From a0d8a57cc65dbf0c33e558d563eb69ece5e4d61e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Wang?= Date: Thu, 23 Jan 2025 05:43:52 +0000 Subject: [PATCH] Bug 1942119 [wpt PR 50124] - Rewrite Trusted types tests for CSP violations, a=testonly Automatic update from web-platform-tests Rewrite Trusted types tests for CSP violations (#50124) * Rewrite Trusted types tests for CSP violations Currently the listener to "securitypolicyviolation" is added before actually running the statement that triggers violations, so it could be possible that some violations are not caught. This bad pattern is duplicated in several `trusted-types*reporting*` tests. This patch adds a new helper file to properly wrap the listener registration and statement execution in a promise, and reuses it in existing tests. https://github.com/w3c/trusted-types/issues/576 -- wpt-commits: bb5f8351e2b19b1f4cfd16ca891ca638461c1b4b wpt-pr: 50124 --- ...icyFactory-createPolicy-cspTests-none.html | 46 +-- ...pePolicyFactory-createPolicy-cspTests.html | 46 +-- ...require-trusted-types-for-report-only.html | 54 +-- ...trusted-types-for-report-only.html.headers | 3 +- .../require-trusted-types-for.html | 59 +--- .../trusted-types/support/csp-violations.js | 70 ++++ .../trusted-types/support/resolve-spv.js | 9 - ...d-types-eval-reporting-no-unsafe-eval.html | 82 +---- ...sted-types-eval-reporting-report-only.html | 77 +---- .../trusted-types-eval-reporting.html | 61 +--- .../trusted-types-report-only.html | 78 ++--- .../trusted-types-report-only.html.headers | 1 + .../trusted-types-reporting.html | 320 ++++++++---------- .../trusted-types-source-file-path.html | 28 +- .../trusted-types-svg-script-set-href.html | 33 +- .../trusted-types-svg-script.html | 37 +- 16 files changed, 392 insertions(+), 612 deletions(-) create mode 100644 testing/web-platform/tests/trusted-types/support/csp-violations.js delete mode 100644 testing/web-platform/tests/trusted-types/support/resolve-spv.js diff --git a/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html b/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html index badaf989eb749..7e67f2bbb70f8 100644 --- a/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html +++ b/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html @@ -2,44 +2,22 @@ + + diff --git a/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests.html b/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests.html index 979de1e8145cb..0a43d2171ccda 100644 --- a/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests.html +++ b/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests.html @@ -2,8 +2,10 @@ + + diff --git a/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html b/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html index 25b4440ef4117..0b1d141fb3ac1 100644 --- a/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html +++ b/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html @@ -2,55 +2,35 @@ + \ No newline at end of file + diff --git a/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html.headers b/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html.headers index c6412f8d472fc..8344761bdddf8 100644 --- a/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html.headers +++ b/testing/web-platform/tests/trusted-types/require-trusted-types-for-report-only.html.headers @@ -1 +1,2 @@ -Content-Security-Policy-Report-Only: require-trusted-types-for 'script' \ No newline at end of file +Content-Security-Policy-Report-Only: require-trusted-types-for 'script' +Content-Security-Policy: object-src 'none' diff --git a/testing/web-platform/tests/trusted-types/require-trusted-types-for.html b/testing/web-platform/tests/trusted-types/require-trusted-types-for.html index b0dcd9cc93002..c6dfbcbfb4871 100644 --- a/testing/web-platform/tests/trusted-types/require-trusted-types-for.html +++ b/testing/web-platform/tests/trusted-types/require-trusted-types-for.html @@ -2,62 +2,37 @@ + + - + diff --git a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-report-only.html b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-report-only.html index a81f5a4578938..b0cc65c088431 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-report-only.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-report-only.html @@ -1,12 +1,12 @@ - - + + diff --git a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting.html b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting.html index e7c7245f9e415..0fa7ed2be80f3 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting.html @@ -2,10 +2,11 @@ + diff --git a/testing/web-platform/tests/trusted-types/trusted-types-report-only.html b/testing/web-platform/tests/trusted-types/trusted-types-report-only.html index fcb77841163d9..f4386f832f43f 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-report-only.