diff --git a/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html b/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html index badaf989eb749..7e67f2bbb70f8 100644 --- a/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html +++ b/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html @@ -2,44 +2,22 @@ + + diff --git a/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests.html b/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests.html index 979de1e8145cb..0a43d2171ccda 100644 --- a/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests.html +++ b/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests.html @@ -2,8 +2,10 @@ + + diff --git a/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html b/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html index 25b4440ef4117..0b1d141fb3ac1 100644 --- a/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html +++ b/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html @@ -2,55 +2,35 @@ + \ No newline at end of file + diff --git a/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html.headers b/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html.headers index c6412f8d472fc..8344761bdddf8 100644 --- a/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html.headers +++ b/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html.headers @@ -1 +1,2 @@ -Content-Security-Policy-Report-Only: require-trusted-types-for 'script' \ No newline at end of file +Content-Security-Policy-Report-Only: require-trusted-types-for 'script' +Content-Security-Policy: object-src 'none' diff --git a/testing/web-platform/tests/trusted-types/require-trusted-types-for.html b/testing/web-platform/tests/trusted-types/require-trusted-types-for.html index b0dcd9cc93002..c6dfbcbfb4871 100644 --- a/testing/web-platform/tests/trusted-types/require-trusted-types-for.html +++ b/testing/web-platform/tests/trusted-types/require-trusted-types-for.html @@ -2,62 +2,37 @@ + + - + diff --git a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-report-only.html b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-report-only.html index a81f5a4578938..b0cc65c088431 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-report-only.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-report-only.html @@ -1,12 +1,12 @@ - - + + diff --git a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting.html b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting.html index e7c7245f9e415..0fa7ed2be80f3 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting.html @@ -2,10 +2,11 @@ + diff --git a/testing/web-platform/tests/trusted-types/trusted-types-report-only.html b/testing/web-platform/tests/trusted-types/trusted-types-report-only.html index fcb77841163d9..f4386f832f43f 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-report-only.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-report-only.html @@ -3,6 +3,7 @@ + @@ -13,27 +14,12 @@ diff --git a/testing/web-platform/tests/trusted-types/trusted-types-report-only.html.headers b/testing/web-platform/tests/trusted-types/trusted-types-report-only.html.headers index 857a8b31e86bc..383f05138fe62 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-report-only.html.headers +++ b/testing/web-platform/tests/trusted-types/trusted-types-report-only.html.headers @@ -1 +1,2 @@ Content-Security-Policy-Report-Only: trusted-types two; report-uri /content-security-policy/resources/dummy-report.php; require-trusted-types-for 'script'; +Content-Security-Policy: object-src 'none' diff --git a/testing/web-platform/tests/trusted-types/trusted-types-reporting.html b/testing/web-platform/tests/trusted-types/trusted-types-reporting.html index 96c9dd72813a7..f1d0b14ee0497 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-reporting.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-reporting.html @@ -3,7 +3,7 @@ - + @@ -33,52 +33,11 @@ const url = "" + document.location; - // Return function that returns a promise that resolves on the given - // violation report. - // - // filter_arg - iff function, call it with the event object. - // Else, string-ify and compare against event.originalPolicy. - function promise_violation(filter_arg) { - return _ => new Promise((resolve, reject) => { - function handler(e) { - let matches = (filter_arg instanceof Function) - ? filter_arg(e) - : (e.originalPolicy.includes(filter_arg)); - if (matches) { - document.removeEventListener("securitypolicyviolation", handler); - e.stopPropagation(); - resolve(e); - } - } - document.addEventListener("securitypolicyviolation", handler); - }); - } - - // Like assert_throws_*, but we don't care about the exact error. We just want - // to run the code and continue. - function expect_throws(fn) { - try { fn(); } catch (err) { return; /* ignore */ } - assert_unreached(); - } - - // Test the "sample" field of the event. // TODO(vogelheim): The current set of tests allows for more variance in the // sample reports than the current spec draft does. Once the spec has // been finalized, we should clamp this down to check byte-for-byte // against the values mandated by the spec. - function expect_sample(s) { return e => { - assert_true(e.sample.includes(s), - `expected "${e.sample}" to include "${s}".`); - return e; - } } - - function expect_blocked_uri(s) { return e => { - assert_equals(e.blockedURI, s, - `expected "${e.blockedURI}" to be "${s}".