dom/security/test/csp/main_csp_worker.html

   1 <!DOCTYPE HTML>
   2 <html>
   3   <head>
   4     <title>Bug 1475849: Test CSP worker inheritance</title>
   5     <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
   6     <script src="/tests/SimpleTest/SimpleTest.js"></script>
   7     <script type="application/javascript" src="worker_helper.js"></script>
   8
   9   </head>
  10   <body>
  11     <script type="application/javascript">
  12       const SJS = "worker.sjs";
  13       const SAME_BASE = "http://mochi.test:8888/tests/dom/security/test/csp/file_CSP.sjs";
  14       const CROSS_BASE = "http://example.com/tests/dom/security/test/csp/file_CSP.sjs";
  15
  16       SimpleTest.waitForExplicitFinish();
  17       /* test data format :
  18         {
  19           id: test id, short description of test,
  20           base: URL of the request in worker,
  21           action: type of request in worker (fetch, xhr, importscript)
  22           type: how do we create the worker, from URL or Blob,
  23           csp: csp of worker,
  24           child: how do we create the child worker, from URL or Blob,
  25           childCsp: csp of child worker
  26           expectedBlock: result when CSP policy, true or false
  27         }
  28       */
  29
  30       // Document's CSP is defined in main_csp_worker.html^headers^
  31       // Content-Security-Policy: default-src 'self' blob: 'unsafe-inline'
  32       var tests = [
  33         // create new Worker(url), worker's csp should be deliveried from header.
  34         // csp should be: default-src 'self' blob: ; connect-src CROSS_BASE
  35         {
  36           id: "worker_url_fetch_same_bad",
  37           base: SAME_BASE,
  38           action: "fetch",
  39           type: "url",
  40           csp: "default-src 'self' blob: ; connect-src http://example.com",
  41           expectBlocked: true
  42         },
  43         {
  44           id: "worker_url_importScripts_same_good",
  45           base: SAME_BASE,
  46           action: "importScripts",
  47           type: "url",
  48           csp: "default-src 'self' blob: ; connect-src http://example.com",
  49           expectBlocked: false
  50         },
  51         {
  52           id: "worker_url_xhr_same_bad",
  53           base: SAME_BASE,
  54           action: "xhr",
  55           type: "url",
  56           csp: "default-src 'self' blob: ; connect-src http://example.com",
  57           expectBlocked: true
  58         },
  59         {
  60           id: "worker_url_fetch_cross_good",
  61           base: CROSS_BASE,
  62           action: "fetch",
  63           type: "url",
  64           csp: "default-src 'self' blob: ; connect-src http://example.com",
  65           expectBlocked: false
  66         },
  67         {
  68           id: "worker_url_importScripts_cross_bad",
  69           base: CROSS_BASE,
  70           action: "importScripts",
  71           type: "url",
  72           csp: "default-src 'self' blob: ; connect-src http://example.com",
  73           expectBlocked: true
  74         },
  75         {
  76           id: "worker_url_xhr_cross_good",
  77           base: CROSS_BASE,
  78           action: "xhr",
  79           type: "url",
  80           csp: "default-src 'self' blob: ; connect-src http://example.com",
  81           expectBlocked: false
  82         },
  83
  84         // create new Worker(blob:), worker's csp should be inherited from
  85         // document.
  86         // csp should be : default-src 'self' blob: 'unsafe-inline'
  87         {
  88           id: "worker_blob_fetch_same_good",
  89           base: SAME_BASE,
  90           action: "fetch",
  91           type: "blob",
  92           csp: "default-src 'self' blob: ; connect-src http://example.com",
  93           expectBlocked: false
  94         },
  95         {
  96           id: "worker_blob_xhr_same_good",
  97           base: SAME_BASE,
  98           action: "xhr",
  99           type: "blob",
 100           csp: "default-src 'self' blob: ; connect-src http://example.com",
 101           expectBlocked: false
 102         },
 103         {
 104           id: "worker_blob_importScripts_same_good",
 105           base: SAME_BASE,
 106           action: "importScripts",
 107           type: "blob",
 108           csp: "default-src 'self' blob: ; connect-src http://example.com",
 109           expectBlocked: false
 110         },
 111         {
 112           id: "worker_blob_fetch_cross_bad",
 113           base: CROSS_BASE,
 114           action: "fetch",
 115           type: "blob",
 116           csp: "default-src 'self' blob: ; connect-src http://example.com",
 117           expectBlocked: true
 118         },
 119         {
 120           id: "worker_blob_xhr_cross_bad",
 121           base: CROSS_BASE,
 122           action: "xhr",
 123           type: "blob",
 124           csp: "default-src 'self' blob: ; connect-src http://example.com",
 125           expectBlocked: true
 126         },
 127         {
 128           id: "worker_blob_importScripts_cross_bad",
 129           base: CROSS_BASE,
 130           action: "importScripts",
 131           type: "blob",
 132           csp: "default-src 'self' blob: ; connect-src http://example.com",
 133           expectBlocked: true
