Bug 1370468 - Tests for userpass in frame ancestor added
MozReview-Commit-ID: 8lsXOszop8e
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frame_a.html
@@ -0,0 +1,14 @@
+<html>
+ <head>
+ <title>Nested frame</title>
+ <script>
+ parent.parent.postMessage({call: "frameLoaded", testname: "frame_a", uri: window.location.toString()}, "*");
+ </script>
+ </head>
+ <body>
+
+ <tt> IFRAME C</tt><br/>
+ <iframe src='http://sampleuser:samplepass@mochi.test:8888/tests/dom/security/test/csp/file_frame_c.html'></iframe><br/>
+
+ </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frame_b.html
@@ -0,0 +1,14 @@
+<html>
+ <head>
+ <title>Nested frame</title>
+ <script>
+ parent.parent.postMessage({call: "frameLoaded", testname: "frame_b", uri: window.location.toString()}, "*");
+ </script>
+ </head>
+ <body>
+
+ <tt> IFRAME D</tt><br/>
+ <iframe src='http://sampleuser:samplepass@example.com/tests/dom/security/test/csp/file_frame_d.html'></iframe><br/>
+
+ </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frame_c.html
@@ -0,0 +1,8 @@
+<html>
+ <head>
+ <title>Nested frame</title>
+ </head>
+ <body>
+ nested frame C content
+ </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frame_c.html^headers^
@@ -0,0 +1,1 @@
+Content-Security-Policy: default-src 'none'; frame-ancestors http://mochi.test:8888/ ; script-src 'self';
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frame_d.html
@@ -0,0 +1,8 @@
+<html>
+ <head>
+ <title>Nested frame</title>
+ </head>
+ <body>
+ nested frame D content
+ </body>
+</html>
new file mode 100644
--- /dev/null
+++ b/dom/security/test/csp/file_frame_d.html^headers^
@@ -0,0 +1,1 @@
+Content-Security-Policy: default-src 'none'; frame-ancestors http://sampleuser:samplepass@example.com/ ; script-src 'self';
--- a/dom/security/test/csp/file_frameancestors_userpass.html
+++ b/dom/security/test/csp/file_frameancestors_userpass.html
@@ -1,33 +1,15 @@
<html>
<head>
<title>CSP frame ancestors tests</title>
- <!-- this page shouldn't have a CSP, just the sub-pages. -->
- <script src='file_frameancestors_userpass.js'></script>
-
</head>
<body>
-<!-- These iframes will get populated by the attached javascript. -->
-
-<tt> aba_allow: /* innermost frame allows b,a */</tt><br/>
-<iframe id='aba_allow'></iframe><br/>
-
-<tt> aba_block: /* innermost frame denies b */</tt><br/>
-<iframe id='aba_block'></iframe><br/>
+<tt> IFRAME A</tt><br/>
+<iframe src='http://sampleuser:samplepass@mochi.test:8888/tests/dom/security/test/csp/file_frame_a.html'></iframe><br/>
-<tt> aba2_block: /* innermost frame denies a */</tt><br/>
-<iframe id='aba2_block'></iframe><br/>
-
-<tt> abb_allow: /* innermost frame allows b,a */</tt><br/>
-<iframe id='abb_allow'></iframe><br/>
-
-<tt> abb_block: /* innermost frame denies b */</tt><br/>
-<iframe id='abb_block'></iframe><br/>
-
-<tt> abb2_block: /* innermost frame denies a */</tt><br/>
-<iframe id='abb2_block'></iframe><br/>
-
+<tt> IFRAME B</tt><br/>
+<iframe src='http://sampleuser:samplepass@example.com/tests/dom/security/test/csp/file_frame_b.html'></iframe><br/>
</body>
</html>
deleted file mode 100644
--- a/dom/security/test/csp/file_frameancestors_userpass.js
+++ /dev/null
@@ -1,52 +0,0 @@
-// Script to populate the test frames in the frame ancestors mochitest.
-//
-function setupFrames() {
-
- var $ = function(v) { return document.getElementById(v); }
- var base = {
- self: '/tests/dom/security/test/csp/file_frameancestors_userpass.sjs',
- a: 'http://sampleuser:samplepass@mochi.test:8888/tests/dom/security/test/csp/file_frameancestors_userpass.sjs',
- b: 'http://sampleuser:samplepass@example.com/tests/dom/security/test/csp/file_frameancestors_userpass.sjs'
- };
-
- // In both cases (base.a, base.b) the path starts with /tests/. Let's make sure this
- // path within the CSP policy is completely ignored when enforcing frame ancestors.
