From 5f8de423f190bbb79a62f804151bc24824fa32d8 Mon Sep 17 00:00:00 2001 From: "Matt A. Tobin" Date: Fri, 2 Feb 2018 04:16:08 -0500 Subject: Add m-esr52 at 52.6.0 --- ...ild-src-about-blank-allowed-by-default.sub.html | 24 ++++++++ ...t-blank-allowed-by-default.sub.html.sub.headers | 6 ++ ...hild-src-about-blank-allowed-by-scheme.sub.html | 20 +++++++ ...ut-blank-allowed-by-scheme.sub.html.sub.headers | 6 ++ .../child-src/child-src-allowed.sub.html | 63 ++++++++++++++++++++ .../child-src-allowed.sub.html.sub.headers | 6 ++ .../child-src/child-src-blocked.sub.html | 61 +++++++++++++++++++ .../child-src-blocked.sub.html.sub.headers | 6 ++ .../child-src-conflicting-frame-src.sub.html | 61 +++++++++++++++++++ ...-src-conflicting-frame-src.sub.html.sub.headers | 6 ++ .../child-src/child-src-cross-origin-load.sub.html | 68 ++++++++++++++++++++++ ...hild-src-cross-origin-load.sub.html.sub.headers | 6 ++ .../child-src/child-src-worker-allowed.sub.html | 32 ++++++++++ .../child-src-worker-allowed.sub.html.sub.headers | 6 ++ .../child-src/child-src-worker-blocked.sub.html | 35 +++++++++++ .../child-src-worker-blocked.sub.html.sub.headers | 6 ++ 16 files changed, 412 insertions(+) create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html.sub.headers create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html.sub.headers create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-allowed.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-allowed.sub.html.sub.headers create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-blocked.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-blocked.sub.html.sub.headers create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub.html.sub.headers create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-cross-origin-load.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-cross-origin-load.sub.html.sub.headers create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-worker-allowed.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-worker-allowed.sub.html.sub.headers create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-worker-blocked.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-worker-blocked.sub.html.sub.headers (limited to 'testing/web-platform/tests/content-security-policy/child-src') diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html new file mode 100644 index 000000000..9222a8ddc --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html @@ -0,0 +1,24 @@ + + + + + + child-src-about-blank-allowed-by-default + + + + +

These frames should not be blocked by Content-Security-Policy. + It's pointless to block about:blank iframes because + blocking a frame just results in displaying about:blank anyway! +

+ + + +
+ + + + \ No newline at end of file diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html.sub.headers b/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html.sub.headers new file mode 100644 index 000000000..68b2fb2fb --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html.sub.headers @@ -0,0 +1,6 @@ +Expires: Mon, 26 Jul 1997 05:00:00 GMT +Cache-Control: no-store, no-cache, must-revalidate +Cache-Control: post-check=0, pre-check=0, false +Pragma: no-cache +Set-Cookie: child-src-about-blank-allowed-by-default={{$id:uuid()}}; Path=/content-security-policy/child-src +Content-Security-Policy: child-src 'none'; object-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}} diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html new file mode 100644 index 000000000..d94eff684 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html @@ -0,0 +1,20 @@ + + + + + + child-src-about-blank-allowed-by-scheme + + + + +

This frame should not be blocked by Content-Security-Policy. +

+ +
+ + + + \ No newline at end of file diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html.sub.headers b/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html.sub.headers new file mode 100644 index 000000000..9ff84d67d --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html.sub.headers @@ -0,0 +1,6 @@ +Expires: Mon, 26 Jul 1997 05:00:00 GMT +Cache-Control: no-store, no-cache, must-revalidate +Cache-Control: post-check=0, pre-check=0, false +Pragma: no-cache +Set-Cookie: child-src-about-blank-allowed-by-scheme={{$id:uuid()}}; Path=/content-security-policy/child-src +Content-Security-Policy: child-src about:; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}} diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-allowed.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-allowed.sub.html new file mode 100644 index 000000000..12a075adb --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-allowed.sub.html @@ -0,0 +1,63 @@ + + + + + child-src-allowed + + + + + +

+ This iframe should be allowed. +

+ + + + + +
+ + + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-allowed.sub.html.sub.headers b/testing/web-platform/tests/content-security-policy/child-src/child-src-allowed.sub.html.sub.headers new file mode 100644 index 000000000..7eb8d76f9 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-allowed.sub.html.sub.headers @@ -0,0 +1,6 @@ +Expires: Mon, 26 Jul 1997 05:00:00 GMT +Cache-Control: no-store, no-cache, must-revalidate +Cache-Control: post-check=0, pre-check=0, false +Pragma: no-cache +Set-Cookie: child-src-allowed={{$id:uuid()}}; Path=/content-security-policy/child-src +Content-Security-Policy: child-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}} diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-blocked.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-blocked.sub.html new file mode 100644 index 000000000..e32cc0af0 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-blocked.sub.html @@ -0,0 +1,61 @@ + + + + + + child-src-blocked + + + + + +

