mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-10-15 19:57:29 +09:00
import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo
This commit is contained in:
Roy Tam
commit
dcd9973243
150858 changed files with 23884658 additions and 0 deletions
|
|
@ -0,0 +1,24 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<!-- Programmatically converted from a WebKit Reftest, please forgive resulting idiosyncracies.-->
|
||||
<title>child-src-about-blank-allowed-by-default</title>
|
||||
<script src="/resources/testharness.js"></script>
|
||||
<script src="/resources/testharnessreport.js"></script>
|
||||
|
||||
<!-- enforcing policy:
|
||||
child-src 'none'; object-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self';
|
||||
-->
|
||||
<p>These frames should not be blocked by Content-Security-Policy.
|
||||
It's pointless to block about:blank iframes because
|
||||
blocking a frame just results in displaying about:blank anyway!
|
||||
</p>
|
||||
<iframe src="about:blank"></iframe>
|
||||
<object type="text/html" data="about:blank"></object>
|
||||
|
||||
<div id="log"></div>
|
||||
<script async defer src="../support/checkReport.sub.js?reportExists=false"></script>
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
Expires: Mon, 26 Jul 1997 05:00:00 GMT
|
||||
Cache-Control: no-store, no-cache, must-revalidate
|
||||
Cache-Control: post-check=0, pre-check=0, false
|
||||
Pragma: no-cache
|
||||
Set-Cookie: child-src-about-blank-allowed-by-default={{$id:uuid()}}; Path=/content-security-policy/child-src
|
||||
Content-Security-Policy: child-src 'none'; object-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<!-- Programmatically converted from a WebKit Reftest, please forgive resulting idiosyncracies.-->
|
||||
<title>child-src-about-blank-allowed-by-scheme</title>
|
||||
<script src="/resources/testharness.js"></script>
|
||||
<script src="/resources/testharnessreport.js"></script>
|
||||
|
||||
<!-- enforcing policy:
|
||||
child-src about:; script-src 'self' 'unsafe-inline'; connect-src 'self';
|
||||
-->
|
||||
<p>This frame should not be blocked by Content-Security-Policy.
|
||||
</p>
|
||||
<iframe src="about:blank"></iframe>
|
||||
<div id="log"></div>
|
||||
<script async defer src="../support/checkReport.sub.js?reportExists=false"></script>
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
Expires: Mon, 26 Jul 1997 05:00:00 GMT
|
||||
Cache-Control: no-store, no-cache, must-revalidate
|
||||
Cache-Control: post-check=0, pre-check=0, false
|
||||
Pragma: no-cache
|
||||
Set-Cookie: child-src-about-blank-allowed-by-scheme={{$id:uuid()}}; Path=/content-security-policy/child-src
|
||||
Content-Security-Policy: child-src about:; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
|
||||
|
|
@ -0,0 +1,63 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<title>child-src-allowed</title>
|
||||
<script src="/resources/testharness.js"></script>
|
||||
<script src="/resources/testharnessreport.js"></script>
|
||||
<script src='../support/logTest.sub.js?logs=["PASS IFrame %231 generated a load event."]'></script>
|
||||
<script>
|
||||
window.addEventListener("message", function(event) {
|
||||
alert_assert(event.data);
|
||||
}, false);
|
||||
|
||||
var t_alert = async_test('Expecting alerts: ["PASS"]');
|
||||
var expected_alerts = ["PASS"];
|
||||
|
||||
function alert_assert(msg) {
|
||||
t_alert.step(function() {
|
||||
if (msg.match(/^FAIL/i)) {
|
||||
assert_unreached(msg);
|
||||
t_alert.done();
|
||||
}
|
||||
for (var i = 0; i < expected_alerts.length; i++) {
|
||||
if (expected_alerts[i] == msg) {
|
||||
assert_true(expected_alerts[i] == msg);
|
||||
expected_alerts.splice(i, 1);
|
||||
if (expected_alerts.length == 0) {
|
||||
t_alert.done();
|
||||
}
|
||||
return;
|
||||
}
|
||||
}
|
||||
assert_unreached('unexpected alert: ' + msg);
|
||||
t_alert.done();
|
||||
});
|
||||
}
|
||||
|
||||
</script>
|
||||
<!-- enforcing policy:
|
||||
Content-Security-Policy: child-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self';
|
||||
-->
|
||||
<p>
|
||||
This iframe should be allowed.
