From 4181e139a8f5a08a2936efc91a2a1e9f7eca8058 Mon Sep 17 00:00:00 2001 From: Andy Paicu Date: Fri, 9 Nov 2018 15:46:07 +0000 Subject: [PATCH] Bug 1499834 [wpt PR 13579] - Added 304 CSP test and removed "content-*" prefix from headers to ignore on 304, a=testonly Automatic update from web-platform-testsAdded 304 CSP test and removed "content-*" prefix from headers to ignore on 304 Also updated kNonUpdatedHeaders with more headers from the nsHttpResponseHead file Spec: https://fetch.spec.whatwg.org/#concept-http-network-or-cache-fetch Spec issue: https://github.com/w3c/webappsec-csp/issues/161 While the spec does not give any list of content headers that should be ignored on a 304 request, some of them are directly dependent on the resource body and as such should not be updated (for example `content-length` cannot be different since the content remains identical). The exact list of ignored headers is identical to the one that firefox uses. Bug: 174301 Change-Id: I8aab863b1f2733d051609e121539ad6acad36c6b Reviewed-on: https://chromium-review.googlesource.com/c/1286427 Commit-Queue: Andy Paicu Reviewed-by: Mike West Reviewed-by: Matt Menke Cr-Commit-Position: refs/heads/master@{#602001} -- wpt-commits: 1b09004d92653856ca896d0f267d42bfda788434 wpt-pr: 13579 --- .../304-response-should-update-csp.sub.html | 52 +++++++++++++++++++ .../generic/support/304-response.py | 33 ++++++++++++ .../tests/fetch/http-cache/304-update.html | 30 +++++++++++ 3 files changed, 115 insertions(+) create mode 100644 testing/web-platform/tests/content-security-policy/generic/304-response-should-update-csp.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/generic/support/304-response.py diff --git a/testing/web-platform/tests/content-security-policy/generic/304-response-should-update-csp.sub.html b/testing/web-platform/tests/content-security-policy/generic/304-response-should-update-csp.sub.html new file mode 100644 index 0000000000000..b16eadaedc07c --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/generic/304-response-should-update-csp.sub.html @@ -0,0 +1,52 @@ + + + + + + Test that a 304 response will update the CSP header + + + + + + diff --git a/testing/web-platform/tests/content-security-policy/generic/support/304-response.py b/testing/web-platform/tests/content-security-policy/generic/support/304-response.py new file mode 100644 index 0000000000000..4980937eab7f7 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/generic/support/304-response.py @@ -0,0 +1,33 @@ +def main(request, response): + if request.headers.get("If-None-Match"): + # we are now receing the second request, we will send back a different CSP + # with the 304 response + response.status = 304 + headers = [("Content-Type", "text/html"), + ("Content-Security-Policy", "script-src 'nonce-def' 'sha256-IIB78ZS1RMMrAWpsLg/RrDbVPhI14rKm3sFOeKPYulw=';"), + ("Cache-Control", "private, max-age=0, must-revalidate"), + ("ETag", "123456")] + return headers, "" + else: + headers = [("Content-Type", "text/html"), + ("Content-Security-Policy", "script-src 'nonce-abc' 'sha256-IIB78ZS1RMMrAWpsLg/RrDbVPhI14rKm3sFOeKPYulw=';"), + ("Cache-Control", "private, max-age=0, must-revalidate"), + ("Etag", "123456")] + return headers, ''' + + + + + + + + +''' diff --git a/testing/web-platform/tests/fetch/http-cache/304-update.html b/testing/web-platform/tests/fetch/http-cache/304-update.html index f0bd82196e57b..d6d8481e87427 100644 --- a/testing/web-platform/tests/fetch/http-cache/304-update.html +++ b/testing/web-platform/tests/fetch/http-cache/304-update.html @@ -120,6 +120,36 @@ } ] }, + { + name: "Content-* header", + requests: [ + { + response_headers: [ + ["Expires", -5000], + ["ETag", "GHI"], + ["Content-Test-Header", "A"] + ] + }, + { + response_headers: [ + ["Expires", 3000], + ["ETag", "GHI"], + ["Content-Test-Header", "B"] + ], + expected_type: "etag_validated", + expected_response_headers: [ + ["Content-Test-Header", "B"] + ], + pause_after: true + }, + { + expected_type: "cached", + expected_response_headers: [ + ["Content-Test-Header", "B"] + ] + } + ] + }, ]; run_tests(tests);