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-report-only.html @@ -3,6 +3,7 @@ + @@ -13,27 +14,12 @@ diff --git a/testing/web-platform/tests/trusted-types/trusted-types-report-only.html.headers b/testing/web-platform/tests/trusted-types/trusted-types-report-only.html.headers index 857a8b31e86bc..383f05138fe62 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-report-only.html.headers +++ b/testing/web-platform/tests/trusted-types/trusted-types-report-only.html.headers @@ -1 +1,2 @@ Content-Security-Policy-Report-Only: trusted-types two; report-uri /content-security-policy/resources/dummy-report.php; require-trusted-types-for 'script'; +Content-Security-Policy: object-src 'none' diff --git a/testing/web-platform/tests/trusted-types/trusted-types-reporting.html b/testing/web-platform/tests/trusted-types/trusted-types-reporting.html index 96c9dd72813a7..f1d0b14ee0497 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-reporting.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-reporting.html @@ -3,7 +3,7 @@ - + @@ -33,52 +33,11 @@ const url = "" + document.location; - // Return function that returns a promise that resolves on the given - // violation report. - // - // filter_arg - iff function, call it with the event object. - // Else, string-ify and compare against event.originalPolicy. - function promise_violation(filter_arg) { - return _ => new Promise((resolve, reject) => { - function handler(e) { - let matches = (filter_arg instanceof Function) - ? filter_arg(e) - : (e.originalPolicy.includes(filter_arg)); - if (matches) { - document.removeEventListener("securitypolicyviolation", handler); - e.stopPropagation(); - resolve(e); - } - } - document.addEventListener("securitypolicyviolation", handler); - }); - } - - // Like assert_throws_*, but we don't care about the exact error. We just want - // to run the code and continue. - function expect_throws(fn) { - try { fn(); } catch (err) { return; /* ignore */ } - assert_unreached(); - } - - // Test the "sample" field of the event. // TODO(vogelheim): The current set of tests allows for more variance in the // sample reports than the current spec draft does. Once the spec has // been finalized, we should clamp this down to check byte-for-byte // against the values mandated by the spec. - function expect_sample(s) { return e => { - assert_true(e.sample.includes(s), - `expected "${e.sample}" to include "${s}".`); - return e; - } } - - function expect_blocked_uri(s) { return e => { - assert_equals(e.blockedURI, s, - `expected "${e.blockedURI}" to be "${s}".`); - return e; - } } - // A sample policy we use to test trustedTypes.createPolicy behaviour. const id = x => x; const a_policy = { @@ -87,172 +46,163 @@ createScript: id, }; - // Provoke/wait for a CSP violation, in order to be sure that all previous - // CSP violations have been delivered. - function promise_flush() { - return promise_violation("object-src 'none'"); - } - function flush() { - expect_throws(_ => { - var o = document.createElement('object'); - o.type = "video/mp4"; - o.data = "dummy.webm"; - document.body.appendChild(o); - }); - } - - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("trusted-types one")) - .then(promise_violation("trusted-types two")) - .then(expect_sample("three")) - .then(expect_blocked_uri("trusted-types-policy")) - .then(promise_flush()); - expect_throws(_ => trustedTypes.createPolicy("three", a_policy)); - flush(); - return p; + promise_test(async t => { + let {violations, exception} = + await trusted_type_violations_and_exception_for(_ => + trustedTypes.createPolicy("three", a_policy) + ); + assert_equals(violations.length, 2); + assert_true(violations[0].originalPolicy.includes("trusted-types one")); + assert_true(violations[1].originalPolicy.includes("trusted-types two")); + assert_true(violations[1].sample.includes("three")); + assert_equals(violations[1].blockedURI, "trusted-types-policy"); + assert_true(exception instanceof TypeError); }, "Trusted Type violation report: creating a forbidden policy."); - promise_test(t => { - let p = promise_flush()(); - expect_throws(_ => trustedTypes.createPolicy("two", a_policy)); - flush(); - return p; + promise_test(async t => { + let {violations, exception} = + await trusted_type_violations_and_exception_for(_ => + trustedTypes.createPolicy("two", a_policy) + ); + assert_equals(violations.length, 1); + assert_true(violations[0].originalPolicy.includes("trusted-types one")); + assert_true(violations[0].sample.includes("two")); + assert_equals(violations[0].blockedURI, "trusted-types-policy"); + assert_true(exception instanceof TypeError); }, "Trusted Type violation report: creating a report-only-forbidden policy."); // policy_one is set below, and used in several tests further down. let policy_one = null; - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("trusted-types two")) - .then(promise_flush()); - policy_one = trustedTypes.createPolicy("one", a_policy); - flush(); - return p; + promise_test(async t => { + let {violations, exception} = + await trusted_type_violation_without_exception_for(_ => + policy_one = trustedTypes.createPolicy("one", a_policy) + ); + assert_equals(violations.length, 1); + assert_true(violations[0].originalPolicy.includes("trusted-types two")); + assert_true(violations[0].sample.includes("one")); + assert_equals(violations[0].blockedURI, "trusted-types-policy"); + assert_equals(exception, null); }, "Trusted Type violation report: creating a forbidden-but-not-reported policy."); - promise_test(t => { - let p = promise_violation("require-trusted-types-for 'script")() - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("Element insertAdjacentHTML|x")); - expect_throws(() => { - document.getElementById("div").insertAdjacentHTML("beforebegin", "x"); - }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("div").insertAdjacentHTML("beforebegin", "x") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); }, "Trusted Type violation report: blocked URI and sample for insertAdjacentHTML"); - promise_test(t => { - let p = promise_violation("require-trusted-types-for 'script'")(); - expect_throws(_ => document.getElementById("script").src = url); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").src = url + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); }, "Trusted Type violation report: assign string to script url"); - promise_test(t => { - let p = promise_violation("require-trusted-types-for 'script'")(); - expect_throws(_ => document.getElementById("div").innerHTML = "abc"); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("div").innerHTML = "abc" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); }, "Trusted Type violation report: assign string to html"); - promise_test(t => { - let p = promise_flush()(); - document.getElementById("script").text = policy_one.createScript("2+2;"); - flush(); - return p; + promise_test(async t => { + await no_trusted_type_violation_for(_ => + document.getElementById("script").text = policy_one.createScript("2+2;") + ); }, "Trusted Type violation report: assign trusted script to script; no report"); - promise_test(t => { - let p = promise_flush()(); - document.getElementById("div").innerHTML = policy_one.createHTML("abc"); - flush(); - return p; + promise_test(async t => { + await no_trusted_type_violation_for(_ => + document.getElementById("div").innerHTML = policy_one.createHTML("abc") + ); }, "Trusted Type violation report: assign trusted HTML to html; no report"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("Element innerHTML|abc")); - expect_throws(_ => { document.getElementById("div").innerHTML = "abc" }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("div").innerHTML = "abc" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("Element innerHTML|abc")); }, "Trusted Type violation report: sample for innerHTML assignment"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("HTMLScriptElement text|abc")); - expect_throws(_ => { document.getElementById("script").text = "abc" }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").text = "abc" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("HTMLScriptElement text|abc")); }, "Trusted Type violation report: sample for text assignment"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("HTMLScriptElement src")); - expect_throws(_ => { document.getElementById("script").src = "" }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").src = "" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("HTMLScriptElement src")); }, "Trusted Type violation report: sample for script.src assignment"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("HTMLScriptElement innerText|2+2;")); - expect_throws(_ => document.getElementById("script").innerText = "2+2;"); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").innerText = "2+2;" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("Element innerText|2+2")); }, "Trusted Type violation report: sample for script innerText assignment"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("SVGScriptElement href")); - expect_throws(_ => { document.getElementById("svgscript").href.baseVal = "" }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("svgscript").href.baseVal = "" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("SVGScriptElement href")); }, "Trusted Type violation report: sample for SVGScriptElement href assignment"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("SVGScriptElement href")); - expect_throws(_ => { document.getElementById("svgscript").setAttribute('href', "test"); }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("svgscript").setAttribute('href', "test") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("SVGScriptElement