web-platform-tests · chromium-wpt-export-bot · Apr 23, 2026 · Apr 23, 2026
diff --git a/css/css-values/urls/cross-origin/url-import-cross-origin-anonymous-negative.sub.html b/css/css-values/urls/cross-origin/url-import-cross-origin-anonymous-negative.sub.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Request URL Modifiers: cross-origin(anonymous) negative test for @import</title>
+<link rel="help" href="https://drafts.csswg.org/css-values-5/#typedef-request-url-modifier-cross-origin-modifier">
+<link rel="match" href="/css/reference/ref-filled-green-100px-square.xht">
+<meta name="assert" content="cross-origin(anonymous) should block a cross-origin @import served without CORS headers.">
+<style>
+@import url("http://{{hosts[][]}}:{{ports[http][1]}}/css/css-values/urls/support/red-style.css" cross-origin(anonymous));
+div {
+  width: 100px;
+  height: 100px;
+  background-color: green;
+}
+</style>
+</head>
+<body>
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+<div></div>
+<script>
+window.addEventListener("load", () => {
+  document.documentElement.classList.remove("reftest-wait");
+});
+</script>
+</body>
+</html>
diff --git a/css/css-values/urls/cross-origin/url-import-cross-origin-anonymous.sub.html b/css/css-values/urls/cross-origin/url-import-cross-origin-anonymous.sub.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Request URL Modifiers: cross-origin(anonymous) for @import</title>
+<link rel="help" href="https://drafts.csswg.org/css-values-5/#typedef-request-url-modifier-cross-origin-modifier">
+<link rel="match" href="/css/reference/ref-filled-green-100px-square.xht">
+<meta name="assert" content="cross-origin(anonymous) should allow a cross-origin @import served with CORS headers.">
+<style>
+@import url("http://{{hosts[][]}}:{{ports[http][1]}}/css/css-values/urls/support/green-style.css?pipe=header(Access-Control-Allow-Origin,*)" cross-origin(anonymous));
+div {
+  width: 100px;
+  height: 100px;
+  background-color: red;
+}
+</style>
+</head>
+<body>
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+<div></div>
+<script>
+window.addEventListener("load", () => {
+  document.documentElement.classList.remove("reftest-wait");
+});
+</script>
+</body>
+</html>
diff --git a/css/css-values/urls/integrity/url-import-integrity-negative.sub.html b/css/css-values/urls/integrity/url-import-integrity-negative.sub.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Request URL Modifiers: integrity() negative test for @import</title>
+<link rel="help" href="https://drafts.csswg.org/css-values-5/#typedef-request-url-modifier-integrity-modifier">
+<link rel="match" href="/css/reference/ref-filled-green-100px-square.xht">
+<meta name="assert" content="An @import with a non-matching integrity() modifier should not apply the imported styles.">
+<style>
+@import url("http://{{hosts[][]}}:{{ports[http][0]}}/css/css-values/urls/support/red-style.css?pipe=header(Access-Control-Allow-Origin,*)" cross-origin(anonymous) integrity("sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="));
+div {
+  width: 100px;
+  height: 100px;
+  background-color: green;
+}
+</style>
+</head>
+<body>
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+<div></div>
+<script>
+window.addEventListener("load", () => {
+  document.documentElement.classList.remove("reftest-wait");
+});
+</script>
+</body>
+</html>
diff --git a/css/css-values/urls/integrity/url-import-integrity.sub.html b/css/css-values/urls/integrity/url-import-integrity.sub.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<title>Request URL Modifiers: integrity() for @import</title>
+<link rel="help" href="https://drafts.csswg.org/css-values-5/#typedef-request-url-modifier-integrity-modifier">
+<link rel="match" href="/css/reference/ref-filled-green-100px-square.xht">
+<meta name="assert" content="An @import with a matching integrity() modifier should apply the imported styles.">
+<style>
+@import url("http://{{hosts[][]}}:{{ports[http][0]}}/css/css-values/urls/support/green-style.css?pipe=header(Access-Control-Allow-Origin,*)" cross-origin(anonymous) integrity("sha256-Id1Hm8tP+9lRAbQlLxjIRmzsU5MK+hftN3wiKKt4Hf4="));
