blob: 731553dd7d6339c5fca85dbc340a86a76d6e0d10 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
// custom *.sjs for Bug 1122236
// CSP: 'block-all-mixed-content'
const HEAD =
"<!DOCTYPE HTML>" +
"<html><head><meta charset=\"utf-8\">" +
"<title>Bug 1122236 - CSP: Implement block-all-mixed-content</title>" +
"</head>";
const CSP_ALLOW =
"<meta http-equiv=\"Content-Security-Policy\" content=\"img-src *\">";
const CSP_BLOCK =
"<meta http-equiv=\"Content-Security-Policy\" content=\"block-all-mixed-content\">";
const BODY =
"<body>" +
"<img id=\"testimage\" src=\"http://mochi.test:8888/tests/image/test/mochitest/blue.png\"></img>" +
"<script type=\"application/javascript\">" +
" var myImg = document.getElementById(\"testimage\");" +
" myImg.onload = function(e) {" +
" window.parent.postMessage({result: \"img-loaded\"}, \"*\");" +
" };" +
" myImg.onerror = function(e) {" +
" window.parent.postMessage({result: \"img-blocked\"}, \"*\");" +
" };" +
"</script>" +
"</body>" +
"</html>";
// We have to use this special code fragment, in particular '?nocache' to trigger an
// actual network load rather than loading the image from the cache.
const BODY_CSPRO =
"<body>" +
"<img id=\"testimage\" src=\"http://mochi.test:8888/tests/image/test/mochitest/blue.png?nocache\"></img>" +
"<script type=\"application/javascript\">" +
" var myImg = document.getElementById(\"testimage\");" +
" myImg.onload = function(e) {" +
" window.parent.postMessage({result: \"img-loaded\"}, \"*\");" +
" };" +
" myImg.onerror = function(e) {" +
" window.parent.postMessage({result: \"img-blocked\"}, \"*\");" +
" };" +
"</script>" +
"</body>" +
"</html>";
function handleRequest(request, response)
{
// avoid confusing cache behaviors
response.setHeader("Cache-Control", "no-cache", false);
var queryString = request.queryString;
if (queryString === "csp-block") {
response.write(HEAD + CSP_BLOCK + BODY);
return;
}
if (queryString === "csp-allow") {
response.write(HEAD + CSP_ALLOW + BODY);
return;
}
if (queryString === "no-csp") {
response.write(HEAD + BODY);
return;
}
if (queryString === "cspro-block") {
// CSP RO is not supported in meta tag, let's use the header
response.setHeader("Content-Security-Policy-Report-Only", "block-all-mixed-content", false);
response.write(HEAD + BODY_CSPRO);
return;
}
// we should never get here but just in case return something unexpected
response.write("do'h");
}
|
