1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
|
<!doctype html>
<html>
<meta name="timeout" content="long">
<body>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/utils.js"></script>
<script src="/common/get-host-info.sub.js"></script>
<script>
// This file consists of tests for COEP reporting. The tests make COEP
// violations and see whether reports are sent to the network as specified.
// We only have basic tests in this file - one for each kind of reports,
// because we can also test the reporting functionality with ReportingObserver,
// and that way is faster, easier to debug, and less flaky.
//
// For more detailed tests and tests with workers, see tests in other files
// such as
// - reporting-navigation.https.html
// - reporting-subresource-corp.https.html
// - cache-storage-reporting*.https.html
// .
const { REMOTE_ORIGIN } = get_host_info();
const BASE = new URL("resources", location).pathname
const FRAME_URL = `resources/reporting-empty-frame.html` +
`?pipe=header(cross-origin-embedder-policy,require-corp;report-to="endpoint")` +
`|header(cross-origin-embedder-policy-report-only,require-corp;report-to="report-only-endpoint")`;
function wait(ms) {
return new Promise(resolve => step_timeout(resolve, ms));
}
async function fetchReports(endpoint) {
const res = await fetch(`resources/report.py?endpoint=${endpoint}`, {cache: 'no-store'});
if (res.status == 200) {
return await res.json();
}
return [];
}
async function checkCorpReportExistence(endpoint, blockedUrl, contextUrl, destination, disposition) {
blockedUrl = new URL(blockedUrl, location).href;
contextUrl = new URL(contextUrl, location).href;
const timeout = 3000;
const retryDelay = 200;
for (let i = 0; i * retryDelay < timeout; i++) {
const reports = await fetchReports(endpoint);
for (const report of reports) {
if (report.type !== 'coep' || report.url !== contextUrl ||
report.body.type !== 'corp') {
continue;
}
if (report.body.blockedURL === blockedUrl &&
report.body.disposition === disposition) {
assert_equals(report.body.destination, destination);
return;
}
}
await wait(retryDelay);
}
assert_unreached(`A report whose blockedURL is ${blockedUrl} and url is ${contextUrl} is not found.`);
}
async function checkNavigationReportExistence(endpoint, blockedUrl, contextUrl, disposition) {
blockedUrl = new URL(blockedUrl, location).href;
contextUrl = new URL(contextUrl, location).href;
const timeout = 3000;
const retryDelay = 200;
for (let i = 0; i * retryDelay < timeout; i++) {
const reports = await fetchReports(endpoint);
for (const report of reports) {
if (report.type !== 'coep' || report.url !== contextUrl ||
report.body.type !== 'navigation') {
continue;
}
if (report.body.blockedURL === blockedUrl &&
report.body.disposition === disposition) {
return;
}
}
await wait(retryDelay);
}
assert_unreached(`A report whose blockedURL is ${blockedUrl} and url is ${contextUrl} is not found.`);
}
promise_test(async t => {
const iframe = document.createElement('iframe');
t.add_cleanup(() => iframe.remove());
iframe.src = FRAME_URL
document.body.appendChild(iframe);
await new Promise(resolve => {
iframe.addEventListener('load', resolve, {once: true});
});
const url = `${REMOTE_ORIGIN}/common/text-plain.txt?${token()}`;
const init = { mode: 'no-cors', cache: 'no-store' };
// The response comes from cross-origin, and doesn't have a CORP
// header, so it is blocked.
iframe.contentWindow.fetch(url, init).catch(() => {});
await checkCorpReportExistence('endpoint', url, iframe.src, '', 'enforce');
await checkCorpReportExistence(
'report-only-endpoint', url, iframe.src, '', 'reporting');
}, 'subresource CORP');
promise_test(async t => {
const iframe = document.createElement('iframe');
t.add_cleanup(() => iframe.remove());
iframe.src = FRAME_URL
document.body.appendChild(iframe);
await new Promise(resolve => {
iframe.addEventListener('load', resolve, {once: true});
});
const w = iframe.contentWindow;
function attachFrame(url) {
const frame = w.document.createElement('iframe');
frame.src = url;
w.document.body.appendChild(frame);
}
const url = `${REMOTE_ORIGIN}/common/blank.html?${token()}`;
// The nested frame comes from cross-origin and doesn't have a CORP
// header, so it is blocked.
attachFrame(url);
await checkCorpReportExistence(
'endpoint', url, iframe.src, 'iframe', 'enforce');
await checkCorpReportExistence(
'report-only-endpoint', url, iframe.src, 'iframe', 'reporting');
}, 'navigation CORP');
promise_test(async (t) => {
const iframe = document.createElement('iframe');
t.add_cleanup(() => iframe.remove());
iframe.src = FRAME_URL;
const targetUrl = `/common/blank.html?${token()}`;
iframe.addEventListener('load', t.step_func(() => {
const nested = iframe.contentDocument.createElement('iframe');
nested.src = targetUrl;
// |nested| doesn't have COEP whereas |iframe| has, so it is blocked.
iframe.contentDocument.body.appendChild(nested);
}), {once: true});
document.body.appendChild(iframe);
await checkNavigationReportExistence(
'endpoint', targetUrl, iframe.src, 'enforce');
await checkNavigationReportExistence(
'report-only-endpoint', targetUrl, iframe.src, 'reporting');
}, 'COEP violation on nested frame navigation');
promise_test(async (t) => {
const iframe = document.createElement('iframe');
t.add_cleanup(() => iframe.remove());
iframe.src = 'resources/reporting-empty-frame-multiple-headers.html.asis';
const targetUrl = `/common/blank.html?${token()}`;
iframe.addEventListener('load', t.step_func(() => {
const nested = iframe.contentDocument.createElement('iframe');
nested.src = targetUrl;
// |nested| doesn't have COEP whereas |iframe| has, so it is blocked.
iframe.contentDocument.body.appendChild(nested);
}), {once: true});
document.body.appendChild(iframe);
await checkNavigationReportExistence(
'endpoint', targetUrl, iframe.src, 'enforce');
await checkNavigationReportExistence(
'report-only-endpoint', targetUrl, iframe.src, 'reporting');
}, 'Two COEP headers, split inside report-to value');
</script>
|