+div {
+  width: 100px;
+  height: 100px;
+  background-color: red;
+}
+</style>
+</head>
+<body>
+<p>Test passes if there is a filled green square and <strong>no red</strong>.</p>
+<div></div>
+<script>
+window.addEventListener("load", () => {
+  document.documentElement.classList.remove("reftest-wait");
+});
+</script>
+</body>
+</html>
diff --git a/css/css-values/urls/referrer-policy/no-referrer/url-font-referrer-policy.sub.html b/css/css-values/urls/referrer-policy/no-referrer/url-font-referrer-policy.sub.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<title>Request URL Modifiers: referrer-policy(no-referrer) for @font-face</title>
+<link rel="help" href="https://drafts.csswg.org/css-values-5/#typedef-request-url-modifier-referrer-policy-modifier">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<style>
+@font-face {
+  font-family: "TestFont";
+  src: url("http://{{hosts[][]}}:{{ports[http][1]}}/css/css-values/urls/support/font-referrer-policy.py?expected_referrer=none" cross-origin(anonymous) referrer-policy(no-referrer)) format("truetype");
+}
+.test { font-family: "TestFont"; }
+</style>
+<div class="test">X</div>
+<script>
+promise_test(async t => {
+  await document.fonts.ready;
+  assert_true(document.fonts.check("16px TestFont"),
+              "Font with referrer-policy(no-referrer) should load when server expects no referrer");
+}, "referrer-policy(no-referrer) sends no referrer for @font-face");
+</script>
diff --git a/css/css-values/urls/referrer-policy/no-referrer/url-import-referrer-policy.html b/css/css-values/urls/referrer-policy/no-referrer/url-import-referrer-policy.html
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<title>Request URL Modifiers: referrer-policy(no-referrer) for @import</title>
+<link rel="help" href="https://drafts.csswg.org/css-values-5/#typedef-request-url-modifier-referrer-policy-modifier">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<div id="test">X</div>
+<script>
+promise_test(async t => {
+  const url = `/css/css-values/urls/support/stylesheet-referrer-policy.py?expected_referrer=none`;
+  const style = document.createElement("style");
+  style.textContent = `@import url("${url}" referrer-policy(no-referrer));`;
+  const { promise, resolve, reject } = Promise.withResolvers();
+  style.onload = resolve;
+  style.onerror = reject;
+  document.head.prepend(style);
+  await promise;
+  assert_equals(
+    getComputedStyle(document.getElementById("test")).color,
+    "rgb(0, 128, 0)",
+    "@import with referrer-policy(no-referrer) should apply green style");
+}, "referrer-policy(no-referrer) sends no referrer for @import");
+</script>
diff --git a/css/css-values/urls/support/font-referrer-policy.py b/css/css-values/urls/support/font-referrer-policy.py
@@ -0,0 +1,39 @@
+import os.path
+
+HERE = os.path.dirname(__file__)
+WPT_ROOT = os.path.abspath(os.path.join(HERE, "../../../.."))
+
+def main(request, response):
+    expected_referrer = request.GET[b'expected_referrer']
+    actual_referrer = request.headers.get(b'referer', b'')
+
+    if expected_referrer == b'none':
+        match = actual_referrer == b''
+    elif expected_referrer == b'origin':
+        origin = request.GET[b'origin']
+        match = actual_referrer == origin
+    elif expected_referrer == b'url':
+        url = request.GET[b'url']
+        match = actual_referrer == url
+    else:
+        match = False
+
+    response.add_required_headers = False
+    response.writer.write_status(200)
+    response.writer.write_header(b"access-control-allow-origin", b"*")
+    response.writer.write_header(b"cache-control", b"no-cache; must-revalidate")
+
+    if match:
+        # Return a valid font.
+        font_path = os.path.join(WPT_ROOT, u"fonts", u"Ahem.ttf")
+        with open(font_path, u"rb") as f:
+            body = f.read()
+        response.writer.write_header(b"content-type", b"font/truetype")
+    else:
+        # Return an empty body, so the font fails to load.