- // To test this behavior we use /foo/ and /bar/ as dummy values for the path.
- var host = { a: 'http://mochi.test:8888/foo/', b: 'http://example.com:80/bar/' };
-
- var innerframeuri = null;
- var elt = null;
-
- /* .... two-level framing */
- elt = $('aba_allow');
- innerframeuri = base.a + "?testid=aba_allow&double=1&internalframe=aba_a&csp=" +
- escape("default-src 'none'; frame-ancestors " + host.a + " " + host.b + "; script-src 'self'");
- elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
-
- elt = $('aba_block');
- innerframeuri = base.a + "?testid=aba_allow&double=1&internalframe=aba_b&csp=" +
- escape("default-src 'none'; frame-ancestors " + host.a + "; script-src 'self'");
- elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
-
- elt = $('aba2_block');
- innerframeuri = base.a + "?testid=aba_allow&double=1&internalframe=aba2_b&csp=" +
- escape("default-src 'none'; frame-ancestors " + host.b + "; script-src 'self'");
- elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
-
- elt = $('abb_allow');
- innerframeuri = base.b + "?testid=abb_allow&double=1&internalframe=abb_a&csp=" +
- escape("default-src 'none'; frame-ancestors " + host.a + " " + host.b + "; script-src 'self'");
- elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
-
- elt = $('abb_block');
- innerframeuri = base.b + "?testid=abb_allow&double=1&internalframe=abb_b&csp=" +
- escape("default-src 'none'; frame-ancestors " + host.a + "; script-src 'self'");
- elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
-
- elt = $('abb2_block');
- innerframeuri = base.b + "?testid=abb_allow&double=1&internalframe=abb2_b&csp=" +
- escape("default-src 'none'; frame-ancestors " + host.b + "; script-src 'self'");
- elt.src = base.b + "?externalframe=" + escape('<script> document.write(location) </script>') + escape('<iframe src="' + innerframeuri + '"></iframe>');
-}
-
-window.addEventListener('load', setupFrames);
deleted file mode 100644
--- a/dom/security/test/csp/file_frameancestors_userpass.sjs
+++ /dev/null
@@ -1,54 +0,0 @@
-// SJS file for CSP frame ancestor mochitests
-function handleRequest(request, response)
-{
- var query = {};
- request.queryString.split('&').forEach(function (val) {
- var [name, value] = val.split('=');
- query[name] = unescape(value);
- });
-
- var isPreflight = request.method == "OPTIONS";
-
- //avoid confusing cache behaviors
- response.setHeader("Cache-Control", "no-cache", false);
-
- // grab the desired policy from the query, and then serve a page
- if (query['csp'])
- response.setHeader("Content-Security-Policy",
- unescape(query['csp']),
- false);
- if (query['scriptedreport']) {
- // spit back a script that records that the page loaded
- response.setHeader("Content-Type", "text/javascript", false);
- if (query['double'])
- response.write('window.parent.parent.parent.postMessage({call: "frameLoaded", testname: "' + query['scriptedreport'] + '", uri: window.location.toString()}, "*");');
- else
- response.write('window.parent.parent.postMessage({call: "frameLoaded", testname: "' + query['scriptedreport'] + '", uri: window.location.toString()}, "*");');
- } else if (query['internalframe']) {
- // spit back an internal iframe (one that might be blocked)
- response.setHeader("Content-Type", "text/html", false);
- response.write('<html><head>');
- if (query['double'])
- response.write('<script src="file_frameancestors_userpass.sjs?double=1&scriptedreport=' + query['testid'] + '"></script>');
- else
- response.write('<script src="file_frameancestors_userpass.sjs?scriptedreport=' + query['testid'] + '"></script>');
- response.write('</head><body>');
- response.write(unescape(query['internalframe']));
- response.write('</body></html>');
- } else if (query['externalframe']) {
- // spit back an internal iframe (one that won't be blocked, and probably
- // has no CSP)
- response.setHeader("Content-Type", "text/html", false);
- response.write('<html><head>');
- // response.write('<script src="file_frameancestors_userpass.sjs?double=1&scriptedreport=' + query['externalframe'] + '"></script>');
- response.write('</head><body>');
- response.write(unescape(query['externalframe']));
- response.write('</body></html>');
- } else {
- // default case: error.
