| Yoav Weiss | e6ac489 | 2018-07-06 06:13:20 | [diff] [blame] | 1 | <!DOCTYPE html> |
| 2 | <head> |
| 3 | <script src="/resources/testharness.js" nonce="123"></script> |
| 4 | <script src="/resources/testharnessreport.js" nonce="123"></script> |
| 5 | <title>CSP strict-dynamic + preload</title> |
| 6 | <meta http-equiv="Content-Security-Policy" content="script-src 'nonce-123' 'strict-dynamic'" /> |
| 7 | </head> |
| 8 | <body> |
| 9 | <link id="static-no-nonce" href="resources/dummy.js?static-no-nonce" rel=preload as=script> |
| 10 | <link id="static-nonce" href="resources/dummy.js?static-nonce" rel=preload as=script nonce="123"> |
| 11 | <script nonce="123"> |
| 12 | let counter = 0; |
| 13 | let cspViolation = false; |
| 14 | let isLoaded = (url) => { |
| 15 | let entries = performance.getEntriesByType("resource"); |
| 16 | for (let entry of entries) { |
| 17 | if (entry.name.indexOf(url) != -1 ) { |
| 18 | return true; |
| 19 | } |
| 20 | } |
| 21 | return false; |
| 22 | } |
| 23 | window.addEventListener("securitypolicyviolation", (e) => { |
| 24 | counter++; |
| Andy Paicu | 412054b | 2018-09-04 16:28:49 | [diff] [blame] | 25 | if (e.violatedDirective == "script-src-elem" && e.blockedURI.includes("static-no-nonce")) { |
| Yoav Weiss | e6ac489 | 2018-07-06 06:13:20 | [diff] [blame] | 26 | cspViolation = true; |
| 27 | } |
| 28 | }); |
| 29 | let link = document.createElement("link"); |
| 30 | link.rel = "preload"; |
| 31 | link.href = "resources/dummy.js?dynamic-nonce"; |
| 32 | link.as = "script"; |
| 33 | link.onload = () => { ++counter; }; |
| 34 | document.head.appendChild(link); |
| 35 | link = document.getElementById("static-no-nonce"); |
| 36 | link.addEventListener("error", () => { ++counter; }); |
| 37 | link = document.getElementById("static-nonce"); |
| 38 | link.addEventListener("load", () => { ++counter; }); |
| 39 | let t = async_test('preload from nonced script should work with strict-dynamic. preloaded script from markup should not.'); |
| 40 | let timerCounter = 0; |
| 41 | setInterval(t.step_func(() => { |
| 42 | if (counter >= 4 || timerCounter > 5) { |
| 43 | assert_true(isLoaded("dynamic-nonce"), "dynamic inserted preload script should have been loaded"); |
| 44 | assert_true(isLoaded("static-nonce"), "preload tag with a nonce should have been loaded"); |
| 45 | assert_false(isLoaded("static-no-nonce"), "preload tag without a nonce should not have been loaded"); |
| 46 | assert_true(cspViolation, "CSP violation should have fired"); |
| 47 | t.done(); |
| 48 | } |
| 49 | ++timerCounter; |
| 50 | }), 100); |
| 51 | |
| 52 | </script> |
| 53 | </body> |
| 54 | </html> |