href")); }, "Trusted Type violation report: sample for SVGScriptElement href assignment by setAttribute"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("SVGScriptElement text")); - expect_throws(_ => { document.getElementById("svgscript").insertBefore(document.createTextNode("Hello"), null) }); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("svgscript").insertBefore(document.createTextNode("Hello"), null) + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("SVGScriptElement text")); }, "Trusted Type violation report: sample for SVGScriptElement text assignment"); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("eval|2+2")) - .then(promise_flush()); - expect_throws(_ => eval("2+2")); - flush(); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(EvalError, _ => + eval("2+2") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("eval|2+2")); }, "Trusted Type violation report: sample for eval"); - promise_test(t => { + promise_test(async t => { // We expect the sample string to always contain the name, and at least the // start of the value, but it should not be excessively long. - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("HTMLScriptElement innerText|abbb")) - .then(e => assert_less_than(e.sample.length, 150)); const value = "a" + "b".repeat(50000); - expect_throws(_ => document.getElementById("script").innerText = value); - return p; + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").innerText = value + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("HTMLScriptElement innerText|abbb")); + assert_less_than(violation.sample.length, 150); }, "Trusted Type violation report: large values should be handled sanely."); // Test reporting for Custom Elements (where supported). The report should @@ -262,25 +212,23 @@ class CustomScript extends HTMLScriptElement {}; customElements.define("custom-script", CustomScript, { extends: "script" }); - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("HTMLScriptElement src|abc")); - expect_throws(_ => document.getElementById("customscript").src = "abc"); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("customscript").src = "abc" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("HTMLScriptElement src|abc")); }, "Trusted Type violation report: sample for custom element assignment"); } - promise_test(t => { - let p = Promise.resolve() - .then(promise_violation("require-trusted-types-for 'script'")) - .then(expect_blocked_uri("trusted-types-sink")) - .then(expect_sample("Worker constructor|")) - .then(promise_flush()); - expect_throws(_ => new Worker("blabla")); - flush(); - return p; + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + new Worker("blabla") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.blockedURI, "trusted-types-sink"); + assert_true(violation.sample.includes("Worker constructor|")); }, "Trusted Type violation report: Worker constructor"); diff --git a/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.html b/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.html index 6e87c25a7f099..871c267d581db 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.html @@ -6,8 +6,10 @@ + + @@ -21,12 +23,6 @@ createScript: x => x, }); -function futureViolation() { - return new Promise(r => addEventListener("securitypolicyviolation", r), { - once: true - }); -} - function futureScript(url) { return new Promise(r => { let script = document.createElement("script"); @@ -37,11 +33,9 @@ } promise_test(async t => { - let future_violation = futureViolation(); - assert_throws_js(TypeError, _ => { - document.getElementById("to-be-modified").innerHTML = "'test'"; - }); - let violation = await future_violation; + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("to-be-modified").innerHTML = "'test'" + ); assert_equals(violation.sourceFile, location.href) }, "same-document script") @@ -50,9 +44,9 @@ let script_src = script_origin + "/trusted-types/support/set-inner-html.js"; let script = await futureScript(script_src); - let future_violation = futureViolation(); - assert_throws_js(TypeError, () => setInnerHtml(toBeModified, "'test'")); - let violation = await future_violation; + let violation = await trusted_type_violation_for(TypeError, _ => + setInnerHtml(toBeModified, "'test'") + ); assert_equals(violation.sourceFile, script_src); }, "same-origin script") @@ -61,9 +55,9 @@ let script_src = script_origin + "/trusted-types/support/set-inner-html.js"; let script = await futureScript(script_src); - let future_violation = futureViolation(); - assert_throws_js(TypeError, () => setInnerHtml(toBeModified, "'test'")); - let violation = await future_violation; + let violation = await trusted_type_violation_for(TypeError, _ => + setInnerHtml(toBeModified, "'test'") + ); assert_equals(violation.sourceFile, script_src); }, "cross-origin script") diff --git a/testing/web-platform/tests/trusted-types/trusted-types-svg-script-set-href.html b/testing/web-platform/tests/trusted-types/trusted-types-svg-script-set-href.html index e437df360db5e..2dd7e163894f3 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-svg-script-set-href.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-svg-script-set-href.html @@ -2,10 +2,11 @@ - + +
