Bug 1370468 - file for Frame-ancestor tests for userpass added
MozReview-Commit-ID: Cq8Bak8w6Ve
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frameancestors_userpass.html
@@ -0,0 +1,33 @@
+<html>
+ <head>
+ <title>CSP frame ancestors tests</title>
+
+ <!-- this page shouldn't have a CSP, just the sub-pages. -->
+ <script src='file_frameancestors_userpass.js'></script>
+
+ </head>
+ <body>
+
+<!-- These iframes will get populated by the attached javascript. -->
+
+<tt> aba_allow: /* innermost frame allows b,a */</tt><br/>
+<iframe id='aba_allow'></iframe><br/>
+
+<tt> aba_block: /* innermost frame denies b */</tt><br/>
+<iframe id='aba_block'></iframe><br/>
+
+<tt> aba2_block: /* innermost frame denies a */</tt><br/>
+<iframe id='aba2_block'></iframe><br/>
+
+<tt> abb_allow: /* innermost frame allows b,a */</tt><br/>
+<iframe id='abb_allow'></iframe><br/>
+
+<tt> abb_block: /* innermost frame denies b */</tt><br/>
+<iframe id='abb_block'></iframe><br/>
+
+<tt> abb2_block: /* innermost frame denies a */</tt><br/>
+<iframe id='abb2_block'></iframe><br/>
+
+
+ </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frameancestors_userpass.js
@@ -0,0 +1,52 @@
+// Script to populate the test frames in the frame ancestors mochitest.
+//
+function setupFrames() {
+
+ var $ = function(v) { return document.getElementById(v); }
+ var base = {
+ self: '/tests/dom/security/test/csp/file_frameancestors_userpass.sjs',
+ a: 'http://sampleuser:samplepass@mochi.test:8888/tests/dom/security/test/csp/file_frameancestors_userpass.sjs',
+ b: 'http://sampleuser:samplepass@example.com/tests/dom/security/test/csp/file_frameancestors_userpass.sjs'
+ };
+
+ // In both cases (base.a, base.b) the path starts with /tests/. Let's make sure this
+ // path within the CSP policy is completely ignored when enforcing frame ancestors.
+ // To test this behavior we use /foo/ and /bar/ as dummy values for the path.
+ var host = { a: 'http://mochi.test:8888/foo/', b: 'http://example.com:80/bar/' };
+
+ var innerframeuri = null;
+ var elt = null;
+
+ /* .... two-level framing */
+ elt = $('aba_allow');
+ innerframeuri = base.a + "?testid=aba_allow&double=1&internalframe=aba_a&csp=" +
+ escape("default-src 'none'; frame-ancestors " + host.a + " " + host.b + "; script-src 'self'");
+ elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
+
+ elt = $('aba_block');
+ innerframeuri = base.a + "?testid=aba_allow&double=1&internalframe=aba_b&csp=" +
+ escape("default-src 'none'; frame-ancestors " + host.a + "; script-src 'self'");
+ elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
+
+ elt = $('aba2_block');
+ innerframeuri = base.a + "?testid=aba_allow&double=1&internalframe=aba2_b&csp=" +
+ escape("default-src 'none'; frame-ancestors " + host.b + "; script-src 'self'");
+ elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
+
+ elt = $('abb_allow');
+ innerframeuri = base.b + "?testid=abb_allow&double=1&internalframe=abb_a&csp=" +
+ escape("default-src 'none'; frame-ancestors " + host.a + " " + host.b + "; script-src 'self'");
+ elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
+
+ elt = $('abb_block');
+ innerframeuri = base.b + "?testid=abb_allow&double=1&internalframe=abb_b&csp=" +
+ escape("default-src 'none'; frame-ancestors " + host.a + "; script-src 'self'");
+ elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
+
+ elt = $('abb2_block');
+ innerframeuri = base.b + "?testid=abb_allow&double=1&internalframe=abb2_b&csp=" +
+ escape("default-src 'none'; frame-ancestors " + host.b + "; script-src 'self'");
+ elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
+}
+
+window.addEventListener('load', setupFrames);
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frameancestors_userpass.sjs
@@ -0,0 +1,54 @@
+// SJS file for CSP frame ancestor mochitests
+function handleRequest(request, response)
+{
+ var query = {};
+ request.queryString.split('&').forEach(function (val) {
+ var [name, value] = val.split('=');
+ query[name] = unescape(value);
+ });
+
+ var isPreflight = request.method == "OPTIONS";
+
+ //avoid confusing cache behaviors
+ response.setHeader("Cache-Control", "no-cache", false);
