[WPT] Test script's base URL used in dynamic imports

This CL checks base URL used in resolving relative URL-like specifiers in dynamic imports() from - `<script>`s, - worker top-level scripts, and - worker scripts imported by `importScripts()`. This is for whatwg/html#5751. Bug: 1082086 Change-Id: I778fb4d34b2e61f57799600006963c93aee5272c
web-platform-tests · Jul 22, 2020 · 365efed · 365efed
1 parent fb1ac61
commit 365efed
Show file tree

Hide file tree

Showing 8 changed files with 132 additions and 0 deletions.
diff --git a/...ntics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub.html b/...ntics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<title>Base URLs used in resolving specifiers in dynamic imports from workers</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+fetch_tests_from_worker(new Worker(
+    "../beta/redirect.py?location=http://{{host}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js"));
+fetch_tests_from_worker(new Worker(
+    "./worker-importScripts.sub.js"));
+</script>
diff --git a/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url.sub.html b/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url.sub.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<title>Base URLs used in resolving specifiers in dynamic imports</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<script>
+self.testName = "same origin classic <script>";
+self.baseUrlSanitized = false;
+</script>
+<script src="../beta/redirect.py?location=http://{{host}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js"></script>
+
+<script>
+self.testName = "cross origin classic <script> without crossorigin attribute";
+self.baseUrlSanitized = true;
+</script>
+<script src="../beta/redirect.py?location=http://{{hosts[alt][]}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js"></script>
+
+<script>
+self.testName = "cross origin classic <script> with crossorigin attribute";
+self.baseUrlSanitized = false;
+</script>
+<script src="../beta/redirect.py?location=http://{{hosts[alt][]}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js%3Fpipe=header(Access-Control-Allow-Origin,*)" crossorigin></script>
+
+<script>
+self.testName = "cross origin module <script>";
+self.baseUrlSanitized = false;
+</script>
+<script src="../beta/redirect.py?location=http://{{hosts[alt][]}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js%3Fpipe=header(Access-Control-Allow-Origin,*)" type="module"></script>
diff --git a/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/import.js b/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/import.js
@@ -0,0 +1,2 @@
+var A = { "from": "alpha/import.js" };
+export { A };
diff --git a/...cs/scripting-1/the-script-element/module/dynamic-import/alpha/worker-importScripts.sub.js b/...cs/scripting-1/the-script-element/module/dynamic-import/alpha/worker-importScripts.sub.js
@@ -0,0 +1,15 @@
+"use strict";
+
+importScripts("/resources/testharness.js");
+
+// CORS-same-origin
+self.testName = "same-origin importScripts()";
+self.baseUrlSanitized = false;
+importScripts("../beta/redirect.py?location=http://{{host}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js");
+
+// CORS-cross-origin
+self.testName = "cross-origin importScripts()";
+self.baseUrlSanitized = true;
+importScripts("../beta/redirect.py?location=http://{{hosts[alt][]}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js");
+
+done();
diff --git a/html/semantics/scripting-1/the-script-element/module/dynamic-import/beta/import.js b/html/semantics/scripting-1/the-script-element/module/dynamic-import/beta/import.js
@@ -0,0 +1,2 @@
+var A = { "from": "beta/import.js" };
+export { A };
diff --git a/html/semantics/scripting-1/the-script-element/module/dynamic-import/beta/redirect.py b/html/semantics/scripting-1/the-script-element/module/dynamic-import/beta/redirect.py
@@ -0,0 +1,19 @@
+def main(request, response):
+    """Simple handler that causes redirection.
+
+    The request should typically have two query parameters:
+    status - The status to use for the redirection. Defaults to 302.
+    location - The resource to redirect to.
+    """
+    status = 302
+    if b"status" in request.GET:
+        try:
+            status = int(request.GET.first(b"status"))
+        except ValueError:
+            pass
+
+    response.status = status
+
+    location = request.GET.first(b"location")
+
+    response.headers.set(b"Location", location)
diff --git a/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js b/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/base-url.sub.js
@@ -0,0 +1,54 @@
+"use strict";
+
+// This script triggers import(), and thus the base URL of this script
+// (either loaded by `<script>` or `importScripts()`) is used as the base URL
+// of resolving relative URL-like specifiers in `import()`.
+
+// The following fields should be set by the callers of this script
+// (unless loaded as the worker top-level script):
+// - self.testName (string)
+// - self.baseUrlSanitized (boolean)
+
+// When this script is loaded as the worker top-level script:
+if ('DedicatedWorkerGlobalScope' in self &&
+    self instanceof DedicatedWorkerGlobalScope &&
+    !self.testName) {
+  importScripts("/resources/testharness.js");
+  self.testName = 'worker top-level script';
+  // Worker top-level scripts are always same-origin.
+  self.baseUrlSanitized = false;
+}
+
+promise_test(((baseUrlSanitized) => {
+    const promise = import("./import.js?pipe=header(Access-Control-Allow-Origin,*)&label=" + Math.random());
+    if (baseUrlSanitized) {
+      // The base URL is "about:blank" and thus import() here should fail.
+      return promise.then(module => {
+          // This code should be unreached, but assert_equals() is used here
+          // to log `module.A["from"]` in case of unexpected resolution.
+          assert_equals(module.A["from"], "(unreached)",
+            "Relative URL-like specifier resolution should fail");
+          assert_unreached();
+        },
+        () => {});
+    } else {
+      // The base URL is the response URL of this script, i.e.
+      // `.../gamma/base-url.sub.js`.
+      return promise.then(module => {
+          assert_equals(module.A["from"], "gamma/import.js");
+        });
+    }
+  // `baseUrlSanitized` is bound here because promise_test() body can be
+  // executed asynchronously.
+  }).bind(undefined, self.baseUrlSanitized),
+  "Relative URL-like from " + self.testName);
+
+promise_test(() => {
+    return import("http://{{hosts[alt][]}}:{{ports[http][0]}}/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/import.js?pipe=header(Access-Control-Allow-Origin,*)&label=" + Math.random())
+      .then(module => {
+          assert_equals(module.A["from"], "gamma/import.js");
+        })
+  },
+  "Absolute URL-like from " + self.testName);
+
+done();
diff --git a/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/import.js b/html/semantics/scripting-1/the-script-element/module/dynamic-import/gamma/import.js
@@ -0,0 +1,2 @@
+var A = { "from": "gamma/import.js" };
+export { A };