Quelle test_base-uri.html Sprache: HTML

products/sources/formale Sprachen/C/Firefox/dom/security/test/csp/test_base-uri.html

<!DOCTYPE HTML>
<html>
<head>
  <title>Bug 1045897 - Test CSP base-uri directive</title>
  
  <script src="/tests/SimpleTest/SimpleTest.js"></script>
  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
  <p id="display"></p>
  <div id="content" style="visibility: hidden">
    <iframe style="width:100%;" id="testframe"></iframe>
  </div>

<script class="testbody" type="text/javascript">

/*
* Description of the test:
* We load a page in an iframe (served over http://example.com) that tries to
* modify the 'base' either through setting or also removing the base-uri. We
* load that page using different policies and verify that setting the base-uri
* is correctly blocked by CSP.
*/

SimpleTest.waitForExplicitFinish();

var tests = [
  { csp: "base-uri http://mochi.test;",
    base1: "http://mochi.test",
    base2: "",
    action: "enforce-csp",
    result: "http://mochi.test",
    desc: "CSP allows base uri"
  },
  { csp: "base-uri http://example.com;",
    base1: "http://mochi.test",
    base2: "",
    action: "enforce-csp",
    result: "http://example.com",
    desc: "CSP blocks base uri"
  },
  { csp: "base-uri https:",
    base1: "http://mochi.test",
    base2: "",
    action: "enforce-csp",
    result: "http://example.com",
    desc: "CSP blocks http base"
  },
  { csp: "base-uri 'none'",
    base1: "http://mochi.test",
    base2: "",
    action: "enforce-csp",
    result: "http://example.com",
    desc: "CSP allows no base modification"
  },
  { csp: "",
    base1: "http://foo:foo/",
    base2: "",
    action: "enforce-csp",
    result: "http://example.com",
    desc: "Invalid base should be ignored"
  },
  { csp: "base-uri http://mochi.test",
    base1: "http://mochi.test",
    base2: "http://test1.example.com",
    action: "remove-base1",
    result: "http://example.com",
    desc: "Removing first base should result in fallback base"
  },
  { csp: "",
    base1: "http://mochi.test",
    base2: "http://test1.example.com",
    action: "remove-base1",
    result: "http://test1.example.com",
    desc: "Removing first base should result in the second base"
  },
];

// initializing to -1 so we start at index 0 when we start the test
var counter = -1;

function finishTest() {
  window.removeEventListener("message", receiveMessage);
  SimpleTest.finish();
}

// a postMessage handler that is used by sandboxed iframes without
// 'allow-same-origin' to bubble up results back to this main page.
window.addEventListener("message", receiveMessage);
function receiveMessage(event) {
  var result = event.data.result;
  // we only care about the base uri, so instead of comparing the complete uri
  // we just make sure that the base is correct which is sufficient here.
  ok(result.startsWith(tests[counter].result),
     `${tests[counter].desc}: Expected a base URI that starts
      with ${tests[counter].result} but got ${result}`);
  loadNextTest();
}

function loadNextTest() {
  counter++;
  if (counter == tests.length) {
    finishTest();
    return;
  }
  var src = "http://example.com/tests/dom/security/test/csp/file_base_uri_server.sjs";
  // append the CSP that should be used to serve the file
  // please note that we have to include 'unsafe-inline' to permit sending the postMessage
  src += "?csp=" + escape("script-src 'unsafe-inline'; " + tests[counter].csp);
  // append potential base tags
  src += "&base1=" + escape(tests[counter].base1);
  src += "&base2=" + escape(tests[counter].base2);
  // append potential action
  src += "&action=" + escape(tests[counter].action);

  document.getElementById("testframe").src = src;
}

// start running the tests
loadNextTest();

</script>
</body>
</html>

Messung V0.5

¤ Dauer der Verarbeitung: 0.0 Sekunden (vorverarbeitet) ¤

Wurzel

Suchen

Beweissystem der NASA

Beweissystem Isabelle

NIST Cobol Testsuite

Cephes Mathematical Library

Wiener Entwicklungsmethode

Haftungshinweis

Die Informationen auf dieser Webseite wurden nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit, noch Qualität der bereit gestellten Informationen zugesichert.

Bemerkung:

Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.