+
+ // grab the desired policy from the query, and then serve a page
+ if (query['csp'])
+ response.setHeader("Content-Security-Policy",
+ unescape(query['csp']),
+ false);
+ if (query['scriptedreport']) {
+ // spit back a script that records that the page loaded
+ response.setHeader("Content-Type", "text/javascript", false);
+ if (query['double'])
+ response.write('window.parent.parent.parent.postMessage({call: "frameLoaded", testname: "' + query['scriptedreport'] + '", uri: window.location.toString()}, "*");');
+ else
+ response.write('window.parent.parent.postMessage({call: "frameLoaded", testname: "' + query['scriptedreport'] + '", uri: window.location.toString()}, "*");');
+ } else if (query['internalframe']) {
+ // spit back an internal iframe (one that might be blocked)
+ response.setHeader("Content-Type", "text/html", false);
+ response.write('<html><head>');
+ if (query['double'])
+ response.write('<script src="file_frameancestors_userpass.sjs?double=1&scriptedreport=' + query['testid'] + '"></script>');
+ else
+ response.write('<script src="file_frameancestors_userpass.sjs?scriptedreport=' + query['testid'] + '"></script>');
+ response.write('</head><body>');
+ response.write(unescape(query['internalframe']));
+ response.write('</body></html>');
+ } else if (query['externalframe']) {
+ // spit back an internal iframe (one that won't be blocked, and probably
+ // has no CSP)
+ response.setHeader("Content-Type", "text/html", false);
+ response.write('<html><head>');
+ // response.write('<script src="file_frameancestors_userpass.sjs?double=1&scriptedreport=' + query['externalframe'] + '"></script>');
+ response.write('</head><body>');
+ response.write(unescape(query['externalframe']));
+ response.write('</body></html>');
+ } else {
+ // default case: error.
+ response.setHeader("Content-Type", "text/html", false);
+ response.write('<html><body>');
+ response.write("ERROR: not sure what to serve.");
+ response.write('</body></html>');
+ }
+}
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/test_frameancestors_userpass.html
@@ -0,0 +1,164 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+ <title>Test for Content Security Policy Frame Ancestors directive</title>
+ <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<iframe style="width:100%;height:300px;" id='cspframe'></iframe>
+<script class="testbody" type="text/javascript">
+
+// These are test results: -1 means it hasn't run,
+// true/false is the pass/fail result.
+var framesThatShouldLoad = {
+ //aa_allow: -1, /* innermost frame allows a *
+ //aa_block: -1, /* innermost frame denies a */
+ //ab_allow: -1, /* innermost frame allows a */
+ //ab_block: -1, /* innermost frame denies a */
+ aba_allow: -1, /* innermost frame allows b,a */
+ //aba_block: -1, /* innermost frame denies b */
+ //aba2_block: -1, /* innermost frame denies a */
+// abb_allow: -1, /* innermost frame allows b,a */
+ //abb_block: -1, /* innermost frame denies b */
+ //abb2_block: -1, /* innermost frame denies a */
+};
+
+// we normally expect _6_ violations (6 test cases that cause blocks), but many
+// of the cases cause violations due to the // origin of the test harness (same
+// as 'a'). When the violation is cross-origin, the URI passed to the observers
+// is null (see bug 846978). This means we can't tell if it's part of the test
+// case or if it is the test harness frame (also origin 'a').
+// As a result, we'll get an extra violation for the following cases:
+// ab_block "frame-ancestors 'none'" (outer frame and test harness)
+// aba2_block "frame-ancestors b" (outer frame and test harness)
+// abb2_block "frame-ancestors b" (outer frame and test harness)
+//
+// and while we can detect the test harness check for this one case since
+// the violations are not cross-origin and we get the URI:
+// aba2_block "frame-ancestors b" (outer frame and test harness)
+//
+// we can't for these other ones:
+// ab_block "frame-ancestors 'none'" (outer frame and test harness)
+// abb2_block "frame-ancestors b" (outer frame and test harness)
+//
+// so that results in 2 extra violation notifications due to the test harness.
