Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CSP] Factorize SVGElement & MHTMLElement nonce hiding. #22021

Merged
merged 1 commit into from
Mar 4, 2020
+58 −26
Merged

[CSP] Factorize SVGElement & MHTMLElement nonce hiding. #22021

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 58 additions & 26 deletions content-security-policy/nonce-hiding/nonces.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,30 +3,62 @@
<script src="/resources/testharnessreport.js"></script>
<div id=log></div>
<script>
[["meh", ""],
["div", ""],
["script", ""],
["meh", "http://www.w3.org/2000/svg"],
["svg", "http://www.w3.org/2000/svg"],
["script", "http://www.w3.org/2000/svg"]].forEach(([localName, namespace]) => {
test(t => {
const element = namespace === "" ? document.createElement(localName) : document.createElementNS(namespace, localName);
t.add_cleanup(() => element.remove());
assert_equals(element.nonce, "", "Initial IDL attribute value");
element.setAttribute("nonce", "x");
assert_equals(element.nonce, "x", "IDL attribute is modified after content attribute set");
assert_equals(element.getAttribute("nonce"), "x", "Content attribute is modified after content attribute set");
document.body.appendChild(element);
assert_equals(element.nonce, "x", "IDL attribute is unchanged after element insertion");
assert_equals(element.getAttribute("nonce"), "", "Content attribute is changed after element insertion");
}, `Basic nonce tests for ${localName} in ${namespace === "" ? "HTML" : "SVG"} namespace`);

test(t => {
const element = namespace === "" ? document.createElement(localName) : document.createElementNS(namespace, localName);
element.setAttribute("nonce", "x");
assert_equals(element.nonce, "x", "IDL attribute is modified after content attribute set");
element.removeAttribute("nonce");
assert_equals(element.nonce, "", "IDL attribute is empty after content attribute removal");
}, `Ensure that removal of content attribute does not affect IDL attribute for ${localName} in ${namespace === "" ? "HTML" : "SVG"} namespace`);
});
const namespace_url= {
"HTML": "http://www.w3.org/1999/xhtml",
"SVG": "http://www.w3.org/2000/svg",
}
const test_cases = [
["meh" , "HTML"],
["div" , "HTML"],
["script" , "HTML"],
["meh" , "SVG"],
["svg" , "SVG"],
["script" , "SVG"],
];

test_cases.forEach(([localName, namespace]) => {
test(t => {
const element = document.createElementNS(namespace_url[namespace], localName);
t.add_cleanup(() => element.remove());
assert_equals(element.nonce, "", "Initial IDL attribute value");
assert_equals(element.getAttribute("nonce"), null, "Initial content attribute");

element.setAttribute("nonce", "x");
assert_equals(element.nonce, "x", "IDL attribute is modified after content attribute set");
assert_equals(element.getAttribute("nonce"), "x", "Content attribute is modified after content attribute set");

document.body.appendChild(element);
assert_equals(element.nonce, "x", "IDL attribute is unchanged after element insertion");
assert_equals(element.getAttribute("nonce"), "", "Content attribute is changed after element insertion");
}, `Basic nonce tests for ${localName} in ${namespace} namespace`);

test(t => {
const element = document.createElementNS(namespace_url[namespace], localName);
t.add_cleanup(() => element.remove());
element.setAttribute("nonce", "x");
assert_equals(element.nonce, "x", "IDL attribute is modified after content attribute set");

element.removeAttribute("nonce");
assert_equals(element.nonce, "", "IDL attribute is empty after content attribute removal");
}, `Ensure that removal of content attribute does not affect IDL attribute for ${localName} in ${namespace} namespace`);

test(t => {
const element = document.createElementNS(namespace_url[namespace], localName);
t.add_cleanup(() => element.remove());
assert_equals(element.nonce, "");
assert_equals(element.getAttribute("nonce"), null);

element.setAttribute("nonce", "");
assert_equals(element.nonce, "");
assert_equals(element.getAttribute("nonce"), "");

document.body.appendChild(element);
assert_equals(element.nonce, "");
assert_equals(element.getAttribute("nonce"), "");

element.removeAttribute("nonce");
assert_equals(element.nonce, "");
assert_equals(element.getAttribute("nonce"), null);
}, `Test empty nonces for ${localName} in ${namespace} namespace`);
});
</script>