The Tor Browser / file comparison
comparison: content/base/test/csp/test_csp_bug773891.html
content/base/test/csp/test_csp_bug773891.html
- branch
- TOR_BUG_9701
- changeset 15
- b8a032363ba2
equal
deleted
inserted
replaced
| -1:000000000000 | 0:cf5f0a9673c4 |
|---|---|
| 1 <!DOCTYPE HTML> | |
| 2 <html> | |
| 3 <!-- | |
| 4 https://bugzilla.mozilla.org/show_bug.cgi?id=768029 | |
| 5 --> | |
| 6 <head> | |
| 7 <meta charset="utf-8"> | |
| 8 <title>Test for CSP on trusted/certified and installed apps -- bug 773891</title> | |
| 9 <script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script> | |
| 10 <link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/> | |
| 11 </head> | |
| 12 <body> | |
| 13 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=773891">Mozilla Bug 773891</a> | |
| 14 <p id="display"></p> | |
| 15 <div id="content"> | |
| 16 | |
| 17 </div> | |
| 18 <pre id="test"> | |
| 19 <script type="application/javascript;version=1.7"> | |
| 20 | |
| 21 Components.utils.import("resource://gre/modules/Services.jsm"); | |
| 22 | |
| 23 /** Test for Bug 773891 **/ | |
| 24 | |
| 25 // Note: we don't have to inspect all the different operations of CSP, | |
| 26 // we're just looking for specific differences in behavior that indicate | |
| 27 // a default CSP got applied. | |
| 28 const DEFAULT_CSP_PRIV = "default-src *; script-src *; style-src 'self' 'unsafe-inline'; object-src 'none'"; | |
| 29 const DEFAULT_CSP_CERT = "default-src *; script-src *; style-src 'self'; object-src 'none'"; | |
| 30 | |
| 31 const MANIFEST_CSP_PRIV = "default-src *; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'"; | |
| 32 const MANIFEST_CSP_INST = "default-src *; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'"; | |
| 33 const MANIFEST_CSP_CERT = "default-src *; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'"; | |
| 34 | |
| 35 SimpleTest.waitForExplicitFinish(); | |
| 36 | |
| 37 var gData = [ | |
| 38 | |
| 39 { | |
| 40 app: "https://example.com/manifest_csp_inst.webapp", | |
| 41 appStatus: Components.interfaces.nsIPrincipal.APP_STATUS_INSTALLED, | |
| 42 csp: MANIFEST_CSP_INST, | |
| 43 origin: "https://example.com", | |
| 44 uri: "https://example.com/tests/content/base/test/csp/file_csp_bug773891.html", | |
| 45 statusString: "installed app", | |
| 46 expectedTestResults: { | |
| 47 max_tests: 7, /* number of bools below plus one for the status check */ | |
| 48 cross_origin: { img: true, script: false, style: false }, | |
| 49 same_origin: { img: true, script: true, style: true }, | |
| 50 }, | |
| 51 }, | |
| 52 { | |
| 53 app: "https://example.com/manifest_csp_cert.webapp", | |
| 54 appStatus: Components.interfaces.nsIPrincipal.APP_STATUS_CERTIFIED, | |
| 55 csp: MANIFEST_CSP_CERT, | |
| 56 origin: "https://example.com", | |
| 57 uri: "https://example.com/tests/content/base/test/csp/file_csp_bug773891.html", | |
| 58 statusString: "certified app", | |
| 59 expectedTestResults: { | |
| 60 max_tests: 7, /* number of bools below plus one for the status check */ | |
| 61 cross_origin: { img: true, script: false, style: false }, | |
| 62 same_origin: { img: true, script: true, style: true }, | |
| 63 }, | |
| 64 }, | |
| 65 { | |
| 66 app: "https://example.com/manifest_csp_priv.webapp", | |
| 67 appStatus: Components.interfaces.nsIPrincipal.APP_STATUS_PRIVILEGED, | |