 134         },
 135
 136         // create parent worker from url, child worker from blob,
 137         // Parent delivery csp then propagate to child
 138         // csp should be: "default-src 'self' blob: ; connect-src 'self' http://example.com",
 139         {
 140           id: "worker_url_child_blob_fetch_same_good",
 141           base: SAME_BASE,
 142           action: "fetch",
 143           child: "blob",
 144           childCsp: "default-src 'none'",
 145           type: "url",
 146           csp: "default-src 'self' blob: ; connect-src 'self' http://example.com",
 147           expectBlocked: false
 148         },
 149         {
 150           id: "worker_url_child_blob_importScripts_same_good",
 151           base: SAME_BASE,
 152           action: "importScripts",
 153           child: "blob",
 154           childCsp: "default-src 'none'",
 155           type: "url",
 156           csp: "default-src 'self' blob: ; connect-src 'self' http://example.com",
 157           expectBlocked: false
 158         },
 159         {
 160           id: "worker_url_child_blob_xhr_same_good",
 161           base: SAME_BASE,
 162           child: "blob",
 163           childCsp: "default-src 'none'",
 164           action: "xhr",
 165           type: "url",
 166           csp: "default-src 'self' blob: ; connect-src 'self' http://example.com",
 167           expectBlocked: false
 168         },
 169         {
 170           id: "worker_url_child_blob_fetch_cross_good",
 171           base: CROSS_BASE,
 172           action: "fetch",
 173           child: "blob",
 174           childCsp: "default-src 'none'",
 175           type: "url",
 176           csp: "default-src 'self' blob: ; connect-src 'self' http://example.com",
 177           expectBlocked: false
 178         },
 179         {
 180           id: "worker_url_child_blob_importScripts_cross_bad",
 181           base: CROSS_BASE,
 182           action: "importScripts",
 183           child: "blob",
 184           childCsp: "default-src 'none'",
 185           type: "url",
 186           csp: "default-src 'self' blob: ; connect-src 'self' http://example.com",
 187           expectBlocked: true
 188         },
 189         {
 190           id: "worker_url_child_blob_xhr_cross_godd",
 191           base: CROSS_BASE,
 192           child: "blob",
 193           childCsp: "default-src 'none'",
 194           action: "xhr",
 195           type: "url",
 196           csp: "default-src 'self' blob: ; connect-src 'self' http://example.com",
 197           expectBlocked: false
 198         },
 199
 200
 201         // create parent worker from blob, child worker from blob,
 202         // Csp: document->parent->child
 203         // csp should be : default-src 'self' blob: 'unsafe-inline'
 204         {
 205           id: "worker_blob_child_blob_fetch_same_good",
 206           base: SAME_BASE,
 207           child: "blob",
 208           childCsp: "default-src 'none'",
 209           action: "fetch",
 210           type: "blob",
 211           csp: "default-src 'self' blob:",
 212           expectBlocked: false
 213         },
 214         {
 215           id: "worker_blob_child_blob_xhr_same_good",
 216           base: SAME_BASE,
 217           child: "blob",
 218           childCsp: "default-src 'none'",
 219           action: "xhr",
 220           type: "blob",
 221           csp: "default-src 'self' blob:",
 222           expectBlocked: false
 223         },
 224         {
 225           id: "worker_blob_child_blob_importScripts_same_good",
 226           base: SAME_BASE,
 227           action: "importScripts",
 228           child: "blob",
 229           childCsp: "default-src 'none'",
 230           type: "blob",
 231           csp: "default-src 'self' blob:",
 232           expectBlocked: false
 233         },
 234         {
 235           id: "worker_blob_child_blob_fetch_cross_bad",
 236           base: CROSS_BASE,
 237           child: "blob",
 238           childCsp: "default-src 'none'",
 239           action: "fetch",
 240           type: "blob",
 241           csp: "default-src 'self' blob:",
 242           expectBlocked: true
 243         },
 244         {
 245           id: "worker_blob_child_blob_xhr_cross_bad",
 246           base: CROSS_BASE,
 247           child: "blob",
 248           childCsp: "default-src 'none'",
 249           action: "xhr",
 250           type: "blob",
 251           csp: "default-src 'self' blob:",
 252           expectBlocked: true
 253         },
 254         {
 255           id: "worker_blob_child_blob_importScripts_cross_bad",
 256           base: CROSS_BASE,
 257           action: "importScripts",
 258           child: "blob",
 259           childCsp: "default-src 'none'",
 260           type: "blob",
 261           csp: "default-src 'self' blob:",
 262           expectBlocked: true
 263         },
 264
 265         // create parent worker from url, child worker from url,
 266         // child delivery csp from header
 267         // csp should be : default-src 'none'
 268         {
 269           id: "worker_url_child_url_fetch_cross_bad",
 270           base: CROSS_BASE,
 271           action: "fetch",
 272           child: "url",
 273           childCsp: "default-src 'none'",
 274           type: "url",
 275           csp: "default-src 'self' blob:",
