// custom *.sjs for Bug 1195172
// CSP: 'block-all-mixed-content'
const PRE_HEAD =
"<!DOCTYPE HTML>" +
'<html><head><meta charset="utf-8">' +
"<title>Bug 1195172 - CSP should block font from cache</title>";
const CSP_BLOCK =
'<meta http-equiv="Content-Security-Policy" content="font-src \'none\'">';
const CSP_ALLOW =
'<meta http-equiv="Content-Security-Policy" content="font-src *">';
const CSS =
"<style>" +
" @font-face {" +
" font-family: myFontTest;" +
" src: url(file_fontloader.woff);" +
" }" +
" div {" +
" font-family: myFontTest;" +
" }" +
"</style>";
const POST_HEAD_AND_BODY =
"</head>" +
"<body>" +
"<div> Just testing the font </div>" +
"</body>" +
"</html>";
function handleRequest(request, response) {
// avoid confusing cache behaviors
response.setHeader("Cache-Control", "no-cache", false);
var queryString = request.queryString;
if (queryString == "baseline") {
response.write(PRE_HEAD + POST_HEAD_AND_BODY);
return;
}
if (queryString == "no-csp") {
response.write(PRE_HEAD + CSS + POST_HEAD_AND_BODY);
return;
}
if (queryString == "csp-block") {
response.write(PRE_HEAD + CSP_BLOCK + CSS + POST_HEAD_AND_BODY);
return;
}
if (queryString == "csp-allow") {
response.write(PRE_HEAD + CSP_ALLOW + CSS + POST_HEAD_AND_BODY);
return;
}
// we should never get here, but just in case return something unexpected
response.write("do'h");
}
