From 48865555047aa04f2fbfcf7ba4460bbda3bd5a75 Mon Sep 17 00:00:00 2001
From: Yoav Weiss <yoavweiss@chromium.org>
Date: Mon, 15 Apr 2024 06:22:23 -0700
Subject: [PATCH] Import map support for integrity metadata

Change-Id: Ida563334048d013ffc658f9783f9401930dd4689
Bug: 334251999
---
 import-maps/dynamic-integrity.html | 90 ++++++++++++++++++++++++++++++
 import-maps/static-integrity.html  | 70 +++++++++++++++++++++++
 2 files changed, 160 insertions(+)
 create mode 100644 import-maps/dynamic-integrity.html
 create mode 100644 import-maps/static-integrity.html
diff --git a/import-maps/dynamic-integrity.html b/import-maps/dynamic-integrity.html
new file mode 100644
index 000000000000000..56a57ed25c4162f
--- /dev/null
+++ b/import-maps/dynamic-integrity.html
@@ -0,0 +1,90 @@
+<!DOCTYPE html>
+<html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+let log;
+</script>
+<script type="importmap" onload="t.assert_unreached('onload')" onerror="t.done()">
+{
+  "imports": {
+    "./resources/log.js?pipe=sub&name=A": "./resources/log.js?pipe=sub&name=B",
+    "./resources/log.js?pipe=sub&name=C": "./resources/log.js?pipe=sub&name=D",
+    "./resources/log.js?pipe=sub&name=G": "./resources/log.js?pipe=sub&name=F",
+    "./resources/log.js?pipe=sub&name=X": "./resources/log.js?pipe=sub&name=X",
+    "bare": "./resources/log.js?pipe=sub&name=E",
+    "bare2": "./resources/log.js?pipe=sub&name=F"
+  },
+  "integrity": {
+    "./resources/log.js?pipe=sub&name=B": "sha384-Li9vy3DqF8tnTXuiaAJuML3ky+er10rcgNR/VqsVpcw+ThHmYcwiB1pbOxEbzJr7",
+    "./resources/log.js?pipe=sub&name=C": "sha384-Li9vy3DqF8tnTXuiaAJuML3ky+er10rcgNR/VqsVpcw+ThHmYcwiB1pbOxEbzJr7",
+    "./resources/log.js?pipe=sub&name=X": "sha384-mCon9M46vUfNK2Wb3yjvBmpBw/3hwB+wMYS8IzDBng+7//R5Qao35E1azo4gFVax",
+    "./resources/log.js?pipe=sub&name=Y": "sha384-mCon9M46vUfNK2Wb3yjvBmpBw/3hwB+wMYS8IzDBng+7//R5Qao35E1azo4gFVax",
+    "./resources/log.js?pipe=sub&name=E": "sha384-Li9vy3DqF8tnTXuiaAJuML3ky+tr10rcgNR/VqsVpcw+ThHmYcwiB1pbOxEbzJr7",
+    "bare2": "sha384-Li9vy3DqF8tnTXuiaAJuML3ky+tr10rcgNR/VqsVpcw+ThHmYcwiB1pbOxEbzJr7"
+  }
+}
+</script>
+<script type="module">
+promise_test(() => {
+  log = [];
+  return import("./resources/log.js?pipe=sub&name=A")
+    .then(() => assert_unreached())
+    .catch(() => assert_equals(log.length, 0))
+  },
+  'script was not loaded, as its resolved URL failed its integrity check');
+
+promise_test(() => {
+  log = [];
+  return import("./resources/log.js?pipe=sub&name=C")
+    .then(() => {
+      assert_equals(log.length, 1);
+      assert_equals(log[0], "log:D");
+    })
+    .catch((e) => assert_unreached(e))
+  },
+  'script was loaded, as its resolved URL had no integrity check, despite' +
+  ' its specifier having one');
+
+promise_test(() => {
+  log = [];
+  return import("./resources/log.js?pipe=sub&name=X")
+    .then(() => {
+      assert_equals(log.length, 1);
+      assert_equals(log[0], "log:X");
+    })
+    .catch((e) => assert_unreached(e))
+  },
+  'script was loaded, as its integrity check passed');
+
+promise_test(() => {
+  log = [];
+  return import("./resources/log.js?pipe=sub&name=Y")
+    .then(() => assert_unreached())
+    .catch(() => assert_equals(log.length, 0))