+        body = b""
+        response.writer.write_header(b"content-type", b"text/plain")
+
+    response.writer.write_header(b"content-length", len(body))
+    response.writer.end_headers()
+    response.writer.write(body)
diff --git a/css/css-values/urls/support/green-style.css b/css/css-values/urls/support/green-style.css
@@ -0,0 +1 @@
+div { background-color: green !important; }
diff --git a/css/css-values/urls/support/red-style.css b/css/css-values/urls/support/red-style.css
@@ -0,0 +1 @@
+div { background-color: red !important; }
diff --git a/css/css-values/urls/support/stylesheet-referrer-policy.py b/css/css-values/urls/support/stylesheet-referrer-policy.py
@@ -0,0 +1,29 @@
+def main(request, response):
+    expected_referrer = request.GET[b'expected_referrer']
+    actual_referrer = request.headers.get(b'referer', b'')
+
+    if expected_referrer == b'none':
+        match = actual_referrer == b''
+    elif expected_referrer == b'origin':
+        origin = request.GET[b'origin']
+        match = actual_referrer == origin
+    elif expected_referrer == b'url':
+        url = request.GET[b'url']
+        match = actual_referrer == url
+    else:
+        match = False
+
+    response.add_required_headers = False
+    response.writer.write_status(200)
+    response.writer.write_header(b"access-control-allow-origin", b"*")
+    response.writer.write_header(b"content-type", b"text/css")
+    response.writer.write_header(b"cache-control", b"no-cache; must-revalidate")
+
+    if match:
+        body = b"#test { color: green; }"
+    else:
+        body = b"#test { color: red; }"
+
+    response.writer.write_header(b"content-length", len(body))
+    response.writer.end_headers()
+    response.writer.write(body)
diff --git a/css/css-values/urls/url-request-modifiers-import-parsing.sub.html b/css/css-values/urls/url-request-modifiers-import-parsing.sub.html
@@ -0,0 +1,76 @@
+<!DOCTYPE html>
+<title>Request URL Modifiers: @import parsing</title>
+<link rel="help" href="https://drafts.csswg.org/css-values-5/#request-url-modifiers">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+function test_import_valid(description, src, expected) {
+  test(t => {
+    const style = document.createElement("style");
+    style.textContent = `@import ${src};`;
+    document.head.appendChild(style);
+    t.add_cleanup(() => style.remove());
+    assert_equals(style.sheet.cssRules.length, 1, "should have one rule");
+    const rule = style.sheet.cssRules[0];
+    assert_equals(rule.type, CSSRule.IMPORT_RULE, "should be an @import rule");
+    if (expected !== undefined) {
+      assert_true(rule.cssText.includes(expected),
+          `cssText should contain "${expected}", got: ${rule.cssText}`);
+    }
+  }, description);
+}
+
+function test_import_invalid(description, src) {
+  test(t => {
+    const style = document.createElement("style");
+    style.textContent = `@import ${src};`;
+    document.head.appendChild(style);
+    t.add_cleanup(() => style.remove());
+    assert_equals(style.sheet.cssRules.length, 0, "should have no rules");
+  }, description);
+}
+
+test_import_valid(
+  "cross-origin(anonymous) in @import",
+  'url("http://{{hosts[][]}}:{{ports[http][0]}}/test.css" cross-origin(anonymous))');
+
+test_import_valid(
+  "referrer-policy(no-referrer) in @import",
+  'url("http://{{hosts[][]}}:{{ports[http][0]}}/test.css" referrer-policy(no-referrer))');
+
+test_import_valid(
+  "integrity() in @import",
+  'url("http://{{hosts[][]}}:{{ports[http][0]}}/test.css" integrity("sha384-foobar"))');
+
+test_import_valid(
+  "multiple modifiers in @import",
+  'url("http://{{hosts[][]}}:{{ports[http][0]}}/test.css" cross-origin(anonymous) referrer-policy(no-referrer))');
+
+test_import_valid(
+  "all three modifiers in @import",
+  'url("http://{{hosts[][]}}:{{ports[http][0]}}/test.css" cross-origin(anonymous) integrity("sha384-foobar") referrer-policy(no-referrer))');
+
+// Serialization round-trip
+test_import_valid(
+  "cross-origin(anonymous) serialized in @import cssText",
+  'url("http://{{hosts[][]}}:{{ports[http][0]}}/test.css" cross-origin(anonymous))',
+  'cross-origin(anonymous)');
+
+test_import_valid(
+  "multiple modifiers serialized in canonical order in @import cssText",
+  'url("http://{{hosts[][]}}:{{ports[http][0]}}/test.css" referrer-policy(no-referrer) cross-origin(anonymous))',
+  'cross-origin(anonymous) referrer-policy(no-referrer)');
+
+// Invalid cases
+test_import_invalid(
+  "duplicate cross-origin in @import",
+  'url("http://{{hosts[][]}}:{{ports[http][0]}}/test.css" cross-origin(anonymous) cross-origin(anonymous))');
+
+test_import_invalid(
+  "duplicate cross-origin in @import between referrer-policy",
+  'url("http://{{hosts[][]}}:{{ports[http][0]}}/test.css" cross-origin(anonymous) referrer-policy(no-referrer) cross-origin(anonymous))');
+
+test_import_invalid(
+  "unquoted url() with cross-origin in @import",
+  'url(http://{{hosts[][]}}:{{ports[http][0]}}/test.css cross-origin(anonymous))');
+</script>