+// expected = 6, total = 8
+//
+// Number of tests that pass for this file should be 12 (8 violations 4 loads)
+var expectedViolationsLeft = 1;
+
+// This is used to watch the blocked data bounce off CSP and allowed data
+// get sent out to the wire.
+function examiner() {
+ SpecialPowers.addObserver(this, "csp-on-violate-policy");
+}
+examiner.prototype = {
+ observe: function(subject, topic, data) {
+ // subject should be an nsURI... though could be null since CSP
+ // prohibits cross-origin URI reporting during frame ancestors checks.
+ if (subject && !SpecialPowers.can_QI(subject))
+ return;
+
+ var asciiSpec = subject;
+
+ try {
+ asciiSpec = SpecialPowers.getPrivilegedProps(
+ SpecialPowers.do_QueryInterface(subject, "nsIURI"),
+ "asciiSpec");
+
+ // skip checks on the test harness -- can't do this skipping for
+ // cross-origin blocking since the observer doesn't get the URI. This
+ // can cause this test to over-succeed (but only in specific cases).
+ if (asciiSpec.includes("test_frameancestors_userpass.html")) {
+ return;
+ }
+ } catch (ex) {
+ // was not an nsIURI, so it was probably a cross-origin report.
+ }
+
+
+ if (topic === "csp-on-violate-policy") {
+ //these were blocked... record that they were blocked
+ window.frameBlocked(asciiSpec, data);
+ }
+ },
+
+ // must eventually call this to remove the listener,
+ // or mochitests might get borked.
+ remove: function() {
+ SpecialPowers.removeObserver(this, "csp-on-violate-policy");
+ }
+}
+
+// called when a frame is loaded
+// -- if it's not enumerated above, it should not load!
+var frameLoaded = function(testname, uri) {
+ //test already complete.... forget it... remember the first result.
+ if (window.framesThatShouldLoad[testname] != -1)
+ return;
+
+ if (typeof window.framesThatShouldLoad[testname] === 'undefined') {
+ // uh-oh, we're not expecting this frame to load!
+ ok(false, testname + ' framed site should not have loaded: ' + uri);
+ } else {
+ //Check if @ symbol is there in URI.
+ if(uri.includes('@'))
+ {
+ ok(false, ' URI contains userpass. Fetched URI is ' + uri);
+ }
+ else {
+ framesThatShouldLoad[testname] = true;
+ ok(true, ' URI doesn\'t contain userpass. Fetched URI is ' + uri);
+ }
+ }
+ checkTestResults();
+}
+
+// called when a frame is blocked
+// -- we can't determine *which* frame was blocked, but at least we can count them
+var frameBlocked = function(uri, policy) {
+ //ok(true, 'a CSP policy blocked frame from being loaded: ' + policy);
+ expectedViolationsLeft--;
+ checkTestResults();
+}
+
+
+// Check to see if all the tests have run
+var checkTestResults = function() {
+ // if any test is incomplete, keep waiting
+ for (var v in framesThatShouldLoad)
+ if(window.framesThatShouldLoad[v] == -1)
+ return;
+
+ if (window.expectedViolationsLeft > 0)
+ return;
+
+ // ... otherwise, finish
+ window.examiner.remove();
+ SimpleTest.finish();
+}
+
+window.addEventListener("message", receiveMessage);
+
+function receiveMessage(event) {
+ if (event.data.call && event.data.call == 'frameLoaded')
+ frameLoaded(event.data.testname, event.data.uri);
+}
+
+//////////////////////////////////////////////////////////////////////
+// set up and go
+window.examiner = new examiner();
+SimpleTest.waitForExplicitFinish();
+
+// save this for last so that our listeners are registered.
+// ... this loads the testbed of good and bad requests.
+document.getElementById('cspframe').src = 'file_frameancestors_userpass.html';
+
+</script>
+</pre>
+</body>
+</html>