- response.setHeader("Content-Type", "text/html", false);
- response.write('<html><body>');
- response.write("ERROR: not sure what to serve.");
- response.write('</body></html>');
- }
-}
--- a/dom/security/test/csp/mochitest.ini
+++ b/dom/security/test/csp/mochitest.ini
@@ -27,18 +27,22 @@ support-files =
file_evalscript_main.html
file_evalscript_main.html^headers^
file_evalscript_main_allowed.html
file_evalscript_main_allowed.html^headers^
file_frameancestors_main.html
file_frameancestors_main.js
file_frameancestors.sjs
file_frameancestors_userpass.html
- file_frameancestors_userpass.js
- file_frameancestors_userpass.sjs
+ file_frame_a.html
+ file_frame_b.html
+ file_frame_c.html
+ file_frame_c.html^headers^
+ file_frame_d.html
+ file_frame_d.html^headers^
file_inlinescript.html
file_inlinestyle_main.html
file_inlinestyle_main.html^headers^
file_inlinestyle_main_allowed.html
file_inlinestyle_main_allowed.html^headers^
file_invalid_source_expression.html
file_main.html
file_main.html^headers^
--- a/dom/security/test/csp/test_frameancestors_userpass.html
+++ b/dom/security/test/csp/test_frameancestors_userpass.html
@@ -1,59 +1,30 @@
<!DOCTYPE HTML>
<html>
<head>
- <title>Test for Content Security Policy Frame Ancestors directive</title>
+ <title>Test for Userpass in Frame Ancestors directive</title>
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<iframe style="width:100%;height:300px;" id='cspframe'></iframe>
<script class="testbody" type="text/javascript">
// These are test results: -1 means it hasn't run,
// true/false is the pass/fail result.
var framesThatShouldLoad = {
- //aa_allow: -1, /* innermost frame allows a *
- //aa_block: -1, /* innermost frame denies a */
- //ab_allow: -1, /* innermost frame allows a */
- //ab_block: -1, /* innermost frame denies a */
- aba_allow: -1, /* innermost frame allows b,a */
- //aba_block: -1, /* innermost frame denies b */
- //aba2_block: -1, /* innermost frame denies a */
-// abb_allow: -1, /* innermost frame allows b,a */
- //abb_block: -1, /* innermost frame denies b */
- //abb2_block: -1, /* innermost frame denies a */
+ frame_a: -1, /* frame a allowed */
+ frame_b: -1, /* frame b allowed */
};
-// we normally expect _6_ violations (6 test cases that cause blocks), but many
-// of the cases cause violations due to the // origin of the test harness (same
-// as 'a'). When the violation is cross-origin, the URI passed to the observers
-// is null (see bug 846978). This means we can't tell if it's part of the test
-// case or if it is the test harness frame (also origin 'a').
-// As a result, we'll get an extra violation for the following cases:
-// ab_block "frame-ancestors 'none'" (outer frame and test harness)
-// aba2_block "frame-ancestors b" (outer frame and test harness)
-// abb2_block "frame-ancestors b" (outer frame and test harness)
-//
-// and while we can detect the test harness check for this one case since
-// the violations are not cross-origin and we get the URI:
-// aba2_block "frame-ancestors b" (outer frame and test harness)
-//
-// we can't for these other ones:
-// ab_block "frame-ancestors 'none'" (outer frame and test harness)
-// abb2_block "frame-ancestors b" (outer frame and test harness)
-//
-// so that results in 2 extra violation notifications due to the test harness.
-// expected = 6, total = 8
-//
-// Number of tests that pass for this file should be 12 (8 violations 4 loads)
+// Number of tests that pass for this file should be 1
var expectedViolationsLeft = 1;
// This is used to watch the blocked data bounce off CSP and allowed data
// get sent out to the wire.
function examiner() {
SpecialPowers.addObserver(this, "csp-on-violate-policy");
}
examiner.prototype = {
@@ -116,17 +87,25 @@ var frameLoaded = function(testname, uri
}
}
checkTestResults();
}
// called when a frame is blocked
// -- we can't determine *which* frame was blocked, but at least we can count them
var frameBlocked = function(uri, policy) {
- //ok(true, 'a CSP policy blocked frame from being loaded: ' + policy);
+
+ //Check if @ symbol is there in URI or in csp policy.
+ if(policy.includes('@') || uri.includes('@'))
+ {
+ ok(false, ' a CSP policy blocked frame from being loaded. But contains userpass. Policy is: ' + policy + ';URI is: ' + uri );
+ }
+ else {
+ ok(true, ' a CSP policy blocked frame from being loaded. Doesn\'t contain userpass. Policy is: ' + policy + ';URI is: ' + uri );
+ }
expectedViolationsLeft--;
checkTestResults();
}
// Check to see if all the tests have run
var checkTestResults = function() {
// if any test is incomplete, keep waiting