`); - return e; - } } - // A sample policy we use to test trustedTypes.createPolicy behaviour. const id = x => x; const a_policy = { @@ -87,172 +46,163 @@ createScript: id, }; - // Provoke/wait for a CSP violation, in order to be sure that all previous - // CSP violations have been delivered. - function promise_flush() { - return promise_violation("object-src 'none'"); - } - function flush() { - expect_throws(_ => { - var o = document.createElement('object'); - o.type = "video/mp4"; - o.data = "dummy.webm"; - document.body.appendChild(o); - }); - } - - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("trusted-types one")) - .then(promise_violation("trusted-types two")) - .then(expect_sample("three")) - .then(expect_blocked_uri("trusted-types-policy")) - .then(promise_flush()); - expect_throws(_ => trustedTypes.createPolicy("three", a_policy)); - flush(); - return p; + promise_test(async t => { + let {violations, exception} = + await trusted_type_violations_and_exception_for(_ => + trustedTypes.createPolicy("three", a_policy) + ); + assert_equals(violations.length, 2); + assert_true(violations[0].originalPolicy.includes("trusted-types one")); + assert_true(violations[1].originalPolicy.includes("trusted-types two")); + assert_true(violations[1].sample.includes("three")); + assert_equals(violations[1].blockedURI, "trusted-types-policy"); + assert_true(exception instanceof TypeError); }, "Trusted Type violation report: creating a forbidden policy."); - promise_test(t => { - let p = promise_flush()(); - expect_throws(_ => trustedTypes.createPolicy("two", a_policy)); - flush(); - return p; + promise_test(async t => { + let {violations, exception} = + await trusted_type_violations_and_exception_for(_ => + trustedTypes.createPolicy("two", a_policy) + ); + assert_equals(violations.length, 1); + assert_true(violations[0].originalPolicy.includes("trusted-types one")); + assert_true(violations[0].sample.includes("two")); + assert_equals(violations[0].blockedURI, "trusted-types-policy"); + assert_true(exception instanceof TypeError); }, "Trusted Type violation report: creating a report-only-forbidden policy."); // policy_one is set below, and used in several tests further down. let policy_one = null; - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("trusted-types two")) - .then(promise_flush()); - policy_one = trustedTypes.createPolicy("one", a_policy); - flush(); - return p; + promise_test(async t => { + let {violations, exception} = + await trusted_type_violation_without_exception_for(_ => + policy_one = trustedTypes.createPolicy("one", a_policy) + ); + assert_equals(violations.length, 1); + assert_true(violations[0].originalPolicy.includes("trusted-types two")); + assert_true(violations[0].sample.includes("one")); + assert_equals(violations[0].blockedURI, "trusted-types-policy"); + assert_equals(exception, null); }, "Trusted Type violation report: creating a forbidden-but-not-reported policy."); - promise_test(t => { - let p = promise_violation("require-trusted-types-for 'script")() - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("Element insertAdjacentHTML|x")); - expect_throws(() => { - document.getElementById("div").insertAdjacentHTML("beforebegin", "x"); - }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("div").insertAdjacentHTML("beforebegin", "x") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); }, "Trusted Type violation report: blocked URI and sample for insertAdjacentHTML"); - promise_test(t => { - let p = promise_violation("require-trusted-types-for 'script'")(); - expect_throws(_ => document.getElementById("script").src = url); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").src = url + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); }, "Trusted Type violation report: assign string to script url"); - promise_test(t => { - let p = promise_violation("require-trusted-types-for 'script'")(); - expect_throws(_ => document.getElementById("div").innerHTML = "abc"); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("div").innerHTML = "abc" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); }, "Trusted Type violation report: assign string to html"); - promise_test(t => { - let p = promise_flush()(); - document.getElementById("script").text = policy_one.createScript("2+2;"); - flush(); - return p; + promise_test(async t => { + await no_trusted_type_violation_for(_ => + document.getElementById("script").text = policy_one.createScript("2+2;") + ); }, "Trusted Type violation report: assign trusted script to script; no report"); - promise_test(t => { - let p = promise_flush()(); - document.getElementById("div").innerHTML = policy_one.createHTML("abc"); - flush(); - return p; + promise_test(async t => { + await no_trusted_type_violation_for(_ => + document.getElementById("div").innerHTML = policy_one.createHTML("abc") + ); }, "Trusted Type violation report: assign trusted HTML to html; no report"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("Element innerHTML|abc")); - expect_throws(_ => { document.getElementById("div").innerHTML = "abc" }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("div").innerHTML = "abc" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("Element innerHTML|abc")); }, "Trusted Type violation report: sample for innerHTML assignment"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("HTMLScriptElement text|abc")); - expect_throws(_ => { document.getElementById("script").text = "abc" }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").text = "abc" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("HTMLScriptElement text|abc")); }, "Trusted Type violation report: sample for text assignment"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("HTMLScriptElement src")); - expect_throws(_ => { document.getElementById("script").src = "" }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").src = "" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("HTMLScriptElement src")); }, "Trusted Type violation report: sample for script.src assignment"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("HTMLScriptElement innerText|2+2;")); - expect_throws(_ => document.getElementById("script").innerText = "2+2;"); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").innerText = "2+2;" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("Element innerText|2+2")); }, "Trusted Type violation report: sample for script innerText assignment"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("SVGScriptElement href")); - expect_throws(_ => { document.getElementById("svgscript").href.baseVal = "" }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("svgscript").href.baseVal = "" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("SVGScriptElement href")); }, "Trusted Type violation report: sample for SVGScriptElement href assignment"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("SVGScriptElement href")); - expect_throws(_ => { document.getElementById("svgscript").setAttribute('href', "test"); }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("svgscript").setAttribute('href', "test") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("SVGScriptElement href")); }, "Trusted Type violation report: sample for SVGScriptElement href assignment by setAttribute"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("SVGScriptElement text")); - expect_throws(_ => { document.getElementById("svgscript").insertBefore(document.createTextNode("Hello"), null) }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("svgscript").insertBefore(document.createTextNode("Hello"), null) + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("SVGScriptElement text")); }, "Trusted Type violation report: sample for SVGScriptElement text assignment"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("eval|2+2")) - .then(promise_flush()); - expect_throws(_ => eval("2+2")); - flush(); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(EvalError, _ => + eval("2+2") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("eval|2+2")); }, "Trusted Type violation report: sample for eval"); - promise_test(t => { + promise_test(async t => { // We expect the sample string to always contain the name, and at least the // start of the value, but it should not be excessively long. - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("HTMLScriptElement innerText|abbb")) - .then(e => assert_less_than(e.sample.length, 150)); const value = "a" + "b".repeat(50000); - expect_throws(_ => document.getElementById("script").innerText = value); - return p; + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").innerText = value + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("HTMLScriptElement innerText|abbb")); + assert_less_than(violation.sample.length, 150); }, "Trusted Type violation report: large values should be handled sanely."); // Test reporting for Custom Elements (where supported). The report should @@ -262,25 +212,23 @@ class CustomScript extends HTMLScriptElement {}; customElements.define("custom-script", CustomScript, { extends: "script" }); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("HTMLScriptElement src|abc")); - expect_throws(_ => document.getElementById("customscript").src = "abc"); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("customscript").src = "abc" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("HTMLScriptElement src|abc")); }, "Trusted Type violation report: sample for custom element assignment"); } - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("Worker constructor|")) - .then(promise_flush()); - expect_throws(_ => new Worker("blabla")); - flush(); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + new Worker("blabla") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("Worker constructor|")); }, "Trusted Type violation report: Worker constructor"); diff --git a/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.html b/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.html index 6e87c25a7f099..871c267d581db 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.html @@ -6,8 +6,10 @@ + + @@ -21,12 +23,6 @@ createScript: x => x, }); -function futureViolation() { - return new Promise(r => addEventListener("securitypolicyviolation", r), { - once: true - }); -} - function futureScript(url) { return new Promise(r => { let script = document.createElement("script"); @@ -37,11 +33,9 @@ } promise_test(async t => { - let future_violation = futureViolation(); - assert_throws_js(TypeError, _ => { - document.getElementById("to-be-modified").innerHTML = "'test'"; - }); - let violation = await future_violation; + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("to-be-modified").innerHTML = "'test'" + ); assert_equals(violation.sourceFile, location.href) }, "same-document script") @@ -50,9 +44,9 @@ let script_src = script_origin + "/trusted-types/support/set-inner-html.js"; let script = await futureScript(script_src); - let