@@ -14,13 +15,13 @@ const policy = trustedTypes.createPolicy("policy", { createScriptURL: script_url => script_url }); - promise_test(t => { + promise_test(async t => { const elem = document.createElementNS(NSURI_SVG, "script"); - assert_throws_js(TypeError, _ => { - elem.href.baseVal = "about:blank"; - }); + let violation = await trusted_type_violation_for(TypeError, _ => + elem.href.baseVal = "about:blank" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); document.getElementById("svg").appendChild(elem); - return promise_spv(); }, "Assign string to SVGScriptElement.href.baseVal."); promise_test(t => { @@ -32,13 +33,13 @@ return Promise.resolve(); }, "Assign TrustedScriptURL to SVGScriptElement.href.baseVal."); - promise_test(t => { + promise_test(async t => { const elem = document.createElementNS(NSURI_SVG, "script"); - assert_throws_js(TypeError, _ => { - elem.setAttribute("href", "about:blank"); - }); + let violation = await trusted_type_violation_for(TypeError, _ => + elem.setAttribute("href", "about:blank") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); document.getElementById("svg").appendChild(elem); - return promise_spv(); }, "Assign string to non-attached SVGScriptElement.href via setAttribute."); promise_test(t => { @@ -50,13 +51,13 @@ return Promise.resolve(); }, "Assign TrustedScriptURL to non-attached SVGScriptElement.href via setAttribute."); - promise_test(t => { + promise_test(async t => { const elem = document.createElementNS(NSURI_SVG, "script"); document.getElementById("svg").appendChild(elem); - assert_throws_js(TypeError, _ => { - elem.setAttribute("href", "about:blank"); - }); - return promise_spv(); + let violation = await trusted_type_violation_for(TypeError, _ => + elem.setAttribute("href", "about:blank") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); }, "Assign string to attached SVGScriptElement.href via setAttribute."); promise_test(t => { diff --git a/testing/web-platform/tests/trusted-types/trusted-types-svg-script.html b/testing/web-platform/tests/trusted-types/trusted-types-svg-script.html index 2fca03906ab3a..ac8d714f56a09 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-svg-script.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-svg-script.html @@ -2,9 +2,10 @@ - + +
@@ -13,32 +14,38 @@ const policy = trustedTypes.createPolicy("policy", { createScript: x => x, createHTML: x => x, createScriptURL: x => x }); - promise_test(t => { - assert_throws_js(TypeError, _ => { - document.getElementById("script").innerHTML = "'modified via innerHTML';"; - }); - return promise_spv(); + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").innerHTML = "'modified via innerHTML';" + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); }, "Assign String to SVGScriptElement.innerHTML."); - promise_test(t => { - document.getElementById("script").innerHTML = policy.createHTML("'modified via innerHTML';"); - return Promise.resolve(); + promise_test(async t => { + let violation = await trusted_type_violation_for(TypeError, _ => + document.getElementById("script").innerHTML = policy.createHTML("'modified via innerHTML';") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); }, "Assign TrustedHTML to SVGScriptElement.innerHTML."); - promise_test(t => { + promise_test(async t => { const elem = document.createElementNS( "http://www.w3.org/2000/svg", "script"); - elem.innerHTML = policy.createHTML("'modified via innerHTML';"); + let violation = await trusted_type_violation_for(TypeError, _ => + elem.innerHTML = policy.createHTML("'modified via innerHTML';") + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); document.getElementById("svg").appendChild(elem); - return promise_spv(); }, "Assign TrustedHTML to SVGScriptElement.innerHTML and execute it."); - promise_test(t => { + promise_test(async t => { const elem = document.createElementNS( "http://www.w3.org/2000/svg", "script"); - elem.insertBefore(document.createTextNode("modified via DOM"), null); + let violation = await trusted_type_violation_for(TypeError, _ => + elem.insertBefore(document.createTextNode("modified via DOM"), null) + ); + assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); document.getElementById("svg").appendChild(elem); - return promise_spv(); }, "Modify SVGScriptElement via DOM manipulation."); promise_test(t => {