function testModeSameOrigin() { // Fetch spec Section 4, step 4, "request's mode is same-origin". var req = new Request("https://example.net", { mode: "same-origin" }); return fetch(req).then( function (res) {
ok( false, "Attempting to fetch a resource from a different origin with mode same-origin should fail."
);
}, function (e) {
ok(
e instanceof TypeError, "Attempting to fetch a resource from a different origin with mode same-origin should fail."
);
}
);
}
function testNoCorsCtor() { // Request constructor Step 19.1 var simpleMethods = ["GET", "HEAD", "POST"]; for (var i = 0; i < simpleMethods.length; ++i) { var r = new Request("http://example.com", {
method: simpleMethods[i],
mode: "no-cors",
});
ok( true, "no-cors Request with simple method " + simpleMethods[i] + " is allowed."
);
}
var otherMethods = ["DELETE", "OPTIONS", "PUT"]; for (var i = 0; i < otherMethods.length; ++i) { try { var r = new Request("http://example.com", {
method: otherMethods[i],
mode: "no-cors",
});
ok( false, "no-cors Request with non-simple method " +
otherMethods[i] + " is not allowed."
);
} catch (e) {
ok( true, "no-cors Request with non-simple method " +
otherMethods[i] + " is not allowed."
);
}
}
// Request constructor Step 19.2, check guarded headers. var r = new Request(".", { mode: "no-cors" });
r.headers.append("Content-Type", "multipart/form-data");
is(
r.headers.get("content-type"), "multipart/form-data", "Appending simple header should succeed"
);
r.headers.append("custom", "value");
ok(!r.headers.has("custom"), "Appending custom header should fail");
r.headers.append("DNT", "value");
ok(!r.headers.has("DNT"), "Appending forbidden header should fail");
}
var corsServerPath = "/tests/dom/security/test/cors/file_CrossSiteXHR_server.sjs?"; function testModeNoCors() { // Fetch spec, section 4, step 4, response tainting should be set opaque, so // that fetching leads to an opaque filtered response in step 8. var r = new Request("https://example.net" + corsServerPath + "status=200", {
mode: "no-cors",
}); return fetch(r).then( function (res) {
ok(
isOpaqueResponse(res), "no-cors Request fetch should result in opaque response"
);
}, function (e) {
ok(false, "no-cors Request fetch should not error");
}
);
}
var finalPromiseResolve, finalPromiseReject; var finalPromise = new Promise(function (res, rej) {
finalPromiseResolve = res;
finalPromiseReject = rej;
});
function makeRequest(test) {
req = { // Add a default query param just to make formatting the actual params // easier.
url: corsServerPath + "a=b",
method: test.method,
headers: test.headers,
withCred: test.withCred,
};
if (test.setCookie) {
req.url += "&setCookie=" + escape(test.setCookie);
} if (test.cookie) {
req.url += "&cookie=" + escape(test.cookie);
} if (test.noCookie) {
req.url += "&noCookie";
}
function testResponse(res, test) {
ok(test.pass, "Expected test to pass " + JSON.stringify(test));
is(res.status, 200, "wrong status in test for " + JSON.stringify(test));
is(res.statusText, "OK", "wrong status text for " + JSON.stringify(test)); return res.text().then(function (v) {
is(
v, "hello pass\n", "wrong text in test for " + JSON.stringify(test)
);
});
}
function runATest(tests, i) { var test = tests[i]; var request = makeRequest(test);
console.log(request.url);
fetch(request).then( function (res) {
testResponse(res, test).then(function () { if (i < tests.length - 1) {
runATest(tests, i + 1);
} else {
finalPromiseResolve();
}
});
}, function (e) {
ok(!test.pass, "Expected test to fail " + JSON.stringify(test));
ok(e instanceof TypeError, "Test should fail " + JSON.stringify(test)); if (i < tests.length - 1) {
runATest(tests, i + 1);
} else {
finalPromiseResolve();
}
}
);
}
runATest(tests, 0); return finalPromise;
}
function testModeCors() { var tests = [ // Plain request
{ pass: 1, method: "GET", noAllowPreflight: 1 },
fetches.push(
(function (test) { returnnew Promise(function (resolve) {
resolve( new Request(req.url, {
method: req.method,
mode: "cors",
headers: req.headers,
body: req.body,
})
);
})
.then(function (request) { return fetch(request);
})
.then(function (res) {
ok(test.pass, "Expected test to pass for " + JSON.stringify(test)); if (test.status) {
is(
res.status,
test.status, "wrong status in test for " + JSON.stringify(test)
);
is(
res.statusText,
test.statusMessage, "wrong status text for " + JSON.stringify(test)
);
} else {
is(
res.status,
200, "wrong status in test for " + JSON.stringify(test)
);
is(
res.statusText, "OK", "wrong status text for " + JSON.stringify(test)
);
} if (test.responseHeaders) { for (header in test.responseHeaders) { if (!test.expectedResponseHeaders.includes(header)) {
is(
res.headers.has(header), false, "|Headers.has()|wrong response header (" +
header + ") in test for " +
JSON.stringify(test)
);
} else {
is(
res.headers.get(header),
test.responseHeaders[header], "|Headers.get()|wrong response header (" +
header + ") in test for " +
JSON.stringify(test)
);
}
}
}
return res.text();
})
.then(function (v) { if (test.method !== "HEAD") {
is(
v, "hello pass\n", "wrong responseText in test for " + JSON.stringify(test)
);
} else {
is(
v, "", "wrong responseText in HEAD test for " + JSON.stringify(test)
);
}
})
.catch(function (e) {
ok(!test.pass, "Expected test failure for " + JSON.stringify(test));
ok(
e instanceof TypeError, "Exception should be TypeError for " + JSON.stringify(test)
);
});
})(test)
);