| 68 csp: MANIFEST_CSP_PRIV, | |
| 69 origin: "https://example.com", | |
| 70 uri: "https://example.com/tests/content/base/test/csp/file_csp_bug773891.html", | |
| 71 statusString: "privileged app", | |
| 72 expectedTestResults: { | |
| 73 max_tests: 7, /* number of bools below plus one for the status check */ | |
| 74 cross_origin: { img: true, script: false, style: false }, | |
| 75 same_origin: { img: true, script: true, style: true }, | |
| 76 }, | |
| 77 }, | |
| 78 ]; | |
| 79 | |
| 80 // Observer for watching allowed loads and blocked attempts | |
| 81 function ThingyListener(app, iframe) { | |
| 82 Services.obs.addObserver(this, "csp-on-violate-policy", false); | |
| 83 Services.obs.addObserver(this, "http-on-modify-request", false); | |
| 84 dump("added observers\n"); | |
| 85 // keep track of which app ID this test is monitoring. | |
| 86 this._testData = app; | |
| 87 this._expectedResults = app.expectedTestResults; | |
| 88 this._resultsRecorded = { cross_origin: {}, same_origin: {}}; | |
| 89 this._iframe = iframe; | |
| 90 this._countedTests = 0; | |
| 91 } | |
| 92 ThingyListener.prototype = { | |
| 93 | |
| 94 observe: function(subject, topic, data) { | |
| 95 // make sure to only observe app-generated calls to the helper for this test. | |
| 96 var testpat = new RegExp("file_csp_bug773891\\.sjs"); | |
| 97 | |
| 98 // used to extract which kind of load this is (img, script, etc). | |
| 99 var typepat = new RegExp("type=([\\_a-z0-9]+)"); | |
| 100 | |
| 101 // used to identify whether it's cross-origin or same-origin loads | |
| 102 // (the applied CSP allows same-origin loads). | |
| 103 var originpat = new RegExp("origin=([\\_a-z0-9]+)"); | |
| 104 | |
| 105 if (topic === "http-on-modify-request") { | |
| 106 // Matching requests on this topic were allowed by the csp | |
| 107 var chan = subject.QueryInterface(Components.interfaces.nsIHttpChannel); | |
| 108 var uri = chan.URI; | |
| 109 // ignore irrelevent URIs | |
| 110 if (!testpat.test(uri.asciiSpec)) return; | |
| 111 | |
| 112 var loadType = typepat.exec(uri.asciiSpec)[1]; | |
| 113 var originType = originpat.exec(uri.asciiSpec)[1]; | |
| 114 | |
| 115 // skip duplicate hits to this topic (potentially document loads | |
| 116 // may generate duplicate loads. | |
| 117 if (this._resultsRecorded[originType] && | |
| 118 this._resultsRecorded[originType][loadType]) { | |
| 119 return; | |
| 120 } | |
| 121 var message = originType + " : " + loadType + " should be " + | |
| 122 (this._expectedResults[originType][loadType] ? "allowed" : "blocked"); | |
| 123 ok(this._expectedResults[originType][loadType] == true, message); | |
| 124 this._resultsRecorded[originType][loadType] = true; | |
| 125 this._countedTests++; | |
| 126 } | |
| 127 else if (topic === "csp-on-violate-policy") { | |
| 128 // Matching hits on this topic were blocked by the csp | |
| 129 var uri = subject.QueryInterface(Components.interfaces.nsIURI); | |
| 130 // ignore irrelevent URIs | |
| 131 if (!testpat.test(uri.asciiSpec)) return; | |
| 132 | |
| 133 var loadType = typepat.exec(uri.asciiSpec)[1]; | |
| 134 var originType = originpat.exec(uri.asciiSpec)[1]; | |
| 135 | |
| 136 // skip duplicate hits to this topic (potentially document loads | |
| 137 // may generate duplicate loads. | |
| 138 if (this._resultsRecorded[originType] && | |
