[CSP] test that quote characters other than U+0027 APOSTROPHE don't work

Part of w3c/webappsec-csp#434.
web-platform-tests · May 14, 2020 · 707e848 · 707e848
1 parent e4d5929
commit 707e848
Showing 1 changed file with 47 additions and 0 deletions.
diff --git a/content-security-policy/generic/quote-characters.html b/content-security-policy/generic/quote-characters.html
@@ -0,0 +1,47 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <script src="/resources/testharness.js"></script>
+  <script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+  <script>
+    var tests = [
+      { "csp": "img-src 'none';", "expected": false, "name": "precondition: single quotes are accepted" },
+      // See https://github.com/w3c/webappsec-csp/issues/434 for background on what is tested.
+      { "csp": 'img-src "none";', "expected": true, "name": "double quotes should not be accepted" },
+      { "csp": "img-src \u0091none'", "expected": true, "name": "U+0091 + single quote should not be accepted" },
+      { "csp": "img-src 'none\u0092", "expected": true, "name": "single quote + U+0092 should not be accepted" },
+      { "csp": "img-src \u0091none\u0092", "expected": true, "name": "U+0091 + U+0092 should not be accepted" },
+      { "csp": "img-src \u2018none\u2019;", "expected": true, "name": "U+2018 + U+2019 should not be accepted" },
+    ];
+
+    tests.forEach(test => {
+      async_test(t => {
+        var url = "support/load_img_and_post_result_meta.sub.html?csp=" + encodeURIComponent(test.csp);
+        test_image_loads_as_expected(test, t, url);
+      }, test.name + " - meta tag");
+
+      async_test(t => {
+        var url = "support/load_img_and_post_result_meta.sub.html?csp=" + encodeURIComponent(test.csp);
+        test_image_loads_as_expected(test, t, url);
+      }, test.name + " - HTTP header");
+    });
+
+    function test_image_loads_as_expected(test, t, url) {
+      var i = document.createElement("iframe");
+      i.src = url;
+      window.addEventListener("message", t.step_func(function(e) {
+        if (e.source != i.contentWindow) return;
+        if (test.expected) {
+          assert_equals(e.data, "img loaded");
+        } else {
+          assert_equals(e.data, "img not loaded");
+        }
+        t.done();
+      }));
+      document.body.appendChild(i);
+    }
+  </script>
+</body>
+</html>