|
||||
</p>
|
||||
<script>
|
||||
window.wasPostTestScriptParsed = true;
|
||||
var loads = 0;
|
||||
|
||||
function loadEvent() {
|
||||
loads++;
|
||||
log("PASS " + "IFrame #" + loads + " generated a load event.");
|
||||
}
|
||||
|
||||
</script>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<iframe src="/content-security-policy/blink-contrib/resources/postmessage-pass.html" onload="loadEvent()"></iframe>
|
||||
<div id="log"></div>
|
||||
<script async defer src="../support/checkReport.sub.js?reportExists=false"></script>
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
Expires: Mon, 26 Jul 1997 05:00:00 GMT
|
||||
Cache-Control: no-store, no-cache, must-revalidate
|
||||
Cache-Control: post-check=0, pre-check=0, false
|
||||
Pragma: no-cache
|
||||
Set-Cookie: child-src-allowed={{$id:uuid()}}; Path=/content-security-policy/child-src
|
||||
Content-Security-Policy: child-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<!-- Programmatically converted from a WebKit Reftest, please forgive resulting idiosyncracies.-->
|
||||
<title>child-src-blocked</title>
|
||||
<script src="/resources/testharness.js"></script>
|
||||
<script src="/resources/testharnessreport.js"></script>
|
||||
<script src='../support/logTest.sub.js?logs=["PASS IFrame %231 generated a load event."]'></script>
|
||||
<script>
|
||||
window.addEventListener("message", function(event) {
|
||||
alert_assert(event.data);
|
||||
}, false);
|
||||
|
||||
function alert_assert(msg) {
|
||||
t_log.step(function() {
|
||||
if (msg.match(/^FAIL/i)) {
|
||||
assert_unreached(msg);
|
||||
t_log.done();
|
||||
}
|
||||
for (var i = 0; i < expected_alerts.length; i++) {
|
||||
if (expected_alerts[i] == msg) {
|
||||
assert_true(expected_alerts[i] == msg);
|
||||
expected_alerts.splice(i, 1);
|
||||
if (expected_alerts.length == 0) {
|
||||
t_log.done();
|
||||
}
|
||||
return;
|
||||
}
|
||||
}
|
||||
assert_unreached('unexpected alert: ' + msg);
|
||||
t_log.done();
|
||||
});
|
||||
}
|
||||
|
||||
</script>
|
||||
<!-- enforcing policy:
|
||||
child-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self';
|
||||
-->
|
||||
<p>
|
||||
IFrames blocked by CSP should generate a 'load', not 'error' event, regardless of blocked state. This means they appear to be normal cross-origin loads, thereby not leaking URL information directly to JS.
|
||||
</p>
|
||||
<script>
|
||||
window.wasPostTestScriptParsed = true;
|
||||
var loads = 0;
|
||||
|
||||
function loadEvent() {
|
||||
loads++;
|
||||
log("PASS " + "IFrame #" + loads + " generated a load event.");
|
||||
}
|
||||
|
||||
</script>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<iframe src="/content-security-policy/blink-contrib/resources/postmessage-fail.html" onload="loadEvent()" onerror="log('FAIL')"></iframe>
|
||||
<div id="log"></div>
|
||||
<script async defer src="../support/checkReport.sub.js?reportExists=true&reportField=violated-directive&reportValue=child-src%20'none'"></script>
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
Expires: Mon, 26 Jul 1997 05:00:00 GMT
|
||||
Cache-Control: no-store, no-cache, must-revalidate
|
||||
Cache-Control: post-check=0, pre-check=0, false
|
||||
Pragma: no-cache
|
||||
Set-Cookie: child-src-blocked={{$id:uuid()}}; Path=/content-security-policy/child-src
|
||||
Content-Security-Policy: child-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>child-src-blocked</title>
|
||||
<script src="/resources/testharness.js"></script>
|
||||
<script src="/resources/testharnessreport.js"></script>
|
||||
<script src='../support/logTest.sub.js?logs=["PASS IFrame %231 generated a load event."]'></script>
|
||||
<script>
|
||||
window.addEventListener("message", function(event) {
|
||||
alert_assert(event.data);
|
||||
}, false);
|
||||
|
||||
function alert_assert(msg) {
|
||||
t_log.step(function() {
|
||||
if (msg.match(/^FAIL/i)) {
|
||||
assert_unreached(msg);
|
||||
t_log.done();
|
||||
}
|
||||
for (var i = 0; i < expected_alerts.length; i++) {
|
||||
if (expected_alerts[i] == msg) {
|
||||
assert_true(expected_alerts[i] == msg);
|
||||
expected_alerts.splice(i, 1);
|
||||
if (expected_alerts.length == 0) {
|
||||
t_log.done();
|
||||
}
|
||||
return;
|
||||
}
|
||||
}
|
||||
assert_unreached('unexpected alert: ' + msg);
|
||||
t_log.done();
|
||||
});
|
||||
}
|
||||
|
||||
</script>
|
||||
<!-- enforcing policy:
|
||||
frame-src 'none'; child-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self';
|
||||
-->
|
||||
<p>
|
||||
A more permissive child-src should not relax restrictions from a less-
|
||||
permissive frame-src. Directives still combine for least privilege, even when
|
||||
one obsoletes another.
