wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 23:38:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo

Browse source
This commit is contained in:
Roy Tam 2018-01-19 03:59:58 +08:00
commit dcd9973243
150858 changed files with 23884658 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
testing/web-platform/tests/content-security-policy/script-src/10_1_support_1.js Normal file
View file

@ -0,0 +1 @@
var dataScriptRan = false;

3
testing/web-platform/tests/content-security-policy/script-src/10_1_support_2.js Normal file
View file

@ -0,0 +1,3 @@
test(function () {
assert_true(dataScriptRan, "data script ran");
}, "Verify that data: as script src runs with this policy");

18
testing/web-platform/tests/content-security-policy/script-src/addInlineTestsWithDOMManipulation.js Normal file
View file

@ -0,0 +1,18 @@
(function () {
var dmTest = async_test("DOM manipulation inline tests");
var attachPoint = document.getElementById('attachHere');
var inlineScript = document.createElement('script');
var scriptText = document.createTextNode('dmTest.step(function() {assert_unreached("Unsafe inline script ran - createTextNode.")});');
inlineScript.appendChild(scriptText);
attachPoint.appendChild(inlineScript);
document.getElementById('emptyScript').innerHTML = 'dmTest.step(function() {assert_unreached("Unsafe inline script ran - innerHTML.")});';
document.getElementById('emptyDiv').outerHTML = '<script id=outerHTMLScript>dmTest.step(function() {assert_unreached("Unsafe inline script ran - outerHTML.")});</script>';
document.write('<script>dmTest.step(function() {assert_unreached("Unsafe inline script ran - document.write")});</script>');
document.writeln('<script>dmTest.step(function() {assert_unreached("Unsafe inline script ran - document.writeln")});</script>');
dmTest.done();
})();

21
testing/web-platform/tests/content-security-policy/script-src/buildInlineWorker.js Normal file
View file

@ -0,0 +1,21 @@
(function ()
{
var workerSource = document.getElementById('inlineWorker');
var blob = new Blob([workerSource.textContent]);
// can I create a new script tag like this? ack...
var url = window.URL.createObjectURL(blob);
try {
var worker = new Worker(url);
}
catch (e) {
done();
}
worker.addEventListener('message', function(e) {
assert_unreached("script ran");
}, false);
worker.postMessage('');
})();

8
testing/web-platform/tests/content-security-policy/script-src/inlineSuccessTest.js Normal file
View file

@ -0,0 +1,8 @@
var inlineRan = false;
onload = function() {
test(function() {
assert_true(inlineRan, 'Unsafe inline script ran.')},
'Inline script in a script tag should run with an unsafe-inline directive'
);
}

4
testing/web-platform/tests/content-security-policy/script-src/inlineTests.js Normal file
View file

@ -0,0 +1,4 @@
var t1 = async_test("Inline script block");
var t2 = async_test("Inline event handler");
onload = function() {t1.done(); t2.done()}

22
testing/web-platform/tests/content-security-policy/script-src/script-src-1_1.html Normal file
View file

@ -0,0 +1,22 @@
<!DOCTYPE HTML>
<html>
<head>
<title>Inline script should not run without 'unsafe-inline' script-src directive.</title>
<script src='/resources/testharness.js'></script>
<script src='/resources/testharnessreport.js'></script>
<script src='inlineTests.js'></script>
</head>
<body>
<h1>Inline script should not run without 'unsafe-inline' script-src directive, even for script-src 'self'.</h1>
<div id='log'></div>
<script>
t1.step(function() {assert_unreached('Unsafe inline script ran.');});
</script>
<img src='doesnotexist.jpg' onerror='t2.step(function() { assert_unreached("Unsafe inline event handler ran.") });'>
<script async defer src='../support/checkReport.sub.js?reportField=violated-directive&reportValue=script-src%20%27self%27'></script>
</body>
</html>

6
testing/web-platform/tests/content-security-policy/script-src/script-src-1_1.html.sub.headers Normal file
View file

@ -0,0 +1,6 @@
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0, false
Pragma: no-cache
Set-Cookie: script-src-1_1={{$id:uuid()}}; Path=/content-security-policy/script-src/
Content-Security-Policy: script-src 'self'; report-uri ../support/report.py?op=put&reportID={{$id}}

27
testing/web-platform/tests/content-security-policy/script-src/script-src-1_10.html Normal file
View file

@ -0,0 +1,27 @@
<!DOCTYPE HTML>
<html>
<head>
<title>data: as script src should not run with a policy that doesn't specify data: as an allowed source</title>
<script src='/resources/testharness.js'></script>
<script src='/resources/testharnessreport.js'></script>
</head>
<body>
<h1>data: as script src should not run with a policy that doesn't specify data: as an allowed source</h1>
<div id='log'></div>
<script>
var dataScriptRan = false;
</script>
<!-- This is our test case, but we don't expect it to actually execute if CSP is working. -->
<script src="data:text/javascript;charset=utf-8;base64,ZGF0YVNjcmlwdFJhbiA9IHRydWU7"></script>
<script>
test(function () {
assert_false(dataScriptRan, "data script ran");
}, "Verify that data: as script src doesn't run with this policy");
</script>
<script async defer src='../support/checkReport.sub.js?reportField=violated-directive&reportValue=default-src%20%27self%27+%27unsafe-inline%27'></script>
</body>
</html>

