Quelle test_form_submission.html Sprache: HTML

products/sources/formale Sprachen/C/Firefox/dom/security/test/https-first/test_form_submission.html

<!DOCTYPE HTML>
<html>
<head>
  <meta charset="utf-8">
  <title>Bug 1720103 - Https-first: Do not upgrade form submissions (for now)</title>
  <script src="/tests/SimpleTest/SimpleTest.js"></script>
  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<iframe style="width:100%;" id="testframe"></iframe>
<script class="testbody" type="text/javascript">
/*
* Description of the test:
* We test https-first behaviour with forms.
* We perform each test once with same origin and the second time
* with a cross origin. We perform two GET form requests and two POST
* form requests.
*/
SimpleTest.waitForExplicitFinish();
window.addEventListener("message", receiveMessage);

const SAME_ORIGIN = "http://example.com/tests/dom/security/test/https-first/file_form_submission.sjs";
const CROSS_ORIGIN = SAME_ORIGIN.replace(".com", ".org");
const Tests = [{
  // 1. Test GET, gets upgraded
    query: "?test=1",
    scheme: "https:",
    method: "GET",
    value: "test=success",
},
{
  // 2. Test GET, gets downgraded again
  // 2. a) If the second request is same-origin there is an upgrade exception
  //       so no upgrade is performed.
  // 2. b) If the submmission domain is different, the request is upgraded.
    query:"?test=2",
    scheme: "http:",
    method: "GET",
    value: "test=success"
},
{  // 3. Test POST formular, does not get upgraded
    query: "?test=3",
    scheme: "http:",
    method: "POST",
    value: "test=success"
},
{   // 4. Test POST formular, does not get upgraded
    query: "?test=4",
    scheme: "http:",
    method: "POST",
    value: "test=success"
},
];
let currentTest;
let counter = 0;
let testWin;
let sameOrigin = true;

// Verify that top-level request got the expected scheme and reached the correct location.
async function receiveMessage(event){
  let data = event.data;
  let origin = sameOrigin? SAME_ORIGIN : CROSS_ORIGIN
  let wantedScheme = currentTest.scheme;
  if (!sameOrigin && counter === 1) {
    // cross-origin still gets upgraded, same-origin has a stored exception
    // after the first fail
    // See 2. a) and 2. b) above.
    wantedScheme = "https:";
  }
  // Since the form is always sent to example.com we expect it here as location
  is(data.location.includes(SAME_ORIGIN.replace("http:", wantedScheme)), true,
  "Reached the correct location for " + currentTest.query );
  is(data.scheme, wantedScheme,`${currentTest.query} upgraded or downgraded to ` + wantedScheme);
  // Check that the form value is correct
  is(data.form, currentTest.value, "Form was transfered");
  testWin.close();
  // Flip origin flag
  sameOrigin ^= true;
  // Only go to next test if already sent same and cross origin request for current test
  if (sameOrigin) {
    counter++;
  }
  await SpecialPowers.removePermission(
    "https-only-load-insecure",
    origin
  );
  // Check if we have test left, if not finish the testing
  if (counter >= Tests.length) {
    window.removeEventListener("message", receiveMessage);
    SimpleTest.finish();
    return;
  }
  // If we didn't reached the end yet, run next test
  runTest();
}

function runTest() {
  currentTest = Tests[counter];
  // If sameOrigin flag is set make a origin request, else a cross origin request
  if (sameOrigin) {
    testWin= window.open(SAME_ORIGIN + currentTest.query, "_blank");
  } else {
    testWin= window.open(CROSS_ORIGIN + currentTest.query, "_blank");
  }
}

// Set prefs and start test
SpecialPowers.pushPrefEnv({ set: [
    ["dom.security.https_first", true],
    ["security.warn_submit_secure_to_insecure", false]
  ]}, runTest);

</script>
</body>
</html>

Messung V0.5

¤ Dauer der Verarbeitung: 0.4 Sekunden ¤

Wurzel

Suchen

Beweissystem der NASA

Beweissystem Isabelle

NIST Cobol Testsuite

Cephes Mathematical Library

Wiener Entwicklungsmethode

Haftungshinweis

Die Informationen auf dieser Webseite wurden nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit, noch Qualität der bereit gestellten Informationen zugesichert.

Bemerkung:

Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.