|
||||
</p>
|
||||
<script>
|
||||
window.wasPostTestScriptParsed = true;
|
||||
var loads = 0;
|
||||
|
||||
function loadEvent() {
|
||||
loads++;
|
||||
log("PASS " + "IFrame #" + loads + " generated a load event.");
|
||||
}
|
||||
|
||||
</script>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<iframe src="/content-security-policy/blink-contrib/resources/postmessage-fail.html" onload="loadEvent()" onerror="log('FAIL')"></iframe>
|
||||
<div id="log"></div>
|
||||
<script async defer src="../support/checkReport.sub.js?reportExists=true&reportField=violated-directive&reportValue=frame-src%20'none'"></script>
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
Expires: Mon, 26 Jul 1997 05:00:00 GMT
|
||||
Cache-Control: no-store, no-cache, must-revalidate
|
||||
Cache-Control: post-check=0, pre-check=0, false
|
||||
Pragma: no-cache
|
||||
Set-Cookie: child-src-conflicting-frame-src={{$id:uuid()}}; Path=/content-security-policy/child-src
|
||||
Content-Security-Policy: frame-src 'none'; child-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<!-- Programmatically converted from a WebKit Reftest, please forgive resulting idiosyncracies.-->
|
||||
<title>child-src-cross-origin-load</title>
|
||||
<script src="/resources/testharness.js"></script>
|
||||
<script src="/resources/testharnessreport.js"></script>
|
||||
<script src='../support/logTest.sub.js?logs=["PASS IFrame %231 generated a load event.","PASS IFrame %232 generated a load event.","PASS IFrame %233 generated a load event."]'></script>
|
||||
<script>
|
||||
window.addEventListener("message", function(event) {
|
||||
alert_assert(event.data);
|
||||
}, false);
|
||||
|
||||
var t_alert = async_test('Expecting alerts: ["PASS","PASS"]');
|
||||
var expected_alerts = ["PASS", "PASS"];
|
||||
|
||||
function alert_assert(msg) {
|
||||
t_alert.step(function() {
|
||||
if (msg.match(/^FAIL/i)) {
|
||||
assert_unreached(msg);
|
||||
t_alert.done();
|
||||
}
|
||||
for (var i = 0; i < expected_alerts.length; i++) {
|
||||
if (expected_alerts[i] == msg) {
|
||||
assert_true(expected_alerts[i] == msg);
|
||||
expected_alerts.splice(i, 1);
|
||||
if (expected_alerts.length == 0) {
|
||||
t_alert.done();
|
||||
}
|
||||
return;
|
||||
}
|
||||
}
|
||||
assert_unreached('unexpected alert: ' + msg);
|
||||
t_alert.done();
|
||||
});
|
||||
}
|
||||
|
||||
</script>
|
||||
<!-- enforcing policy:
|
||||
child-src 'self' http://www1.{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe-inline'; connect-src 'self';
|
||||
-->
|
||||
<p>
|
||||
IFrames blocked by CSP should generate a 'load', not 'error' event, regardless of blocked state. This means they appear to be normal cross-origin loads, thereby not leaking URL information directly to JS.
