Skip to content

Commit

Permalink
Re-sync trusted types WPT tests
Browse files Browse the repository at this point in the history
https://bugs.webkit.org/show_bug.cgi?id=271316

Reviewed by Anne van Kesteren.

Upstream commit: web-platform-tests/wpt@577d225

* LayoutTests/imported/w3c/web-platform-tests/trusted-types/TrustedTypePolicyFactory-blocking.tentative-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/trusted-types/TrustedTypePolicyFactory-blocking-expected.txt.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/TrustedTypePolicyFactory-blocking.tentative.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/trusted-types/TrustedTypePolicyFactory-blocking.html.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-Document-parseHTMLUnsafe-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-Document-parseHTMLUnsafe.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-Element-setAttribute-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-Element-setAttribute.html:
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-Element-setAttributeNS-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-Element-setAttributeNS.html:
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-Element-setHTMLUnsafe-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-Element-setHTMLUnsafe.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-ShadowRoot-setHTMLUnsafe-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/block-string-assignment-to-ShadowRoot-setHTMLUnsafe.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/idlharness.window-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/idlharness.window.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/idlharness.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/trusted-types/idlharness.tentative.window.js.html.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/support/helper.sub.js:
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-from-literal.tentative-expected.txt: Renamed from LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-from-literal-expected.txt.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-from-literal.tentative.html: Renamed from LayoutTests/imported/w3c/web-platform-tests/trusted-types/trusted-types-from-literal.html.
* LayoutTests/imported/w3c/web-platform-tests/trusted-types/w3c-import.log:

Canonical link: https://commits.webkit.org/276793@main
  • Loading branch information
lukewarlow committed Mar 28, 2024
1 parent 9a1840e commit 2e2d6c1
Show file tree
Hide file tree
Showing 19 changed files with 430 additions and 30 deletions.
@@ -0,0 +1,9 @@
CONSOLE MESSAGE: This requires a TrustedHTML value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
CONSOLE MESSAGE: This requires a TrustedHTML value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"

PASS Document.parseHTMLUnsafe assigned via policy (successful HTML transformation).
PASS `Document.parseHTMLUnsafe(string)` throws.
PASS 'Document.parseHTMLUnsafe(null)' throws
PASS 'Document.parseHTMLUnsafe(string)' assigned via default policy (successful HTML transformation).
PASS 'Document.parseHTMLUnsafe(null)' assigned via default policy does not throw

@@ -0,0 +1,48 @@
<!DOCTYPE html>
<html>
<head>
<meta name="author" title="Luke Warlow" href="mailto:lwarlow@igalia.com">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="support/helper.sub.js"></script>

<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script';">
</head>
<body>
<script>
test(t => {
let p = createHTML_policy(window, 1);
let html = p.createHTML(INPUTS.HTML);
let doc = Document.parseHTMLUnsafe(html);
assert_equals(doc.body.innerText, RESULTS.HTML);
}, "Document.parseHTMLUnsafe assigned via policy (successful HTML transformation).");

// String assignments throw.
test(t => {
assert_throws_js(TypeError, _ => {
var doc = Document.parseHTMLUnsafe("Fail");
});
}, "`Document.parseHTMLUnsafe(string)` throws.");

// Null assignment throws.
test(t => {
assert_throws_js(TypeError, _ => {
var doc = Document.parseHTMLUnsafe(null);
});
}, "'Document.parseHTMLUnsafe(null)' throws");

// After default policy creation string assignment implicitly calls createHTML.
test(t => {
let p = window.trustedTypes.createPolicy("default", { createHTML: createHTMLJS }, true);
let doc = Document.parseHTMLUnsafe(INPUTS.HTML, "text/html");
assert_equals(doc.body.innerText, RESULTS.HTML);
}, "'Document.parseHTMLUnsafe(string)' assigned via default policy (successful HTML transformation).");