+ IFrames blocked by CSP should generate a 'load', not 'error' event, regardless of blocked state. This means they appear to be normal cross-origin loads, thereby not leaking URL information directly to JS. +

+ + + + + +
+ + + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-blocked.sub.html.sub.headers b/testing/web-platform/tests/content-security-policy/child-src/child-src-blocked.sub.html.sub.headers new file mode 100644 index 000000000..961d18a7d --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-blocked.sub.html.sub.headers @@ -0,0 +1,6 @@ +Expires: Mon, 26 Jul 1997 05:00:00 GMT +Cache-Control: no-store, no-cache, must-revalidate +Cache-Control: post-check=0, pre-check=0, false +Pragma: no-cache +Set-Cookie: child-src-blocked={{$id:uuid()}}; Path=/content-security-policy/child-src +Content-Security-Policy: child-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}} diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub.html new file mode 100644 index 000000000..b681253ae --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub.html @@ -0,0 +1,61 @@ + + + + child-src-blocked + + + + + +

+ A more permissive child-src should not relax restrictions from a less- + permissive frame-src. Directives still combine for least privilege, even when + one obsoletes another. +

+ + + + + +
+ + + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub.html.sub.headers b/testing/web-platform/tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub.html.sub.headers new file mode 100644 index 000000000..9c3ce8426 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub.html.sub.headers @@ -0,0 +1,6 @@ +Expires: Mon, 26 Jul 1997 05:00:00 GMT +Cache-Control: no-store, no-cache, must-revalidate +Cache-Control: post-check=0, pre-check=0, false +Pragma: no-cache +Set-Cookie: child-src-conflicting-frame-src={{$id:uuid()}}; Path=/content-security-policy/child-src +Content-Security-Policy: frame-src 'none'; child-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}} diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-cross-origin-load.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-cross-origin-load.sub.html new file mode 100644 index 000000000..b6f3e5164 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-cross-origin-load.sub.html @@ -0,0 +1,68 @@ + + + + + + child-src-cross-origin-load + + + + + +

+ IFrames blocked by CSP should generate a 'load', not 'error' event, regardless of blocked state. This means they appear to be normal cross-origin loads, thereby not leaking URL information directly to JS. +

+ + + + + + + +
+ + + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-cross-origin-load.sub.html.sub.headers b/testing/web-platform/tests/content-security-policy/child-src/child-src-cross-origin-load.sub.html.sub.headers new file mode 100644 index 000000000..53527c1ad --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-cross-origin-load.sub.html.sub.headers @@ -0,0 +1,6 @@ +Expires: Mon, 26 Jul 1997 05:00:00 GMT +Cache-Control: no-store, no-cache, must-revalidate +Cache-Control: post-check=0, pre-check=0, false +Pragma: no-cache +Set-Cookie: child-src-cross-origin-load={{$id:uuid()}}; Path=/content-security-policy/child-src +Content-Security-Policy: child-src 'self' http://www1.{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}} diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-allowed.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-allowed.sub.html new file mode 100644 index 000000000..361d09742 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-allowed.sub.html @@ -0,0 +1,32 @@ + + + + + child-src-worker-allowed + + + + + + + + + + +
+ + + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-allowed.sub.html.sub.headers b/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-allowed.sub.html.sub.headers new file mode 100644 index 000000000..4ddb39e84 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-allowed.sub.html.sub.headers @@ -0,0 +1,6 @@ +Expires: Mon, 26 Jul 1997 05:00:00 GMT +Cache-Control: no-store, no-cache, must-revalidate +Cache-Control: post-check=0, pre-check=0, false +Pragma: no-cache +Set-Cookie: child-src-worker-allowed={{$id:uuid()}}; Path=/content-security-policy/child-src +Content-Security-Policy: child-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}} diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-blocked.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-blocked.sub.html new file mode 100644 index 000000000..8ed6b157a --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-blocked.sub.html @@ -0,0 +1,35 @@ + + + + + child-src-worker-blocked + + + + + + + + + + +
+ + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-blocked.sub.html.sub.headers b/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-blocked.sub.html.sub.headers new file mode 100644 index 000000000..685d6dcf5 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-blocked.sub.html.sub.headers @@ -0,0 +1,6 @@ +Expires: Mon, 26 Jul 1997 05:00:00 GMT +Cache-Control: no-store, no-cache, must-revalidate +Cache-Control: post-check=0, pre-check=0, false +Pragma: no-cache +Set-Cookie: child-src-worker-blocked={{$id:uuid()}}; Path=/content-security-policy/child-src +Content-Security-Policy: child-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}} -- cgit v1.2.3