Jan-Ivar Bruaroey
02e47efeec
Differential Revision: https://phabricator.services.mozilla.com/D276378
39 lines
1.4 KiB
HTML
39 lines
1.4 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta name="timeout" content="long">
|
|
<meta http-equiv="Content-Security-Policy" content="connect-src 'self'; script-src 'self' 'unsafe-inline';">
|
|
<title>connect-src-webtransport-blocked</title>
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
</head>
|
|
<script>
|
|
|
|
const url = "https://{{domains[www1]}}:{{ports[webtransport-h3][0]}}/webtransport/handlers/echo.py";
|
|
|
|
const serverCertificateHashes = [
|
|
{algorithm: "sha-256", value: new Uint8Array(32)}
|
|
];
|
|
|
|
[
|
|
{url, options: {}, expected: "connect-src"},
|
|
{url, options: {serverCertificateHashes}, expected: "connect-src"},
|
|
].forEach(({url, options, expected}) => promise_test(async t => {
|
|
const haveViolation = new Promise(r => window.onsecuritypolicyviolation = r);
|
|
try {
|
|
const wt = new WebTransport(url, options);
|
|
t.add_cleanup(() => wt.close());
|
|
wt.closed.catch(() => {});
|
|
await wt.ready;
|
|
assert_equals(expected, undefined, "allowed");
|
|
} catch (e) {
|
|
if (e.name != "WebTransportError") throw e;
|
|
const timeout = new Promise(r => t.step_timeout(() => r({}), 1000));
|
|
const {violatedDirective} = await Promise.race([haveViolation, timeout]);
|
|
assert_equals(violatedDirective, expected);
|
|
}
|
|
}, `CSP connect-src self vs ${Object.keys(options)[0] || "WebTransport"}. Expecting ${expected}`));
|
|
|
|
</script>
|
|
</html>
|