// After default policy creation null assignment implicitly calls createHTML.
test(t => {
var doc = Document.parseHTMLUnsafe(null, "text/html");
assert_equals(doc.body.innerText, "null");
}, "'Document.parseHTMLUnsafe(null)' assigned via default policy does not throw");
</script>
</body>
</html>
Expand Up @@ -24,6 +24,12 @@ PASS embed.src accepts string and null after default policy was created.
PASS object.data accepts string and null after default policy was created.
PASS object.codeBase accepts string and null after default policy was created.
PASS script.src accepts string and null after default policy was created.
FAIL embed.src's mutationobservers receive the default policy's value. assert_equals: expected "http://this.is.a.successful.test/" but got "http://this.is.a.scripturl.test/"
FAIL object.data's mutationobservers receive the default policy's value. assert_equals: expected "http://this.is.a.successful.test/" but got "http://this.is.a.scripturl.test/"
FAIL object.codeBase's mutationobservers receive the default policy's value. assert_equals: expected "http://this.is.a.successful.test/" but got "http://this.is.a.scripturl.test/"
FAIL script.src's mutationobservers receive the default policy's value. assert_equals: expected "http://this.is.a.successful.test/" but got "http://this.is.a.scripturl.test/"
FAIL iframe.srcdoc's mutationobservers receive the default policy's value. assert_equals: expected "Quack, I want to be a duck!" but got "Hi, I want to be transformed!"
FAIL div.onclick's mutationobservers receive the default policy's value. assert_equals: expected "Meow, I want to be a cat!" but got "Hi, I want to be transformed!"
PASS iframe.srcdoc accepts string and null after default policy was created.
FAIL div.onclick accepts string and null after default policy was created. assert_equals: expected "Meow, I want to be a cat!" but got "Hi, I want to be transformed!"
PASS a.rel accepts strings
Expand Down
Expand Up @@ -13,10 +13,10 @@

// TrustedScriptURL Assignments
const scriptURLTestCases = [
[ 'embed', 'src' ],
[ 'object', 'data' ],
[ 'object', 'codeBase' ],
[ 'script', 'src' ]
[ 'embed', 'src', INPUTS.SCRIPTURL, RESULTS.SCRIPTURL],
[ 'object', 'data', INPUTS.SCRIPTURL, RESULTS.SCRIPTURL ],
[ 'object', 'codeBase', INPUTS.SCRIPTURL, RESULTS.SCRIPTURL ],
[ 'script', 'src', INPUTS.SCRIPTURL, RESULTS.SCRIPTURL ]
];

scriptURLTestCases.forEach(c => {
Expand All @@ -31,12 +31,12 @@

// TrustedHTML Assignments
const HTMLTestCases = [
[ 'iframe', 'srcdoc' ]
[ 'iframe', 'srcdoc' , INPUTS.HTML, RESULTS.HTML]
];

HTMLTestCases.forEach(c => {
test(t => {
assert_element_accepts_trusted_html_explicit_set(window, c[0] + "-" + c[1], t, c[0], c[1], RESULTS.HTML);
assert_element_accepts_trusted_html_explicit_set(window, c[0] + "-" + c[1], t, c[0], c[1], c[3]);
assert_throws_no_trusted_type_explicit_set(c[0], c[1], 'A string');
assert_throws_no_trusted_type_explicit_set(c[0], c[1], null);
assert_throws_no_trusted_type_explicit_set(c[0], c[1], nullPolicy.createScript('script'));
Expand All @@ -45,12 +45,12 @@

// TrustedScript Assignments
const ScriptTestCases = [
[ 'div', 'onclick' ]
[ 'div', 'onclick' , INPUTS.SCRIPT, RESULTS.SCRIPT]
];