6
testing/web-platform/tests/content-security-policy/script-src/script-src-1_10.html.sub.headers Normal file
View file

@ -0,0 +1,6 @@
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0, false
Pragma: no-cache
Set-Cookie: script-src-1_10={{$id:uuid()}}; Path=/content-security-policy/script-src/
Content-Security-Policy: default-src 'self' 'unsafe-inline'; report-uri ../support/report.py?op=put&reportID={{$id}}

20
testing/web-platform/tests/content-security-policy/script-src/script-src-1_10_1.html Normal file
View file

@ -0,0 +1,20 @@
<!DOCTYPE HTML>
<html>
<head>
<title>data: as script src should run with a policy that specifies data: as an allowed source but not 'unsafe-inline'</title>
<script src='/resources/testharness.js'></script>
<script src='/resources/testharnessreport.js'></script>
</head>
<body>
<h1>data: as script src should run with a policy that specifies data: as an allowed source but not 'unsafe-inline'</h1>
<div id='log'></div>
<script src="10_1_support_1.js"></script>
<script src="data:text/javascript;charset=utf-8;base64,ZGF0YVNjcmlwdFJhbiA9IHRydWU7"></script>
<script src="10_1_support_2.js"></script>
<script async defer src='../support/checkReport.sub.js?reportExists=false'></script>
</body>
</html>

6
testing/web-platform/tests/content-security-policy/script-src/script-src-1_10_1.html.sub.headers Normal file
View file

@ -0,0 +1,6 @@
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0, false
Pragma: no-cache
Set-Cookie: script-src-1_10_1={{$id:uuid()}}; Path=/content-security-policy/script-src/
Content-Security-Policy: script-src 'self' data:; report-uri ../support/report.py?op=put&reportID={{$id}}

22
testing/web-platform/tests/content-security-policy/script-src/script-src-1_2.html Normal file
View file

@ -0,0 +1,22 @@
<!DOCTYPE HTML>
<html>
<head>
<title>Inline script should not run without 'unsafe-inline' script-src directive.</title>
<script src='/resources/testharness.js'></script>
<script src='/resources/testharnessreport.js'></script>
<script src='inlineTests.js'></script>
</head>
<body>
<h1>Inline script should not run without 'unsafe-inline' script-src directive, even for script-src *.</h1>
<div id='log'></div>
<script>
t1.step(function() {assert_unreached('Unsafe inline script ran.');});
</script>
<img src='doesnotexist.jpg' onerror='t2.step(function() { assert_unreached("Unsafe inline event handler ran.") });'>
<script async defer src='../support/checkReport.sub.js?reportField=violated-directive&reportValue=script-src%20%27self%27'></script>
</body>
</html>

6
testing/web-platform/tests/content-security-policy/script-src/script-src-1_2.html.sub.headers Normal file
View file

@ -0,0 +1,6 @@
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0, false
Pragma: no-cache
Set-Cookie: script-src-1_2={{$id:uuid()}}; Path=/content-security-policy/script-src/
Content-Security-Policy: script-src *; report-uri ../support/report.py?op=put&reportID={{$id}}

23
testing/web-platform/tests/content-security-policy/script-src/script-src-1_2_1.html Normal file
View file

@ -0,0 +1,23 @@
<!DOCTYPE HTML>
<html>
<head>
<title>Inline script attached by DOM manipulation should not run without an 'unsafe-inline' script-src policy, even with default-src *</title>
<script src='/resources/testharness.js'></script>
<script src='/resources/testharnessreport.js'></script>
</head>
<body>
<h1>Inline script attached by DOM manipulation should not run without an 'unsafe-inline' script-src policy, even with default-src *</h1>
<div id="log"></div>
<div id=attachHere></div>
<script id=emptyScript></script>
<div id=emptyDiv></div>
<script src="addInlineTestsWithDOMManipulation.js"></script>
<script async defer src="../support/checkReport.sub.js?reportField=violated-directive&reportValue=script-src%20*"></script>
</body>
</html>

6
testing/web-platform/tests/content-security-policy/script-src/script-src-1_2_1.html.sub.headers Normal file
View file

@ -0,0 +1,6 @@
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0, false
Pragma: no-cache
Set-Cookie: script-src-1_2_1={{$id:uuid()}}; Path=/content-security-policy/script-src/
Content-Security-Policy: script-src *; report-uri ../support/report.py?op=put&reportID={{$id}}

20
testing/web-platform/tests/content-security-policy/script-src/script-src-1_3.html Normal file
View file

