wpt/trusted-types/trusted-types-source-file-path.html at master · web-platform-tests/wpt · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
<!DOCTYPE html>
<head>
  <title>
    Check the reported TrustedType violation's sourceFile.
  </title>
  <script src="/resources/testharness.js"></script>
  <script src="/resources/testharnessreport.js"></script>
  <script src="/common/get-host-info.sub.js"></script>
  <script src="./support/csp-violations.js"></script>
  <meta http-equiv="Content-Security-Policy"
        content="require-trusted-types-for 'script'; trusted-types id">
  <meta http-equiv="Content-Security-Policy" content="connect-src 'none'">
  </head>
<body>

<script id="to-be-modified"></script>
<script>
let toBeModified = document.querySelector("#to-be-modified");

let id_policy = trustedTypes.createPolicy("id", {
  createHTML: x => x,
  createScriptURL: x => x,
  createScript: x => x,
});

function futureScript(url) {
  return new Promise(r => {
    let script = document.createElement("script");
    script.src = id_policy.createScriptURL(url);
    script.onload = r;
    document.body.appendChild(script);
  });
}

promise_test(async t => {
  const input = "'test'";
  let violation = await trusted_type_violation_for(TypeError, _ =>
    document.getElementById("to-be-modified").innerHTML = input
  );
  assert_equals(violation.sourceFile, location.href);
  assert_equals(violation.sample, `Element innerHTML|${clipSampleIfNeeded(input)}`);
}, "same-document script")

promise_test(async t => {
  const input = "'test'";
  let script_origin = get_host_info().HTTP_ORIGIN;
  let script_src = script_origin +
    "/trusted-types/support/set-inner-html.js";
  let script = await futureScript(script_src);
  let violation = await trusted_type_violation_for(TypeError, _ =>
    setInnerHtml(toBeModified, input)
  );
  assert_equals(violation.sourceFile, script_src);
  assert_equals(violation.sample, `Element innerHTML|${clipSampleIfNeeded(input)}`);
}, "same-origin script")

promise_test(async t => {
  const input = "'test'";
  let script_origin = get_host_info().HTTP_REMOTE_ORIGIN;
  let script_src = script_origin +
    "/trusted-types/support/set-inner-html.js";
  let script = await futureScript(script_src);
  let violation = await trusted_type_violation_for(TypeError, _ =>
    setInnerHtml(toBeModified, input)
  );
  assert_equals(violation.sourceFile, script_src);
  assert_equals(violation.sample, `Element innerHTML|${clipSampleIfNeeded(input)}`);
}, "cross-origin script")

// TODO(arthursonzogni): Check what happens with redirects. Do we report the
// request's URL or the response's URL?

</script>
</body>