1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
<!DOCTYPE html>
<head>
<script src="/resources/testharness.js" nonce="123"></script>
<script src="/resources/testharnessreport.js" nonce="123"></script>
<title>CSP strict-dynamic + preload</title>
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-123' 'strict-dynamic'" />
</head>
<body>
<link id="static-no-nonce" href="resources/dummy.js?static-no-nonce" rel=preload as=script>
<link id="static-nonce" href="resources/dummy.js?static-nonce" rel=preload as=script nonce="123">
<script nonce="123">
let counter = 0;
let cspViolation = false;
let isLoaded = (url) => {
let entries = performance.getEntriesByType("resource");
for (let entry of entries) {
if (entry.name.indexOf(url) != -1 ) {
return true;
}
}
return false;
}
window.addEventListener("securitypolicyviolation", (e) => {
counter++;
if (e.violatedDirective == "script-src-elem" && e.blockedURI.includes("static-no-nonce")) {
cspViolation = true;
}
});
let link = document.createElement("link");
link.rel = "preload";
link.href = "resources/dummy.js?dynamic-nonce";
link.as = "script";
link.onload = () => { ++counter; };
document.head.appendChild(link);
link = document.getElementById("static-no-nonce");
link.addEventListener("error", () => { ++counter; });
link = document.getElementById("static-nonce");
link.addEventListener("load", () => { ++counter; });
let t = async_test('preload from nonced script should work with strict-dynamic. preloaded script from markup should not.');
let timerCounter = 0;
setInterval(t.step_func(() => {
if (counter >= 4 || timerCounter > 5) {
assert_true(isLoaded("dynamic-nonce"), "dynamic inserted preload script should have been loaded");
assert_true(isLoaded("static-nonce"), "preload tag with a nonce should have been loaded");
assert_false(isLoaded("static-no-nonce"), "preload tag without a nonce should not have been loaded");
assert_true(cspViolation, "CSP violation should have fired");
t.done();
}
++timerCounter;
}), 100);
</script>
</body>
</html>
|
