Quelle test_scheme_relative_sources.html

Sprache: HTML

products/Sources/formale Sprachen/C/Firefox/dom/security/test/csp/test_scheme_relative_sources.html

<!DOCTYPE HTML>
<html>
<head>
  <title>Bug 921493 - CSP: test allowlisting of scheme-relative sources</title>
  
  <script src="/tests/SimpleTest/SimpleTest.js"></script>
  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<iframe style="width:100%;" id="testframe"></iframe>

<script class="testbody" type="text/javascript">

SimpleTest.waitForExplicitFinish();

/* Description of the test:
* We load http and https pages and verify that scheme relative sources
* are allowed unless its a downgrade from https -> http.
*
* Please note that the policy contains 'unsafe-inline' so we can use
* an inline script to query the result from within the sandboxed iframe
* and report it back to the parent document.
*/

var POLICY = "default-src 'none'; script-src 'unsafe-inline' example.com;";

var tests = [
  {
    description: "http -> http",
    from: "http",
    to: "http",
    result: "allowed",
  },
  {
    description: "http -> https",
    from: "http",
    to: "https",
    result: "allowed",
  },
  {
    description: "https -> https",
    from: "https",
    to: "https",
    result: "allowed",
  },
  {
    description: "https -> http",
    from: "https",
    to: "http",
    result: "blocked",
  }
];

var counter = 0;
var curTest;

function loadNextTest() {
  if (counter == tests.length) {
    window.removeEventListener("message", receiveMessage);
    SimpleTest.finish();
    return;
  }

  curTest = tests[counter++];

  var src = curTest.from +
             "://example.com/tests/dom/security/test/csp/file_scheme_relative_sources.sjs" +
            "?scheme=" + curTest.to +
            "&policy=" + escape(POLICY);

  document.getElementById("testframe").src = src;
}

// using a postMessage handler to report the result back from
// within the sandboxed iframe without 'allow-same-origin'.
window.addEventListener("message", receiveMessage);

function receiveMessage(event) {

  is(event.data.result, curTest.result,
     "should be " + curTest.result + " in test (" + curTest.description + ")!");

  loadNextTest();
}

// get the test started
loadNextTest();

</script>
</body>
</html>

Messung V0.5 in Prozent

¤ Dauer der Verarbeitung: 0.23 Sekunden (vorverarbeitet am 2026-06-05) ¤

Wurzel

Suchen

PVS Prover

Isabelle Prover

NIST Cobol Testsuite

Cephes Mathematical Library

Vienna Development Method

Haftungshinweis

Die Informationen auf dieser Webseite wurden nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit, noch Qualität der bereit gestellten Informationen zugesichert.

Bemerkung:

Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.