+  },
+  'Script with no import definition was not loaded, as it failed its' +
+  ' integrity check');
+
+promise_test(() => {
+  log = [];
+  return import("bare")
+    .then(() => assert_unreached())
+    .catch(() => assert_equals(log.length, 0))
+  },
+  'Bare specifier script was not loaded, as it failed its integrity check');
+
+promise_test(() => {
+  log = [];
+  return import("bare2")
+    .then(() => {
+      assert_equals(log.length, 1);
+      assert_equals(log[0], "log:F");
+    })
+    .catch((e) => assert_unreached(e))
+  },
+  'Bare specifier used for integrity loaded, as its definition should have' +
+  ' used the URL');
+
+</script>
+
diff --git a/import-maps/static-integrity.html b/import-maps/static-integrity.html
new file mode 100644
index 000000000000000..7fef79650ccf156
--- /dev/null
+++ b/import-maps/static-integrity.html
@@ -0,0 +1,70 @@
+<!DOCTYPE html>
+<html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script>
+let log = [];
+</script>
+<script type="importmap">
+{
+  "imports": {
+    "./resources/log.js?pipe=sub&name=A": "./resources/log.js?pipe=sub&name=B",
+    "./resources/log.js?pipe=sub&name=C": "./resources/log.js?pipe=sub&name=D"
+  },
+  "integrity": {
+    "./resources/log.js?pipe=sub&name=B": "sha384-Li9vy3DqF8tnTXuiaAJuML3ky+er10rcgNR/VqsVpcw+ThHmYcwiB1pbOxEbzJr7",
+    "./resources/log.js?pipe=sub&name=D": "sha384-rxZqznFuOnvObm6JJKVmwzBXrsRG25IepqKDFHGhtitRu9YPjxPpRPMIu2hzvtxF",
+    "./resources/log.js?pipe=sub&name=X": "sha384-mCon9M46vUfNK2Wb3yjvBmpBw/3hwB+wMYS8IzDBng+7//R5Qao35E1azo4gFVzx",
+    "./resources/log.js?pipe=sub&name=Y": "sha384-u0yaFlBF39Au++qcn+MGL/Ml7UmuVfLymNJAz6Yyi4RqyUfWelcuAzVyE8Shs9xn",
+    "./resources/log.js?pipe=sub&name=Z": "sha384-u0yaFlBF39Au++qcn+MGL/Ml7UmuVfLymNJAz6Yyi4RqyUfWelcuAzVyE8Shs9xn"
+  }
+}
+</script>
+<script type="module">
+import './resources/log.js?pipe=sub&name=A';
+</script>
+<script type="module">
+test(t => {
+    assert_array_equals(log, []);
+  }, 'Static script did not load as it failed its integrity check');
+log = [];
+</script>
+<script type="module">
+import './resources/log.js?pipe=sub&name=C';
+</script>
+<script type="module">
+test(t => {
+    assert_array_equals(log, ["log:D"]);
+  }, 'Static script loaded as its integrity check passed');
+log = [];
+</script>
+<script type="module">
+import './resources/log.js?pipe=sub&name=X';
+</script>
+<script type="module">
+test(t => {
+    assert_array_equals(log, []);
+  }, 'Static script did not load as it failed its integrity check, even' +
+     ' without an import defined');
+log = [];
+</script>
+<script type="module">
+import './resources/log.js?pipe=sub&name=Y';
+</script>
+<script type="module">
+test(t => {
+    assert_array_equals(log, ["log:Y"]);
+  }, 'Static script loaded as its integrity check passed without an import' +
+     ' defined');
+log = [];
+</script>
+<script type="module" src="./resources/log.js?pipe=sub&name=Z">;
+</script>
+<script type="module">
+test(t => {
+    assert_array_equals(log, ["log:Z"]);
+  }, 'HTML-based module script loaded despite an integrity check that was' +
+     ' supposed to fail, because import map integrity does not apply to' +
+     ' HTML-based modules.');
+log = [];
+</script>