ScriptTestCases.forEach(c => {
test(t => {
assert_element_accepts_trusted_script_explicit_set(window, c[0] + "-" + c[1], t, c[0], c[1], RESULTS.SCRIPT);
assert_element_accepts_trusted_script_explicit_set(window, c[0] + "-" + c[1], t, c[0], c[1], c[3]);
assert_throws_no_trusted_type_explicit_set(c[0], c[1], 'A string');
assert_throws_no_trusted_type_explicit_set(c[0], c[1], null);
}, c[0] + "." + c[1] + " accepts only TrustedScript");
Expand All @@ -70,21 +70,37 @@
let p = window.trustedTypes.createPolicy("default", { createScriptURL: createScriptURLJS, createHTML: createHTMLJS, createScript: createScriptJS }, true);
scriptURLTestCases.forEach(c => {
test(t => {
assert_element_accepts_trusted_type(c[0], c[1], INPUTS.SCRIPTURL, RESULTS.SCRIPTURL);
assert_element_accepts_trusted_type(c[0], c[1], c[2], c[3]);
assert_element_accepts_trusted_type(c[0], c[1], null, window.location.toString().replace(/[^\/]*$/, "null"));
}, c[0] + "." + c[1] + " accepts string and null after default policy was created.");
});

scriptURLTestCases.concat(HTMLTestCases).concat(ScriptTestCases).forEach(c => {
async_test(t => {
const testElement = document.createElement(c[0]);

const observer = new MutationObserver(t.step_func_done((aMutations, aObserver) => {
assert_equals(aMutations.length, 1);
const newValue = aMutations[0].target.getAttribute(c[1]);
assert_equals(newValue, c[3]);
}));

observer.observe(testElement, { attributes: true});

testElement.setAttribute(c[1], c[2]);
}, c[0] + "." + c[1] + "'s mutationobservers receive the default policy's value.");
});

HTMLTestCases.forEach(c => {
test(t => {
assert_element_accepts_trusted_type(c[0], c[1], INPUTS.HTML, RESULTS.HTML);
assert_element_accepts_trusted_type(c[0], c[1], c[2], c[3]);
assert_element_accepts_trusted_type(c[0], c[1], null, "null");
}, c[0] + "." + c[1] + " accepts string and null after default policy was created.");
});

ScriptTestCases.forEach(c => {
test(t => {
assert_element_accepts_trusted_type_explicit_set(c[0], c[1], INPUTS.SCRIPT, RESULTS.SCRIPT);
assert_element_accepts_trusted_type_explicit_set(c[0], c[1], c[2], c[3]);
assert_element_accepts_trusted_type_explicit_set(c[0], c[1], null, "null");
}, c[0] + "." + c[1] + " accepts string and null after default policy was created.");
});
Expand Down
Expand Up @@ -6,6 +6,13 @@ PASS Element.setAttributeNS accepts untrusted string for non-specced accessor
PASS Element.setAttributeNS accepts null for non-specced accessor
PASS Assigning TrustedScriptURL to <svg:script xlink:href=...> works
FAIL Blocking non-TrustedScriptURL assignment to <svg:script xlink:href=...> works assert_throws_js: function "_ => {
elem.setAttributeNS(xlink, "href", v);
elem.setAttributeNS(xlinkNamespace, "href", v);
}" did not throw
PASS Check `setAttributeNS` allows setting non-trusted string for non-lowercase attribute "SRCDOC" (ns=null) for "iframe" element (ns=http://www.w3.org/1999/xhtml).
PASS Check `setAttributeNS` allows setting non-trusted string for non-lowercase attribute "SRC" (ns=null) for "embed" element (ns=http://www.w3.org/1999/xhtml).
PASS Check `setAttributeNS` allows setting non-trusted string for non-lowercase attribute "SRC" (ns=null) for "script" element (ns=http://www.w3.org/1999/xhtml).
PASS Check `setAttributeNS` allows setting non-trusted string for non-lowercase attribute "DATA" (ns=null) for "object" element (ns=http://www.w3.org/1999/xhtml).
PASS Check `setAttributeNS` allows setting non-trusted string for non-lowercase attribute "CODEBASE" (ns=null) for "object" element (ns=http://www.w3.org/1999/xhtml).
PASS Check `setAttributeNS` allows setting non-trusted string for non-lowercase attribute "HREF" (ns=null) for "script" element (ns=http://www.w3.org/2000/svg).
PASS Check `setAttributeNS` allows setting non-trusted string for non-lowercase attribute "HREF" (ns=http://www.w3.org/1999/xlink) for "script" element (ns=http://www.w3.org/2000/svg).