|
||||
</p>
|
||||
<script>
|
||||
window.wasPostTestScriptParsed = true;
|
||||
var loads = 0;
|
||||
|
||||
function loadEvent() {
|
||||
loads++;
|
||||
log("PASS " + "IFrame #" + loads + " generated a load event.");
|
||||
if (loads == 3)
|
||||
log("TEST COMPLETE");
|
||||
}
|
||||
|
||||
</script>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<iframe src="/content-security-policy/blink-contrib/resources/postmessage-pass.html" onload="loadEvent()"></iframe>
|
||||
<iframe src="http://www1.{{host}}:{{ports[http][0]}}/content-security-policy/blink-contrib/resources/postmessage-pass.html" onload="loadEvent()"></iframe>
|
||||
<iframe src="http://www2.{{host}}:{{ports[http][0]}}/content-security-policy/blink-contrib/resources/postmessage-fail.html" onload="loadEvent()" onerror="log('FAIL')"></iframe>
|
||||
<div id="log"></div>
|
||||
<script async defer src="../support/checkReport.sub.js?reportExists=true&reportField=violated-directive&reportValue=child-src%20'self'"></script>
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
Expires: Mon, 26 Jul 1997 05:00:00 GMT
|
||||
Cache-Control: no-store, no-cache, must-revalidate
|
||||
Cache-Control: post-check=0, pre-check=0, false
|
||||
Pragma: no-cache
|
||||
Set-Cookie: child-src-cross-origin-load={{$id:uuid()}}; Path=/content-security-policy/child-src
|
||||
Content-Security-Policy: child-src 'self' http://www1.{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<title>child-src-worker-allowed</title>
|
||||
<script src="/resources/testharness.js"></script>
|
||||
<script src="/resources/testharnessreport.js"></script>
|
||||
<script src="../support/logTest.sub.js?logs=[]"></script>
|
||||
<script src='../support/alertAssert.sub.js?alerts=["PASS"]'></script>
|
||||
<!-- enforcing policy:
|
||||
child-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self';
|
||||
-->
|
||||
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<script>
|
||||
try {
|
||||
var foo = new Worker('http://{{host}}:{{ports[http][0]}}/content-security-policy/blink-contrib/resources/post-message.js');
|
||||
foo.onmessage = function(event) {
|
||||
alert_assert("PASS");
|
||||
};
|
||||
} catch (e) {
|
||||
alert_assert(e);
|
||||
}
|
||||
|
||||
</script>
|
||||
<div id="log"></div>
|
||||
<script async defer src="../support/checkReport.sub.js?reportExists=false"></script>
|
||||
</body>
|
||||
|
||||
</html>
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
Expires: Mon, 26 Jul 1997 05:00:00 GMT
|
||||
Cache-Control: no-store, no-cache, must-revalidate
|
||||
Cache-Control: post-check=0, pre-check=0, false
|
||||
Pragma: no-cache
|
||||
Set-Cookie: child-src-worker-allowed={{$id:uuid()}}; Path=/content-security-policy/child-src
|
||||
Content-Security-Policy: child-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
|
||||
|
|
@ -0,0 +1,35 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<title>child-src-worker-blocked</title>
|
||||
<script src="/resources/testharness.js"></script>
|
||||
<script src="/resources/testharnessreport.js"></script>
|
||||
<script src="../support/logTest.sub.js?logs=[]"></script>
|
||||
<script src='../support/alertAssert.sub.js?alerts=["PASS"]'></script>
|
||||
<!-- enforcing policy:
|
||||
child-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self';
|
||||
-->
|
||||
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<script>
|
||||
try {
|
||||
var foo = new Worker('http://{{host}}:{{ports[http][0]}}/content-security-policy/blink-contrib/resources/post-message.js');
|
||||
foo.onerror = function(event) {
|
||||
event.preventDefault();
|
||||
alert_assert("PASS");
|
||||
}
|
||||
foo.onmessage = function(event) {
|
||||
alert_assert("FAIL");
|
||||
};
|
||||
} catch (e) {
|
||||
alert_assert("PASS");
|
||||
}
|
||||
|
||||
</script>
|
||||
<div id="log"></div>
|
||||
<script async defer src="../support/checkReport.sub.js?reportExists=true&reportField=violated-directive&reportValue=child-src%20'none'"></script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -0,0 +1,6 @@
|
|||
Expires: Mon, 26 Jul 1997 05:00:00 GMT
|
||||
Cache-Control: no-store, no-cache, must-revalidate
|
||||
Cache-Control: post-check=0, pre-check=0, false
|
||||
Pragma: no-cache
|
||||
Set-Cookie: child-src-worker-blocked={{$id:uuid()}}; Path=/content-security-policy/child-src
|
||||
Content-Security-Policy: child-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
|
||||
Loading…
Add table
Add a link
Reference in a new issue