Add test to verify that link rel=compression-dictionary fetches can be blocked via connect-src

fred-wang · fred-wang · commit 493a4547e1c5 · 2026-07-17T15:32:37.000+02:00
diff --git a/fetch/compression-dictionary/dictionary-fetch-with-link-connect-src.tentative.https.html b/fetch/compression-dictionary/dictionary-fetch-with-link-connect-src.tentative.https.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<head>
+<meta charset="utf-8">
+<meta name="timeout" content="long"/>
+<script src="./resources/compression-dictionary-util.sub.js"></script>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<link rel="help" href="https://w3c.github.io/webappsec-csp/#directive-connect-src">
+<link rel="help" href="https://github.com/whatwg/fetch/pull/1854">
+<link rel="help" href="https://github.com/whatwg/html/pull/11620">
+<link rel="compression-dictionary" href="/blockedRegistration?blockedFromElement">
+<link rel="compression-dictionary" href="/allowedRegistration?allowedFromElement">
+<script>
+  let blocked = [];
+  const observer = new ReportingObserver(reports => {
+    for (const report of reports) {
+       if (report.body.effectiveDirective === "connect-src") {
+         const url = new URL(report.body.blockedURL);
+         if (url.pathname.endsWith("Registration")) {
+           blocked.push(url.search);
+        }
+       }
+    }
+  }, {types:["csp-violation"], buffered: true});
+  observer.observe();
+
+  // Link from HTTP headers are only loaded after page, so don't ever try to
+  // run the test before.
+  promise_setup(_ => new Promise(resolve => {
+    if (document.readyState === 'complete') {
+      resolve();
+    } else {
+      addEventListener("load", resolve);
+    }
+  }));
+
+  promise_test(async t => {
+    let expectedBlocked = [
+      "?blockedFromElement",
+      "?blockedFromHeader",
+    ];
+    await t.step_wait(_ => blocked.length >= expectedBlocked.length, "<link> violating connect-src should trigger CSP violations", 3000);
+    assert_array_equals(blocked.toSorted(), expectedBlocked);
+  }, "link rel=compression-dictionary can be blocked via connect-src.");
+</script>
diff --git a/fetch/compression-dictionary/dictionary-fetch-with-link-connect-src.tentative.https.html.headers b/fetch/compression-dictionary/dictionary-fetch-with-link-connect-src.tentative.https.html.headers
@@ -0,0 +1,3 @@
+Content-Security-Policy: connect-src *:*/allowedRegistration
+Link: </blockedRegistration?blockedFromHeader> ; rel="compression-dictionary"
+Link: </allowedRegistration?allowedFromHeader> ; rel="compression-dictionary"

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+Content-Security-Policy: connect-src :/allowedRegistration`
	`2`	`+Link: </blockedRegistration?blockedFromHeader> ; rel="compression-dictionary"`
	`3`	`+Link: </allowedRegistration?allowedFromHeader> ; rel="compression-dictionary"`