future_violation = futureViolation(); - assert_throws_js(TypeError, () => setInnerHtml(toBeModified, "'test'")); - let violation = await future_violation; + let violation = await trusted_type_violation_for(TypeError, _ => + setInnerHtml(toBeModified, "'test'") + ); assert_equals(violation.sourceFile, script_src); }, "same-origin script") @@ -61,9 +55,9 @@ let script_src = script_origin + "/trusted-types/support/set-inner-html.js"; let script = await futureScript(script_src); - let future_violation = futureViolation(); - assert_throws_js(TypeError, () => setInnerHtml(toBeModified, "'test'")); - let violation = await future_violation; + let violation = await trusted_type_violation_for(TypeError, _ => + setInnerHtml(toBeModified, "'test'") + ); assert_equals(violation.sourceFile, script_src); }, "cross-origin script") diff --git a/testing/web-platform/tests/trusted-types/trusted-types-svg-script-set-href.html b/testing/web-platform/tests/trusted-types/trusted-types-svg-script-set-href.html index e437df360db5e..2dd7e163894f3 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-svg-script-set-href.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-svg-script-set-href.html @@ -2,10 +2,11 @@ - + +
@@ -14,13 +15,13 @@ const policy = trustedTypes.createPolicy("policy", { createScriptURL: script_url => script_url }); - promise_test(t => { + promise_test(async t => { const elem = document.createElementNS(NSURI_SVG, "script"); - assert_throws_js(TypeError, _ => { - elem.href.baseVal = "about:blank"; - }); + let violation = await trusted_type_violation_for(TypeError, _ => + elem.href.baseVal = "about:blank" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); document.getElementById("svg").appendChild(elem); - return promise_spv(); }, "Assign string to SVGScriptElement.href.baseVal."); promise_test(t => { @@ -32,13 +33,13 @@ return Promise.resolve(); }, "Assign TrustedScriptURL to SVGScriptElement.href.baseVal."); - promise_test(t => { + promise_test(async t => { const elem = document.createElementNS(NSURI_SVG, "script"); - assert_throws_js(TypeError, _ => { - elem.setAttribute("href", "about:blank"); - }); + let violation = await trusted_type_violation_for(TypeError, _ => + elem.setAttribute("href", "about:blank") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); document.getElementById("svg").appendChild(elem); - return promise_spv(); }, "Assign string to non-attached SVGScriptElement.href via setAttribute."); promise_test(t => { @@ -50,13 +51,13 @@ return Promise.resolve(); }, "Assign TrustedScriptURL to non-attached SVGScriptElement.href via setAttribute."); - promise_test(t => { + promise_test(async t => { const elem = document.createElementNS(NSURI_SVG, "script"); document.getElementById("svg").appendChild(elem); - assert_throws_js(TypeError, _ => { - elem.setAttribute("href", "about:blank"); - }); - return promise_spv(); + let violation = await trusted_type_violation_for(TypeError, _ => + elem.setAttribute("href", "about:blank") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); }, "Assign string to attached SVGScriptElement.href via setAttribute."); promise_test(t => { diff --git a/testing/web-platform/tests/trusted-types/trusted-types-svg-script.html b/testing/web-platform/tests/trusted-types/trusted-types-svg-script.html index 2fca03906ab3a..ac8d714f56a09 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-svg-script.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-svg-script.html @@ -2,9 +2,10 @@ - + +
@@ -13,32 +14,38 @@ const policy = trustedTypes.createPolicy("policy", { createScript: x => x, createHTML: x => x, createScriptURL: x => x }); - promise_test(t => { - assert_throws_js(TypeError, _ => { - document.getElementById("script").innerHTML = "'modified via innerHTML';"; - }); - return promise_spv(); + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").innerHTML = "'modified via innerHTML';" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); }, "Assign String to SVGScriptElement.innerHTML."); - promise_test(t => { - document.getElementById("script").innerHTML = policy.createHTML("'modified via innerHTML';"); - return Promise.resolve(); + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").innerHTML = policy.createHTML("'modified via innerHTML';") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); }, "Assign TrustedHTML to SVGScriptElement.innerHTML."); - promise_test(t => { + promise_test(async t => { const elem = document.createElementNS( "http://www.w3.org/2000/svg", "script"); - elem.innerHTML = policy.createHTML("'modified via innerHTML';"); + let violation = await trusted_type_violation_for(TypeError, _ => + elem.innerHTML = policy.createHTML("'modified via innerHTML';") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); document.getElementById("svg").appendChild(elem); - return promise_spv(); }, "Assign TrustedHTML to SVGScriptElement.innerHTML and execute it."); - promise_test(t => { + promise_test(async t => { const elem = document.createElementNS( "http://www.w3.org/2000/svg", "script"); - elem.insertBefore(document.createTextNode("modified via DOM"), null); + let violation = await trusted_type_violation_for(TypeError, _ => + elem.insertBefore(document.createTextNode("modified via DOM"), null) + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); document.getElementById("svg").appendChild(elem); - return promise_spv(); }, "Modify SVGScriptElement via DOM manipulation."); promise_test(t => {