Quelle test_bug888172.html Sprache: HTML

products/Sources/formale Sprachen/C/Firefox/dom/security/test/csp/test_bug888172.html

<!DOCTYPE HTML>
<html>
<head>
  <title>Bug 888172 - CSP 1.0 does not process 'unsafe-inline' or 'unsafe-eval' for default-src</title>
  <script src="/tests/SimpleTest/SimpleTest.js"></script>
  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<p id="display"></p>
<div id="content" style="display: none">
</div>

<iframe style="width:100%;" id='testframe1'></iframe>
<iframe style="width:100%;" id='testframe2'></iframe>
<iframe style="width:100%;" id='testframe3'></iframe>
<script class="testbody" type="text/javascript">

//////////////////////////////////////////////////////////////////////
// set up and go
SimpleTest.waitForExplicitFinish();

// utilities for check functions
// black means the style wasn't applied, applied styles are green
var green = 'rgb(0, 128, 0)';
var black = 'rgb(0, 0, 0)';

function getElementColorById(doc, id) {
  return window.getComputedStyle(doc.contentDocument.getElementById(id)).color;
}

// We test both script and style execution by observing changes in computed styles
function checkDefaultSrcOnly() {
  var testframe = document.getElementById('testframe1');

  ok(getElementColorById(testframe, 'unsafe-inline-script') === green, "Inline script should be allowed");
  ok(getElementColorById(testframe, 'unsafe-eval-script')  === green, "Eval should be allowed");
  ok(getElementColorById(testframe, 'unsafe-inline-style') === green, "Inline style should be allowed");

  document.getElementById('testframe2').src = 'file_bug888172.sjs?csp=' +
    escape("default-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'self'");
  document.getElementById('testframe2').addEventListener('load', checkDefaultSrcWithScriptSrc);
}

function checkDefaultSrcWithScriptSrc() {
  var testframe = document.getElementById('testframe2');

  ok(getElementColorById(testframe, 'unsafe-inline-script') === black, "Inline script should be blocked");
  ok(getElementColorById(testframe, 'unsafe-eval-script')  === black, "Eval should be blocked");
  ok(getElementColorById(testframe, 'unsafe-inline-style') === green, "Inline style should be allowed");

  document.getElementById('testframe3').src = 'file_bug888172.sjs?csp=' +
    escape("default-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self'");
  document.getElementById('testframe3').addEventListener('load', checkDefaultSrcWithStyleSrc);
}

function checkDefaultSrcWithStyleSrc() {
  var testframe = document.getElementById('testframe3');

  ok(getElementColorById(testframe, 'unsafe-inline-script') === green, "Inline script should be allowed");
  ok(getElementColorById(testframe, 'unsafe-eval-script')  === green, "Eval should be allowed");
  ok(getElementColorById(testframe, 'unsafe-inline-style') === black, "Inline style should be blocked");

  // last test calls finish
  SimpleTest.finish();
}

document.getElementById('testframe1').src = 'file_bug888172.sjs?csp=' +
  escape("default-src 'self' 'unsafe-inline' 'unsafe-eval'");
document.getElementById('testframe1').addEventListener('load', checkDefaultSrcOnly);
</script>
</pre>
</body>
</html>

Messung V0.5

¤ Dauer der Verarbeitung: 0.3 Sekunden ¤

Wurzel

Suchen

Beweissystem der NASA

Beweissystem Isabelle

NIST Cobol Testsuite

Cephes Mathematical Library

Wiener Entwicklungsmethode

Haftungshinweis

Die Informationen auf dieser Webseite wurden nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit, noch Qualität der bereit gestellten Informationen zugesichert.

Bemerkung:

Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.