 276           expectBlocked: true
 277         },
 278         {
 279           id: "worker_url_child_url_xhr_cross_bad",
 280           base: CROSS_BASE,
 281           child: "url",
 282           childCsp: "default-src 'none'",
 283           action: "xhr",
 284           type: "url",
 285           csp: "default-src 'self' blob:",
 286           expectBlocked: true
 287         },
 288         {
 289           id: "worker_url_child_url_importScripts_cross_bad",
 290           base: CROSS_BASE,
 291           action: "importScripts",
 292           child: "url",
 293           childCsp: "default-src 'none'",
 294           type: "url",
 295           csp: "default-src 'self' blob:",
 296           expectBlocked: true
 297         },
 298         {
 299           id: "worker_url_child_url_fetch_same_bad",
 300           base: SAME_BASE,
 301           action: "fetch",
 302           child: "url",
 303           childCsp: "default-src 'none'",
 304           type: "url",
 305           csp: "default-src 'self' blob:",
 306           expectBlocked: true
 307         },
 308         {
 309           id: "worker_url_child_url_xhr_same_bad",
 310           base: SAME_BASE,
 311           child: "url",
 312           childCsp: "default-src 'none'",
 313           action: "xhr",
 314           type: "url",
 315           csp: "default-src 'self' blob:",
 316           expectBlocked: true
 317         },
 318         {
 319           id: "worker_url_child_url_importScripts_same_bad",
 320           base: SAME_BASE,
 321           action: "importScripts",
 322           child: "url",
 323           childCsp: "default-src 'none'",
 324           type: "url",
 325           csp: "default-src 'self' blob:",
 326           expectBlocked: true
 327         },
 328
 329         // create parent worker from blob, child worker from url,
 330         // child delivery csp from header
 331         // csp should be : default-src 'none'
 332         {
 333           id: "worker_blob_child_url_fetch_cross_bad",
 334           base: CROSS_BASE,
 335           child: "url",
 336           childCsp: "default-src 'none'",
 337           action: "fetch",
 338           type: "blob",
 339           csp: "default-src 'self' blob:",
 340           expectBlocked: true
 341         },
 342         {
 343           id: "worker_blob_child_url_xhr_cross_bad",
 344           base: CROSS_BASE,
 345           child: "url",
 346           childCsp: "default-src 'none'",
 347           action: "xhr",
 348           type: "blob",
 349           csp: "default-src 'self' blob:",
 350           expectBlocked: true
 351         },
 352         {
 353           id: "worker_blob_child_url_importScripts_cross_bad",
 354           base: CROSS_BASE,
 355           action: "importScripts",
 356           child: "url",
 357           childCsp: "default-src 'none'",
 358           type: "blob",
 359           csp: "default-src 'self' blob:",
 360           expectBlocked: true
 361         },
 362         {
 363           id: "worker_blob_child_url_fetch_same_bad",
 364           base: SAME_BASE,
 365           child: "url",
 366           childCsp: "default-src 'none'",
 367           action: "fetch",
 368           type: "blob",
 369           csp: "default-src 'self' blob:",
 370           expectBlocked: true
 371         },
 372         {
 373           id: "worker_blob_child_url_xhr_same_bad",
 374           base: SAME_BASE,
 375           child: "url",
 376           childCsp: "default-src 'none'",
 377           action: "xhr",
 378           type: "blob",
 379           csp: "default-src 'self' blob:",
 380           expectBlocked: true
 381         },
 382         {
 383           id: "worker_blob_child_url_importScripts_same_bad",
 384           base: SAME_BASE,
 385           action: "importScripts",
 386           child: "url",
 387           childCsp: "default-src 'none'",
 388           type: "blob",
 389           csp: "default-src 'self' blob:",
 390           expectBlocked: true
 391         },
 392
 393
 394       ];
 395
 396       async function runWorkerTest(data) {
 397         let src = SJS;
 398         src += "?base=" + escape(data.base);
 399         src += "&action=" + escape(data.action);
 400         src += "&csp=" + escape(data.csp);
 401         src += "&id=" + escape(data.id);
 402
 403         if (data.child) {
 404           src += "&child=" + escape(data.child);
 405         }
 406
 407         if (data.childCsp) {
 408           src += "&childCsp=" + escape(data.childCsp);
 409         }
 410
 411         switch (data.type) {
 412           case "url":
 413             new Worker(src);
 414             break;
 415
 416           case "blob":
 417             new Worker(URL.createObjectURL(await doXHRGetBlob(src)));
 418             break;
 419
 420           default:
 421             throw "Unsupport type";
 422         }
 423
 424         let checkUri = data.base + "?id=" + data.id;
 425         await assertCSPBlock(checkUri, data.expectBlocked);
 426         runNextTest();
 427       };
 428
 429       tests.forEach(function(test) {
 430         addAsyncTest(async function() {
 431           runWorkerTest(test);
 432         });
 433       });
 434
 435       runNextTest();
 436     </script>
 437
 438   </body>
 439 </html>