Add test to verify that link rel=compression-dictionary fetches can be blocked via connect-src

fred-wang · fred-wang · commit 1a5b8567c011 · 2026-07-15T14:54:11.000+02:00
diff --git a/fetch/compression-dictionary/dictionary-fetch-with-link-connect-src.tentative.https.html b/fetch/compression-dictionary/dictionary-fetch-with-link-connect-src.tentative.https.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8">
+<meta name="timeout" content="long"/>
+<script src="./resources/compression-dictionary-util.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<link rel="help" href="https://html.spec.whatwg.org/#processing-the-type-attribute">
+<link rel="help" href="https://github.com/whatwg/html/pull/11620">
+<link rel="help" href="https://github.com/whatwg/html/pull/11620">
+<script>
+  let blocked = [];
+  self.addEventListener("securitypolicyviolation", e => {
+    if (e.effectiveDirective === "connect-src") {
+      const url = new URL(e.blockedURI);
+      if (url.pathname.endsWith("Registration")) {
+        blocked.push(url.search);
+      }
+    }
+  });
+</script>
+<link rel="compression-dictionary" href="/blockedRegistration?blockedFromElement">
+<link rel="compression-dictionary" href="/allowedRegistration?allowedFromElement">
+<script>
+  promise_test(async t => {
+    await new Promise(resolve => addEventListener("load", resolve));
+    let expectedBlocked = [
+      "?blockedFromElement",
+      "?blockedFromHeader",
+    ];
+    await t.step_wait(_ => blocked.length >= expectedBlocked.length, "<link> violating connect-src should trigger CSP violations", 3000);
+    assert_array_equals(blocked.toSorted(), expectedBlocked);
+  }, "link rel=compression-dictionary can be blocked via connect-src.");
+</script>
diff --git a/fetch/compression-dictionary/dictionary-fetch-with-link-connect-src.tentative.https.html.headers b/fetch/compression-dictionary/dictionary-fetch-with-link-connect-src.tentative.https.html.headers
@@ -0,0 +1,3 @@
+Content-Security-Policy: connect-src *:*/allowedRegistration
+Link: </blockedRegistration?blockedFromHeader> ; rel="compression-dictionary"
+Link: </allowedRegistration?allowedFromHeader> ; rel="compression-dictionary"

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+Content-Security-Policy: connect-src :/allowedRegistration`
	`2`	`+Link: </blockedRegistration?blockedFromHeader> ; rel="compression-dictionary"`
	`3`	`+Link: </allowedRegistration?allowedFromHeader> ; rel="compression-dictionary"`