content", "http://example.com"); | ||
| const HTML_URI = TEST_PATH + "file_data_load_inherit_csp.html"; | ||
| const DATA_URI = "data:text/html;html,<html><body>foo</body></html>"; | ||
|
|
||
| function setDataHrefOnLink(aBrowser, aDataURI) { | ||
| return ContentTask.spawn(aBrowser, aDataURI, function(uri) { | ||
| let link = content.document.getElementById("testlink"); | ||
| link.href = uri; | ||
| }); | ||
| }; | ||
|
|
||
| function verifyCSP(aTestName, aBrowser, aDataURI) { | ||
| return ContentTask.spawn(aBrowser, {aTestName, aDataURI}, async function ({aTestName, aDataURI}) { | ||
| let channel = content.docShell.currentDocumentChannel; | ||
| is(channel.URI.spec, aDataURI, "testing CSP for " + aTestName); | ||
| let principal = channel.loadInfo.triggeringPrincipal; | ||
| let cspJSON = principal.cspJSON; | ||
| let cspOBJ = JSON.parse(cspJSON); | ||
| let policies = cspOBJ["csp-policies"]; | ||
| is(policies.length, 1, "should be one policy"); | ||
| let policy = policies[0]; | ||
| is(policy['script-src'], "'unsafe-inline'", "script-src directive matches"); | ||
| }); | ||
| }; | ||
|
|
||
| add_task(async function setup() { | ||
| // allow top level data: URI navigations, otherwise clicking data: link fails | ||
| await SpecialPowers.pushPrefEnv({ | ||
| "set": [["security.data_uri.block_toplevel_data_uri_navigations", false]], | ||
| }); | ||
| }); | ||
|
|
||
| add_task(async function test_data_csp_inheritance_regular_click() { | ||
| await BrowserTestUtils.withNewTab(HTML_URI, async function(browser) { | ||
| let loadPromise = BrowserTestUtils.browserLoaded(browser, false, DATA_URI); | ||
| // set the data href + simulate click | ||
| await setDataHrefOnLink(gBrowser.selectedBrowser, DATA_URI); | ||
| BrowserTestUtils.synthesizeMouseAtCenter("#testlink", {}, | ||
| gBrowser.selectedBrowser); | ||
| await loadPromise; | ||
| await verifyCSP("click()", gBrowser.selectedBrowser, DATA_URI); | ||
| }); | ||
| }); | ||
|
|
||
| add_task(async function test_data_csp_inheritance_ctrl_click() { | ||
| await BrowserTestUtils.withNewTab(HTML_URI, async function(browser) { | ||
| let loadPromise = BrowserTestUtils.waitForNewTab(gBrowser, DATA_URI); | ||
| // set the data href + simulate ctrl+click | ||
| await setDataHrefOnLink(gBrowser.selectedBrowser, DATA_URI); | ||
| BrowserTestUtils.synthesizeMouseAtCenter("#testlink", | ||
| { ctrlKey: true, metaKey: true }, | ||
| gBrowser.selectedBrowser); | ||
| let tab = await loadPromise; | ||
| gBrowser.selectTabAtIndex(2); | ||
| await verifyCSP("ctrl-click()", gBrowser.selectedBrowser, DATA_URI); | ||
| await BrowserTestUtils.removeTab(tab); | ||
| }); | ||
| }); | ||
|
|
||
| add_task(async function test_data_csp_inheritance_right_click_open_link_in_new_tab() { | ||
| await BrowserTestUtils.withNewTab(HTML_URI, async function(browser) { | ||
| let loadPromise = BrowserTestUtils.waitForNewTab(gBrowser, DATA_URI); | ||
| // set the data href + simulate right-click open link in tab | ||
| await setDataHrefOnLink(gBrowser.selectedBrowser, DATA_URI); | ||
| BrowserTestUtils.waitForEvent(document, "popupshown", false, event => { | ||
| // These are operations that must be executed synchronously with the event. | ||
| document.getElementById("context-openlinkintab").doCommand(); | ||
| event.target.hidePopup(); | ||
| return true; | ||
| }); | ||
| BrowserTestUtils.synthesizeMouseAtCenter("#testlink", | ||
| { type: "contextmenu", button: 2 }, | ||
| gBrowser.selectedBrowser); | ||
|
|
||
| let tab = await loadPromise; | ||
| gBrowser.selectTabAtIndex(2); | ||
| await verifyCSP("right-click-open-in-new-tab()", gBrowser.selectedBrowser, DATA_URI); | ||
| await BrowserTestUtils.removeTab(tab); | ||
| }); | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| <!DOCTYPE HTML> | ||
| <html> | ||
| <head> | ||
| <meta charset="utf-8"> | ||
| <title>Bug 1358009 - Inherit CSP into data URI</title> | ||
| <meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'"> | ||
| </head> | ||
| <body> | ||
| <a id="testlink">testlink</a> | ||
| </body> | ||
| </html> |
Oops, something went wrong.