1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
// some javascript for the CSP eval() tests
// all of these evals should succeed, as the document loading this script
// has script-src 'self' 'unsafe-eval'
function logResult(str, passed) {
var elt = document.createElement('div');
var color = passed ? "#cfc;" : "#fcc";
elt.setAttribute('style', 'background-color:' + color + '; width:100%; border:1px solid black; padding:3px; margin:4px;');
elt.innerHTML = str;
document.body.appendChild(elt);
}
// callback for when stuff is allowed by CSP
var onevalexecuted = (function(window) {
return function(shouldrun, what, data) {
window.parent.scriptRan(shouldrun, what, data);
logResult((shouldrun ? "PASS: " : "FAIL: ") + what + " : " + data, shouldrun);
};})(window);
// callback for when stuff is blocked
var onevalblocked = (function(window) {
return function(shouldrun, what, data) {
window.parent.scriptBlocked(shouldrun, what, data);
logResult((shouldrun ? "FAIL: " : "PASS: ") + what + " : " + data, !shouldrun);
};})(window);
// Defer until document is loaded so that we can write the pretty result boxes
// out.
addEventListener('load', function() {
// setTimeout(String) test -- should pass
try {
setTimeout('onevalexecuted(true, "setTimeout(String)", "setTimeout with a string was enabled.");', 10);
} catch (e) {
onevalblocked(true, "setTimeout(String)",
"setTimeout with a string was blocked");
}
// setTimeout(function) test -- should pass
try {
setTimeout(function() {
onevalexecuted(true, "setTimeout(function)",
"setTimeout with a function was enabled.")
}, 10);
} catch (e) {
onevalblocked(true, "setTimeout(function)",
"setTimeout with a function was blocked");
}
// eval() test
try {
eval('onevalexecuted(true, "eval(String)", "eval() was enabled.");');
} catch (e) {
onevalblocked(true, "eval(String)",
"eval() was blocked");
}
// eval(foo,bar) test
try {
eval('onevalexecuted(true, "eval(String,scope)", "eval() was enabled.");',1);
} catch (e) {
onevalblocked(true, "eval(String,object)",
"eval() with scope was blocked");
}
// [foo,bar].sort(eval) test
try {
['onevalexecuted(true, "[String, obj].sort(eval)", "eval() was enabled.");',1].sort(eval);
} catch (e) {
onevalblocked(true, "[String, obj].sort(eval)",
"eval() with scope via sort was blocked");
}
// [].sort.call([foo,bar], eval) test
try {
[].sort.call(['onevalexecuted(true, "[String, obj].sort(eval)", "eval() was enabled.");',1], eval);
} catch (e) {
onevalblocked(true, "[].sort.call([String, obj], eval)",
"eval() with scope via sort/call was blocked");
}
// new Function() test
try {
var fcn = new Function('onevalexecuted(true, "new Function(String)", "new Function(String) was enabled.");');
fcn();
} catch (e) {
onevalblocked(true, "new Function(String)",
"new Function(String) was blocked.");
}
function checkResult() {
//alert(bar);
if (bar) {
onevalexecuted(true, "setTimeout(eval, 0, str)",
"setTimeout(eval, 0, string) was enabled.");
} else {
onevalblocked(true, "setTimeout(eval, 0, str)",
"setTimeout(eval, 0, str) was blocked.");
}
}
var bar = false;
function foo() {
bar = true;
}
window.foo = foo;
// setTimeout(eval, 0, str)
// error is not catchable here
setTimeout(eval, 0, 'window.foo();');
setTimeout(checkResult.bind(this), 0);
}, false);
|