@ -0,0 +1,20 @@
<!DOCTYPE HTML>
<html>
<head>
<title>Positive test case: Inline script should run 'unsafe-inline' script-src directive.</title>
<script src='/resources/testharness.js'></script>
<script src='/resources/testharnessreport.js'></script>
<script src='inlineSuccessTest.js'></script>
</head>
<body>
<h1>Positive test case: Inline script should run 'unsafe-inline' script-src directive.</h1>
<div id='log'></div>
<script>
inlineRan = true;
</script>
<script async defer src='../support/checkReport.sub.js?reportExists=false'></script>
</body>
</html>

6
testing/web-platform/tests/content-security-policy/script-src/script-src-1_3.html.sub.headers Normal file
View file

@ -0,0 +1,6 @@
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0, false
Pragma: no-cache
Set-Cookie: script-src-1_3={{$id:uuid()}}; Path=/content-security-policy/script-src/
Content-Security-Policy: script-src 'self' 'unsafe-inline'; report-uri ../support/report.py?op=put&reportID={{$id}}

25
testing/web-platform/tests/content-security-policy/script-src/script-src-1_4.html Normal file
View file

@ -0,0 +1,25 @@
<!DOCTYPE HTML>
<html>
<head>
<title>eval() should not run without 'unsafe-eval' script-src directive.</title>
<script src='/resources/testharness.js'></script>
<script src='/resources/testharnessreport.js'></script>
</head>
<body>
<h1>eval() should not run without 'unsafe-eval' script-src directive.</h1>
<div id='log'></div>
<script>
var evalRan = false;
test(function() {assert_throws(new EvalError(), function() { eval('evalRan = true;') })}, "eval() should throw without 'unsafe-eval' keyword source in script-src directive.");
test(function() {assert_false(evalRan);})
</script>
<script async defer src='../support/checkReport.sub.js?reportField=violated-directive&reportValue=script-src%20%27self%27+%27unsafe-inline%27'></script>
</body>
</html>

6
testing/web-platform/tests/content-security-policy/script-src/script-src-1_4.html.sub.headers Normal file
View file

@ -0,0 +1,6 @@
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0, false
Pragma: no-cache
Set-Cookie: script-src-1_4={{$id:uuid()}}; Path=/content-security-policy/script-src/
Content-Security-Policy: script-src 'self' 'unsafe-inline'; report-uri ../support/report.py?op=put&reportID={{$id}}

26
testing/web-platform/tests/content-security-policy/script-src/script-src-1_4_1.html Normal file
View file

@ -0,0 +1,26 @@
<!DOCTYPE HTML>
<html>
<head>
<title>setTimeout() and setInterval() should not run without 'unsafe-eval' script-src directive.</title>
<script src='/resources/testharness.js'></script>
<script src='/resources/testharnessreport.js'></script>
</head>
<body>
<h1>setTimeout() and setInterval() should not run without 'unsafe-eval' script-src directive.</h1>
<div id='log'></div>
<script>
var t1 = async_test("window.setTimeout()");
var t2 = async_test("window.setInterval()");
onload = function() {t1.done(); t2.done()}
window.setTimeout('t1.step(function() {assert_unreached("window.setTimeout() ran without unsafe-eval.")})',0);
window.setInterval('t2.step(function() {assert_unreached("window.setInterval() ran without unsafe-eval.")})',0);
</script>
<script async defer src='../support/checkReport.sub.js?reportField=violated-directive&reportValue=script-src%20%27self%27+%27unsafe-eval%27'></script>
</body>
</html>

6
testing/web-platform/tests/content-security-policy/script-src/script-src-1_4_1.html.sub.headers Normal file
View file

@ -0,0 +1,6 @@
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0, false
Pragma: no-cache
Set-Cookie: script-src-1_4_1={{$id:uuid()}}; Path=/content-security-policy/script-src/
Content-Security-Policy: script-src 'self' 'unsafe-inline'; report-uri ../support/report.py?op=put&reportID={{$id}}

27
testing/web-platform/tests/content-security-policy/script-src/script-src-1_4_2.html Normal file
View file

@ -0,0 +1,27 @@
<!DOCTYPE HTML>
<html>
<head>
<title>Function() called as a constructor should throw without 'unsafe-eval' script-src directive.</title>
<script src='/resources/testharness.js'></script>
<script src='/resources/testharnessreport.js'></script>
</head>
<body>
<h1>Function() called as a constructor should throw without 'unsafe-eval' script-src directive.</h1>
<div id='log'></div>
<script>
test(function() {
assert_throws(
new EvalError(),
function() {
var funq = new Function('');
funq();
})}, "Unsafe eval ran in Function() constructor.");
</script>
<script async defer src='../support/checkReport.sub.js?reportField=violated-directive&reportValue=script-src%20%27self%27+%27unsafe-inline%27'></script>
</body>
</html>

6
testing/web-platform/tests/content-security-policy/script-src/script-src-1_4_2.html.sub.headers Normal file
View file

@ -0,0 +1,6 @@
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0, false
Pragma: no-cache
Set-Cookie: script-src-1_4_2={{$id:uuid()}}; Path=/content-security-policy/script-src/
Content-Security-Policy: script-src 'self' 'unsafe-inline'; report-uri ../support/report.py?op=put&reportID={{$id}}