Expand Up @@ -21,40 +21,65 @@
assert_element_accepts_trusted_script_url_set_ns(window, '2', t, 'a', 'b', RESULTS.SCRIPTURL);
}, "Element.setAttributeNS assigned via policy (successful ScriptURL transformation)");

// Unknown, namespaced attributes should not be TT checked:
const htmlNamespace = "http://www.w3.org/1999/xhtml";

// Unknown attributes should not be TT checked:
test(t => {
assert_element_accepts_non_trusted_type_set_ns('a', 'b', 'A string', 'A string');
assert_element_accepts_non_trusted_type_set_ns('a', 'b', 'A string', 'A string', htmlNamespace, null);
}, "Element.setAttributeNS accepts untrusted string for non-specced accessor");

test(t => {
assert_element_accepts_non_trusted_type_set_ns('a', 'b', null, 'null');
assert_element_accepts_non_trusted_type_set_ns('a', 'b', null, 'null', htmlNamespace, null);
}, "Element.setAttributeNS accepts null for non-specced accessor");

// Setup trusted values for use in subsequent tests.
const script_url = createScriptURL_policy(window, '5').createScriptURL(INPUTS.ScriptURL);
const html = createHTML_policy(window, '6').createHTML(INPUTS.HTML);
const script = createScript_policy(window, '7').createScript(INPUTS.Script);

const xlink = "http://www.w3.org/1999/xlink";
const svg = "http://www.w3.org/2000/svg";
const xlinkNamespace = "http://www.w3.org/1999/xlink";
const svgNamespace = "http://www.w3.org/2000/svg";

// svg:script xlink:href=... expects a TrustedScriptURL.
// Assigning a TrustedScriptURL works.
test(t => {
let elem = document.createElementNS(svg, "script");
elem.setAttributeNS(xlink, "href", script_url);
let elem = document.createElementNS(svgNamespace, "script");
elem.setAttributeNS(xlinkNamespace, "href", script_url);
assert_equals("" + RESULTS.ScriptURL,
elem.getAttributeNodeNS(xlink, "href").value);
elem.getAttributeNodeNS(xlinkNamespace, "href").value);
}, "Assigning TrustedScriptURL to <svg:script xlink:href=...> works");

// Assigning things that ought to not work.
test(t => {
let elem = document.createElementNS(svg, "script");
let elem = document.createElementNS(svgNamespace, "script");
const values = [ "abc", null, html, script ];
for (const v of values) {
assert_throws_js(TypeError, _ => {
elem.setAttributeNS(xlink, "href", v);
elem.setAttributeNS(xlinkNamespace, "href", v);
});
}
}, "Blocking non-TrustedScriptURL assignment to <svg:script xlink:href=...> works");

// <https://w3c.github.io/trusted-types/dist/spec/#validate-attribute-mutation>.
const nonLowerCaseTests = [
{ element: "iframe", attribute: "SRCDOC", elementNamespace: htmlNamespace },
{ element: "embed", attribute: "SRC", elementNamespace: htmlNamespace },
{ element: "script", attribute: "SRC", elementNamespace: htmlNamespace },
{ element: "object", attribute: "DATA", elementNamespace: htmlNamespace },
{ element: "object", attribute: "CODEBASE", elementNamespace: htmlNamespace },
{ element: "script", attribute: "HREF", elementNamespace: svgNamespace },
{ element: "script", attribute: "HREF", elementNamespace: svgNamespace,
attributeNamespace: xlinkNamespace },
];

for (const testData of nonLowerCaseTests) {
const attributeNamespace = testData.attributeNamespace ?? null;

test(t => {
assert_element_accepts_non_trusted_type_set_ns(testData.element, testData.attribute, "v",
"v", testData.elementNamespace, attributeNamespace);
}, "Check `setAttributeNS` allows setting non-trusted string for non-lowercase attribute \"" +
testData.attribute + "\" (ns=" + attributeNamespace + ") for \"" + testData.element +
"\" element (ns=" + testData.elementNamespace + ").");
}
</script>
@@ -0,0 +1,9 @@
CONSOLE MESSAGE: This requires a TrustedHTML value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
CONSOLE MESSAGE: This requires a TrustedHTML value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"

