Skip to content

Commit c658198

Browse files
lukewarlowlukewarlow
authored
Add TT reporting tests for Worker eval and new Function() (#51425)
1 parent 2c7f8b0 commit c658198

16 files changed

+162
-57
lines changed

‎trusted-types/support/trusted-types-reporting-for-eval-worker.js

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
const testSetupPolicy = trustedTypes.createPolicy("p", { createScriptURL: s => s });
2+
3+
importScripts(testSetupPolicy.createScriptURL("/resources/testharness.js"));
4+
importScripts(testSetupPolicy.createScriptURL("helper.sub.js"));
5+
importScripts(testSetupPolicy.createScriptURL("csp-violations.js"));
6+
7+
importScripts(testSetupPolicy.createScriptURL(
8+
"trusted-types-reporting-for-eval.js"
9+
));
10+
11+
done();

‎trusted-types/support/trusted-types-reporting-for-eval-worker.js.headers

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Content-Security-Policy: require-trusted-types-for 'script';
2+
Content-Security-Policy: connect-src 'none'

‎trusted-types/support/trusted-types-reporting-for-eval.js

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
const policy = trustedTypes.createPolicy("dummy", { createScript: x => x });
2+
3+
promise_test(async t => {
4+
let beacon = 'never_overwritten2';
5+
await no_trusted_type_violation_for(_ =>
6+
eval(policy.createScript('beacon="i ran"'))
7+
);
8+
assert_equals(beacon, 'i ran');
9+
}, "No violation reported for eval with TrustedScript.");
10+
11+
promise_test(async t => {
12+
const input = 'beacon="should not run"';
13+
let beacon = 'never_overwritten';
14+
let violation = await trusted_type_violation_for(EvalError, _ =>
15+
eval(input)
16+
);
17+
assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'"));
18+
assert_equals(violation.blockedURI, "trusted-types-sink");
19+
assert_equals(violation.sample, `eval|${clipSampleIfNeeded(input)}`);
20+
assert_equals(beacon, 'never_overwritten');
21+
}, "Violation report for eval with plain string.");

‎trusted-types/support/trusted-types-reporting-for-function-constructor-worker.js

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
const testSetupPolicy = trustedTypes.createPolicy("p", { createScriptURL: s => s });
2+
3+
importScripts(testSetupPolicy.createScriptURL("/resources/testharness.js"));
4+
importScripts(testSetupPolicy.createScriptURL("helper.sub.js"));
5+
importScripts(testSetupPolicy.createScriptURL("csp-violations.js"));
6+
7+
importScripts(testSetupPolicy.createScriptURL(
8+
"trusted-types-reporting-for-function-constructor.js"
9+
));
10+
11+
done();

‎trusted-types/support/trusted-types-reporting-for-function-constructor-worker.js.headers

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Content-Security-Policy: require-trusted-types-for 'script';
2+
Content-Security-Policy: connect-src 'none'

‎trusted-types/support/trusted-types-reporting-for-function-constructor.js

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
const policy = trustedTypes.createPolicy("dummy", { createScript: x => x });
2+
3+
const AsyncFunction = async function() {}.constructor;
4+
const GeneratorFunction = function*() {}.constructor;
5+
const AsyncGeneratorFunction = async function*() {}.constructor;
6+
7+
const input = `return${';'.repeat(100)}`;
8+
[Function, AsyncFunction, GeneratorFunction, AsyncGeneratorFunction].forEach(functionConstructor => {
9+
promise_test(async t => {
10+
await no_trusted_type_violation_for(_ =>
11+
new functionConstructor(policy.createScript(input))
12+
);
13+
}, `No violation reported for ${functionConstructor.name} with TrustedScript.`);
14+
15+
promise_test(async t => {
16+
await no_trusted_type_violation_for(_ =>
17+
new functionConstructor(policy.createScript('a'), policy.createScript(input))
18+
);
19+
}, `No violation reported for ${functionConstructor.name} with multiple TrustedScript args.`);
20+
21+
promise_test(async t => {
22+
let violation = await trusted_type_violation_for(EvalError, _ =>
23+
new functionConstructor(input)
24+
);
25+
assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'"));
26+
assert_equals(violation.blockedURI, "trusted-types-sink");
27+
assert_equals(violation.sample, `Function|${clipSampleIfNeeded(`(\n) {\n${input}\n}`)}`);
28+
}, `Violation report for ${functionConstructor.name} with plain string.`);
29+
});

‎trusted-types/trusted-types-eval-reporting.html

-53
This file was deleted.

‎trusted-types/trusted-types-eval-reporting.html.headers

-4
This file was deleted.

‎trusted-types/trusted-types-reporting-for-DedicatedWorker-eval.html

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<body>
5+
<script>
6+
fetch_tests_from_worker(new Worker(
7+
"support/trusted-types-reporting-for-eval-worker.js"
8+
));
9+
</script>

‎trusted-types/trusted-types-reporting-for-DedicatedWorker-function-constructor.html

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<body>
5+
<script>
6+
fetch_tests_from_worker(new Worker(
7+
"support/trusted-types-reporting-for-function-constructor-worker.js"
8+
));
9+
</script>

‎trusted-types/trusted-types-reporting-for-ServiceWorker-eval.https.html

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<body>
5+
<script>
6+
// Cargo-culted from code generated from "META: worker".
7+
(async function() {
8+
const scope = 'support/some/scope/for/this/test';
9+
let reg = await navigator.serviceWorker.getRegistration(scope);
10+
if (reg) await reg.unregister();
11+
reg = await navigator.serviceWorker.register(
12+
"support/trusted-types-reporting-for-eval-worker.js", {scope});
13+
fetch_tests_from_worker(reg.installing);
14+
})();
15+
</script>

‎trusted-types/trusted-types-reporting-for-ServiceWorker-function-constructor.html

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<body>
5+
<script>
6+
// Cargo-culted from code generated from "META: worker".
7+
(async function() {
8+
const scope = 'support/some/scope/for/this/test';
9+
let reg = await navigator.serviceWorker.getRegistration(scope);
10+
if (reg) await reg.unregister();
11+
reg = await navigator.serviceWorker.register(
12+
"support/trusted-types-reporting-for-function-constructor-worker.js", {scope});
13+
fetch_tests_from_worker(reg.installing);
14+
})();
15+
</script>

‎trusted-types/trusted-types-reporting-for-SharedWorker-eval.html

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<body>
5+
<script>
6+
fetch_tests_from_worker(new SharedWorker(
7+
"support/trusted-types-reporting-for-eval-worker.js"
8+
));
9+
</script>

‎trusted-types/trusted-types-reporting-for-SharedWorker-function-constructor.html

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<body>
5+
<script>
6+
fetch_tests_from_worker(new SharedWorker(
7+
"support/trusted-types-reporting-for-function-constructor-worker.js"
8+
));
9+
</script>

‎trusted-types/trusted-types-reporting-for-Window-eval.html

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="support/helper.sub.js"></script>
5+
<script src="support/csp-violations.js"></script>
6+
7+
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'; connect-src 'none';">
8+
<body>
9+
<script src="support/trusted-types-reporting-for-eval.js">
10+
</script>

‎trusted-types/trusted-types-reporting-for-Window-function-constructor.html

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="support/helper.sub.js"></script>
5+
<script src="support/csp-violations.js"></script>
6+
7+
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'; connect-src 'none';">
8+
<body>
9+
<script src="support/trusted-types-reporting-for-function-constructor.js">
10+
</script>

0 commit comments

Comments
 (0)