<!
DOCTYPE HTML>
<
html>
<
head>
<
meta charset=
"utf-8">
<
title>Bug 1720103 - Https-first: Do not upgrade
form submissions (for now)</
title>
<
script src=
"/tests/SimpleTest/SimpleTest.js"></
script>
<
link rel=
"stylesheet" type=
"text/css" href=
"/tests/SimpleTest/test.css" />
</
head>
<
body>
<
iframe style=
"width:100%;" id=
"testframe"></
iframe>
<
script class=
"testbody" type=
"text/javascript">
/*
* Description of the test:
* We test https-first behaviour with forms.
* We perform each test once with same origin and the second
time
* with a cross origin. We perform two GET
form requests and two POST
*
form requests.
*/
SimpleTest.waitForExplicitFinish();
window.addEventListener(
"message", receiveMessage);
const SAME_ORIGIN =
"http://example.com/tests/dom/security/test/https-first/file_form_submission.sjs";
const CROSS_ORIGIN = SAME_ORIGIN.replace(
".com",
".org");
const Tests = [{
// 1. Test GET, gets upgraded
query:
"?test=1",
scheme:
"https:",
method:
"GET",
value:
"test=success",
},
{
// 2. Test GET, gets downgraded again
// 2. a) If the second request is same-origin there is an upgrade exception
// so no upgrade is performed.
// 2. b) If the submmission domain is different, the request is upgraded.
query:
"?test=2",
scheme:
"http:",
method:
"GET",
value:
"test=success"
},
{ // 3. Test POST formular, does not get upgraded
query:
"?test=3",
scheme:
"http:",
method:
"POST",
value:
"test=success"
},
{ // 4. Test POST formular, does not get upgraded
query:
"?test=4",
scheme:
"http:",
method:
"POST",
value:
"test=success"
},
];
let currentTest;
let counter = 0;
let testWin;
let sameOrigin = true;
// Verify that top-level request got the expected scheme and reached the correct location.
async function receiveMessage(event){
let data = event.data;
let origin = sameOrigin? SAME_ORIGIN : CROSS_ORIGIN
let wantedScheme = currentTest.scheme;
if (!sameOrigin && counter === 1) {
// cross-origin still gets upgraded, same-origin has a stored exception
// after the first fail
// See 2. a) and 2. b) above.
wantedScheme =
"https:";
}
// Since the
form is always sent to example.com we expect it here as location
is(data.location.includes(SAME_ORIGIN.replace(
"http:", wantedScheme)), true,
"Reached the correct location for " + currentTest.query );
is(data.scheme, wantedScheme,`${currentTest.query} upgraded or downgraded to ` + wantedS
cheme);
// Check that the form value is correct
is(data.form, currentTest.value, "Form was transfered");
testWin.close();
// Flip origin flag
sameOrigin ^= true;
// Only go to next test if already sent same and cross origin request for current test
if (sameOrigin) {
counter++;
}
await SpecialPowers.removePermission(
"https-only-load-insecure",
origin
);
// Check if we have test left, if not finish the testing
if (counter >= Tests.length) {
window.removeEventListener("message", receiveMessage);
SimpleTest.finish();
return;
}
// If we didn't reached the end yet, run next test
runTest();
}
function runTest() {
currentTest = Tests[counter];
// If sameOrigin flag is set make a origin request, else a cross origin request
if (sameOrigin) {
testWin= window.open(SAME_ORIGIN + currentTest.query, "_blank");
} else {
testWin= window.open(CROSS_ORIGIN + currentTest.query, "_blank");
}
}
// Set prefs and start test
SpecialPowers.pushPrefEnv({ set: [
["dom.security.https_first", true],
["security.warn_submit_secure_to_insecure", false]
]}, runTest);
</script>
</body>
</html>
