Ziele Untersuchung
mit Columbo Integrität von
Datenbanken Interaktion und
Portierbarkeit Ergonomie der
Schnittstellen

Angebot Produkte Projekt Beratung

Mittel Analytik Modellierung Sprachen Algebra Logik Hardware Denken Kreativität

Zusammenhänge Gesellschaft Wirtschaft Branche Firma


products/Sources/formale Sprachen/C/Firefox/dom/security/test/csp/ (Browser von der Mozilla Stiftung Version 136.0.1^©) Datei vom 10.2.2025 mit Größe 4 kB

Quelle test_strict_dynamic.html Sprache: HTML

products/Sources/formale Sprachen/C/Firefox/dom/security/test/csp/test_strict_dynamic.html

<!DOCTYPE HTML>
<html>
<head>
  <title>Bug 1299483 - CSP: Implement 'strict-dynamic'</title>
  
  <script src="/tests/SimpleTest/SimpleTest.js"></script>
  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
  <iframe style="width:100%;" id="testframe"></iframe>

<script class="testbody" type="text/javascript">

SimpleTest.waitForExplicitFinish();

/* Description of the test:
* We load scripts with a CSP of 'strict-dynamic' with valid
* and invalid nonces and make sure scripts are allowed/blocked
* accordingly. Different tests load inline and external scripts
* also using a CSP including http: and https: making sure
* other srcs are invalided by 'strict-dynamic'.
*/

var tests = [
  {
    desc: "strict-dynamic with valid nonce should be allowed",
    result: "allowed",
    file: "file_strict_dynamic_script_extern.html",
    policy: "script-src 'strict-dynamic' 'nonce-foo' https: 'none' 'self'"
  },
  {
    desc: "strict-dynamic with invalid nonce should be blocked",
    result: "blocked",
    file: "file_strict_dynamic_script_extern.html",
    policy: "script-src 'strict-dynamic' 'nonce-bar' http: http://example.com"
  },
  {
    desc: "strict-dynamic, allowlist and invalid nonce should be blocked",
    result: "blocked",
    file: "file_strict_dynamic_script_extern.html",
    policy: "script-src 'strict-dynamic' 'nonce-bar' 'unsafe-inline' http: http://example.com"
  },
  {
    desc: "strict-dynamic with no 'nonce-' should be blocked",
    result: "blocked",
    file: "file_strict_dynamic_script_extern.html",
    policy: "script-src 'strict-dynamic'"
  },
  // inline scripts
  {
    desc: "strict-dynamic with valid nonce should be allowed",
    result: "allowed",
    file: "file_strict_dynamic_script_inline.html",
    policy: "script-src 'strict-dynamic' 'nonce-foo' https: 'none' 'self'"
  },
  {
    desc: "strict-dynamic with invalid nonce should be blocked",
    result: "blocked",
    file: "file_strict_dynamic_script_inline.html",
    policy: "script-src 'strict-dynamic' 'nonce-bar' http: http://example.com"
  },
  {
    desc: "strict-dynamic, unsafe-inline and invalid nonce should be blocked",
    result: "blocked",
    file: "file_strict_dynamic_script_inline.html",
    policy: "script-src 'strict-dynamic' 'nonce-bar' 'unsafe-inline' http: http://example.com"
  },
  {
    desc: "strict-dynamic with no 'nonce-' should be blocked",
    result: "blocked",
    file: "file_strict_dynamic_script_inline.html",
    policy: "script-src 'strict-dynamic'"
  },
  {
    desc: "strict-dynamic with DOM events should be blocked",
    result: "blocked",
    file: "file_strict_dynamic_script_events.html",
    policy: "script-src 'strict-dynamic' 'nonce-foo'"
  },
  {
    // marquee is a special snowflake
    desc: "strict-dynamic with DOM events should be blocked (marquee)",
    result: "blocked",
    file: "file_strict_dynamic_script_events_marquee.html",
    policy: "script-src 'strict-dynamic' 'nonce-foo'"
  },
  {
    desc: "strict-dynamic with JS URLs should be blocked",
    result: "blocked",
    file: "file_strict_dynamic_js_url.html",
    policy: "script-src 'strict-dynamic' 'nonce-foo'"
  },
];

var counter = 0;
var curTest;

function loadNextTest() {
  if (counter == tests.length) {
    SimpleTest.finish();
    return;
  }

  curTest = tests[counter++];
  var src = "file_testserver.sjs?file=";
  // append the file that should be served
  src += escape("tests/dom/security/test/csp/" + curTest.file)
  // append the CSP that should be used to serve the file
  src += "&csp=" + escape(curTest.policy);

  document.getElementById("testframe").addEventListener("load", test);
  document.getElementById("testframe").src = src;
}

function test() {
  try {
    document.getElementById("testframe").removeEventListener('load', test);
    var testframe = document.getElementById("testframe");
    var divcontent = testframe.contentWindow.document.getElementById('testdiv').innerHTML;
    is(divcontent, curTest.result, curTest.desc);
  }
  catch (e) {
    ok(false, "ERROR: could not access content for test: '" + curTest.desc + "'");
  }
  loadNextTest();
}

// start running the tests
loadNextTest();

</script>
</body>
</html>

Messung V0.5

¤ Dauer der Verarbeitung: 0.24 Sekunden (vorverarbeitet) ¤

Wurzel

Suchen

Beweissystem der NASA

Beweissystem Isabelle

NIST Cobol Testsuite

Cephes Mathematical Library

Wiener Entwicklungsmethode

Haftungshinweis

Die Informationen auf dieser Webseite wurden nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit, noch Qualität der bereit gestellten Informationen zugesichert.