| 139 this._resultsRecorded[originType][loadType]) { | |
| 140 return; | |
| 141 } | |
| 142 | |
| 143 var message = originType + " : " + loadType + " should be " + | |
| 144 (this._expectedResults[originType][loadType] ? "allowed" : "blocked"); | |
| 145 ok(this._expectedResults[originType][loadType] == false, message); | |
| 146 this._resultsRecorded[originType][loadType] = true; | |
| 147 this._countedTests++; | |
| 148 } | |
| 149 else { | |
| 150 // wrong topic! Nothing to do. | |
| 151 return; | |
| 152 } | |
| 153 | |
| 154 this._checkForFinish(); | |
| 155 }, | |
| 156 | |
| 157 _checkForFinish: function() { | |
| 158 // check to see if there are load tests still pending. | |
| 159 // (All requests triggered by the app should hit one of the | |
| 160 // two observer topics.) | |
| 161 if (this._countedTests == this._expectedResults.max_tests) { | |
| 162 Services.obs.removeObserver(this, "csp-on-violate-policy"); | |
| 163 Services.obs.removeObserver(this, "http-on-modify-request"); | |
| 164 dump("removed observers\n"); | |
| 165 checkedCount++; | |
| 166 if (checkedCount == checksTodo) { | |
| 167 SpecialPowers.removePermission("browser", "https://example.com"); | |
| 168 SimpleTest.finish(); | |
| 169 } else { | |
| 170 gTestRunner.next(); | |
| 171 } | |
| 172 } | |
| 173 }, | |
| 174 | |
| 175 // verify the status of the app | |
| 176 checkAppStatus: function() { | |
| 177 var principal = this._iframe.contentDocument.nodePrincipal; | |
| 178 if (this._testData.app) { | |
| 179 is(principal.appStatus, this._testData.appStatus, | |
| 180 "iframe principal's app status doesn't match the expected app status."); | |
| 181 this._countedTests++; | |
| 182 this._checkForFinish(); | |
| 183 } | |
| 184 } | |
| 185 } | |
| 186 | |
| 187 var content = document.getElementById('content'); | |
| 188 var checkedCount = 0; // number of apps checked | |
| 189 var checksTodo = gData.length; | |
| 190 | |
| 191 // quick check to make sure we can test apps: | |
| 192 is('appStatus' in document.nodePrincipal, true, | |
| 193 'appStatus should be present in nsIPrincipal, if not the rest of this test will fail'); | |
| 194 | |
| 195 function runTest() { | |
| 196 for (var i = 0; i < gData.length; i++) { | |
| 197 let data = gData[i]; | |
| 198 var iframe = document.createElement('iframe'); | |
| 199 | |
| 200 // watch for successes and failures | |
| 201 var examiner = new ThingyListener(data, iframe); | |
| 202 | |
| 203 iframe.setAttribute('mozapp', data.app); | |
| 204 iframe.setAttribute('mozbrowser', 'true'); | |
| 205 iframe.addEventListener('load', examiner.checkAppStatus.bind(examiner)); | |
| 206 iframe.src = data.uri; | |
| 207 | |
| 208 content.appendChild(iframe); | |
| 209 | |
| 210 yield undefined; | |
| 211 } | |
| 212 } | |
| 213 | |
| 214 var gTestRunner = runTest(); | |
| 215 | |
| 216 // load the default CSP and pref it on | |
| 217 SpecialPowers.addPermission("browser", true, "https://example.com"); | |
| 218 | |
| 219 SpecialPowers.pushPrefEnv({'set': [["dom.mozBrowserFramesEnabled", true], | |
| 220 ["security.apps.privileged.CSP.default", DEFAULT_CSP_PRIV], | |
| 221 ["security.apps.certified.CSP.default", DEFAULT_CSP_CERT]]}, | |
| 222 function() { gTestRunner.next(); }); | |
| 223 | |
| 224 | |
| 225 </script> | |
| 226 </pre> | |
| 227 </body> | |
| 228 </html> |