}
return Promise.all(fetches);
}
function testCrossOriginCredentials() { var origin = self.location.origin;
function testResponse(res, test) {
ok(test.pass, "Expected test to pass for " + JSON.stringify(test));
is(res.status, 200, "wrong status in test for " + JSON.stringify(test));
is(res.statusText, "OK", "wrong status text for " + JSON.stringify(test)); return res.text().then(function (v) {
is(
v, "hello pass\n", "wrong text in test for " + JSON.stringify(test)
);
});
}
function runATest(tests, i) { var test = tests[i]; var request = makeRequest(test);
fetch(request).then( function (res) {
testResponse(res, test).then(function () { if (i < tests.length - 1) {
runATest(tests, i + 1);
} else {
finalPromiseResolve();
}
});
}, function (e) {
ok(!test.pass, "Expected test failure for " + JSON.stringify(test));
ok(
e instanceof TypeError, "Exception should be TypeError for " + JSON.stringify(test)
); if (i < tests.length - 1) {
runATest(tests, i + 1);
} else {
finalPromiseResolve();
}
}
);
}
var fetches = []; for (test of tests) {
req = {
url:
test.hops[0].server +
corsServerPath + "hop=1&hops=" +
escape(JSON.stringify(test.hops)),
method: test.method,
headers: test.headers,
body: test.body,
};
if (test.headers) {
req.url += "&headers=" + escape(JSON.stringify(test.headers));
}
if (test.pass) { if (test.body) {
req.url += "&body=" + escape(test.body);
}
}
var request = new Request(req.url, {
method: req.method,
headers: req.headers,
body: req.body,
});
fetches.push(
(function (request, test) { return fetch(request).then( function (res) {
ok(test.pass, "Expected test to pass for " + JSON.stringify(test));
is(
res.status,
200, "wrong status in test for " + JSON.stringify(test)
);
is(
res.statusText, "OK", "wrong status text for " + JSON.stringify(test)
);
is(
res.type, "cors", "wrong response type for " + JSON.stringify(test)
); var reqHost = new URL(req.url).host; // If there is a service worker present, the redirections will be // transparent, assuming that the original request is to the current // site and would be intercepted. if (isSWPresent) { if (reqHost === location.host) {
is( new URL(res.url).host,
reqHost, "Response URL should be original URL with a SW present"
);
}
} else {
is( new URL(res.url).host, new URL(test.hops[test.hops.length - 1].server).host, "Response URL should be redirected URL"
);
} return res.text().then(function (v) {
is(
v, "hello pass\n", "wrong responseText in test for " + JSON.stringify(test)
);
});
}, function (e) {
ok(!test.pass, "Expected test failure for " + JSON.stringify(test));
ok(
e instanceof TypeError, "Exception should be TypeError for " + JSON.stringify(test)
);
}
);
})(request, test)
);
}
return Promise.all(fetches);
}
function testNoCORSRedirects() { var origin = self.location.origin;
var fetches = []; for (test of tests) {
req = {
url:
test.hops[0].server +
corsServerPath + "hop=1&hops=" +
escape(JSON.stringify(test.hops)),
method: test.method,
headers: test.headers,
body: test.body,
};
if (test.headers) {
req.url += "&headers=" + escape(JSON.stringify(test.headers));
}
if (test.pass) { if (test.body) {
req.url += "&body=" + escape(test.body);
}
}
fetches.push(
(function (req, test) { returnnew Promise(function (resolve, reject) {
resolve( new Request(req.url, {
mode: "no-cors",
method: req.method,
headers: req.headers,
body: req.body,
})
);
})
.then(function (request) { return fetch(request);
})
.then( function (res) {
ok(
test.pass, "Expected test to pass for " + JSON.stringify(test)
); // All requests are cross-origin no-cors, we should always have // an opaque response here. All values on the opaque response // should be hidden.
is(
res.type, "opaque", "wrong response type for " + JSON.stringify(test)
);
is(
res.status,
0, "wrong status in test for " + JSON.stringify(test)
);
is(
res.statusText, "", "wrong status text for " + JSON.stringify(test)
);
is(res.url, "", "wrong response url for " + JSON.stringify(test)); return res.text().then(function (v) {
is(
v, "", "wrong responseText in test for " + JSON.stringify(test)
);
});
}, function (e) {
ok(
!test.pass, "Expected test failure for " + JSON.stringify(test)
);
ok(
e instanceof TypeError, "Exception should be TypeError for " + JSON.stringify(test)
);
}
);
})(req, test)
);
}
return Promise.all(fetches);
}
function testReferrer() { var referrer; if (self && self.location) {
referrer = self.location.href;
} else {
referrer = document.documentURI;
}
var dict = {
Referer: referrer,
}; return fetch(
corsServerPath + "headers=" + encodeURIComponent(JSON.stringify(dict))
).then( function (res) {
is(res.status, 200, "expected correct referrer header to be sent");
dump(res.statusText);
}, function (e) {
ok(false, "expected correct referrer header to be sent");
}
);
}
function runTest() {
testNoCorsCtor();
let promise = Promise.resolve(); if (typeof SpecialPowers === "object") {
promise = SpecialPowers.pushPrefEnv({ // Bug 1617611: Fix all the tests broken by "cookies SameSite=lax by default"
set: [["network.cookie.sameSite.laxByDefault", false]],
});
}
return promise
.then(testModeSameOrigin)
.then(testModeNoCors)
.then(testModeCors)
.then(testSameOriginCredentials)
.then(testCrossOriginCredentials)
.then(testModeNoCorsCredentials)
.then(testCORSRedirects)
.then(testNoCORSRedirects)
.then(testReferrer); // Put more promise based tests here.
}
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.