PASS element.setHTMLUnsafe(html) assigned via policy (successful HTML transformation).
PASS `element.setHTMLUnsafe(string)` throws.
PASS `element.setHTMLUnsafe(null)` throws.
PASS `element.setHTMLUnsafe(string)` assigned via default policy (successful HTML transformation).
PASS `element.setHTMLUnsafe(string)` assigned via default policy does not throw

@@ -0,0 +1,79 @@
<!DOCTYPE html>
<html>
<head>
<meta name="author" title="Luke Warlow" href="mailto:lwarlow@igalia.com">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="support/helper.sub.js"></script>

<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script';">
</head>
<body>
<div id="container"></div>
<script>
var container = document.querySelector('#container')

// TrustedHTML assignments do not throw.
test(t => {
let p = createHTML_policy(window, 1);
let html = p.createHTML(INPUTS.HTML);

var d = document.createElement('div');
document.querySelector('#container').appendChild(d);
d.setHTMLUnsafe(html);
assert_equals(container.innerText, RESULTS.HTML);

while (container.firstChild)
container.firstChild.remove();
}, "element.setHTMLUnsafe(html) assigned via policy (successful HTML transformation).");

// String assignments throw.
test(t => {
var d = document.createElement('div');
container.appendChild(d);
assert_throws_js(TypeError, _ => {
d.setHTMLUnsafe("Fail");
});
assert_equals(container.innerText, "");
while (container.firstChild)
container.firstChild.remove();
}, "`element.setHTMLUnsafe(string)` throws.");

// Null assignment throws.
test(t => {
var d = document.createElement('div');
container.appendChild(d);
assert_throws_js(TypeError, _ => {
d.outerHTML = null;
});
assert_equals(container.innerText, "");
while (container.firstChild)
container.firstChild.remove();
}, "`element.setHTMLUnsafe(null)` throws.");

// After default policy creation string assignment implicitly calls createHTML.
test(t => {
let p = window.trustedTypes.createPolicy("default", { createHTML: createHTMLJS }, true);

var d = document.createElement('div');
document.querySelector('#container').appendChild(d);
d.setHTMLUnsafe(INPUTS.HTML);
assert_equals(container.innerText, RESULTS.HTML);

while (container.firstChild)
container.firstChild.remove();
}, "`element.setHTMLUnsafe(string)` assigned via default policy (successful HTML transformation).");

// After default policy creation null assignment implicitly calls createHTML.
test(t => {
var d = document.createElement('div');
container.appendChild(d);
d.setHTMLUnsafe(null);
assert_equals(container.innerText, "null");

while (container.firstChild)
container.firstChild.remove();
}, "`element.setHTMLUnsafe(string)` assigned via default policy does not throw");
</script>
</body>
</html>
@@ -0,0 +1,9 @@
CONSOLE MESSAGE: This requires a TrustedHTML value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"
CONSOLE MESSAGE: This requires a TrustedHTML value else it violates the following Content Security Policy directive: "require-trusted-types-for 'script'"

PASS shadowRoot.setHTMLUnsafe(html) assigned via policy (successful HTML transformation).
PASS `shadowRoot.setHTMLUnsafe(string)` throws.
PASS `shadowRoot.setHTMLUnsafe(null)` throws.
PASS `shadowRoot.setHTMLUnsafe(string)` assigned via default policy (successful HTML transformation).
PASS `shadowRoot.setHTMLUnsafe(string)` assigned via default policy does not throw

0 comments on commit 2e2d6c1

Please sign in to comment.