Skip to content

Commit db339f5

Browse files
tete17tete17
committed
LibWeb: Add a bunch of WPT tests for TrustedTypes
We now successfully pass these
1 parent b42f0b7 commit db339f5

13 files changed

+604
-0
lines changed

‎Tests/LibWeb/Text/expected/wpt-import/trusted-types/DOMParser-parseFromString-regression.txt‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Harness status: OK
2+
3+
Found 1 tests
4+
5+
1 Pass
6+
Pass Regression test for TT changes to parseFromString.

‎Tests/LibWeb/Text/expected/wpt-import/trusted-types/Document-write-appending-line-feed.txt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
Harness status: OK
2+
3+
Found 6 tests
4+
5+
6 Pass
6+
Pass document.write() with TrustedHTML arguments only.
7+
Pass document.write() with String arguments only.
8+
Pass document.write() with TrustedHTML for all but one argument.
9+
Pass document.writeln() with TrustedHTML arguments only.
10+
Pass document.writeln() with String arguments only.
11+
Pass document.writeln() with TrustedHTML for all but one argument.

‎Tests/LibWeb/Text/expected/wpt-import/trusted-types/block-Document-execCommand.txt‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
Harness status: OK
2+
3+
Found 6 tests
4+
5+
5 Pass
6+
1 Fail
7+
Fail Document.execCommand("insertHTML") throws.
8+
Pass Document.execCommand("insertHTML") works with a TrustedHTML argument.
9+
Pass Document.execCommand("paste") works as usual."
10+
Pass Document.execCommand("paste") works with a TrustedHTML argument.
11+
Pass Document.execCommand("insertHTML") works as usual with a default policy.
12+
Pass Document.execCommand("paste") works as usual with a default policy.

‎Tests/LibWeb/Text/expected/wpt-import/trusted-types/block-string-assignment-to-HTMLIFrameElement-srcdoc.txt‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
Harness status: OK
2+
3+
Found 5 tests
4+
5+
2 Pass
6+
3 Fail
7+
Pass iframe.srcdoc assigned via policy (successful HTML transformation).
8+
Fail `iframe.srcdoc = string` throws.
9+
Fail `iframe.srcdoc = null` throws.
10+
Fail `iframe.srcdoc = string` assigned via default policy (successful HTML transformation).
11+
Pass `iframe.srcdoc = null` assigned via default policy does not throw

‎Tests/LibWeb/Text/expected/wpt-import/trusted-types/trusted-types-event-handlers.txt‎

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
Harness status: OK
2+
3+
Found 104 tests
4+
5+
104 Pass
6+
Pass Event handler onclick should be blocked.
7+
Pass Event handler onchange should be blocked.
8+
Pass Event handler onfocus should be blocked.
9+
Pass Event handler oNclick should be blocked.
10+
Pass Event handler OnClIcK should be blocked.
11+
Pass Non-event handler one should not be blocked.
12+
Pass Non-event handler oNe should not be blocked.
13+
Pass Non-event handler onIcon should not be blocked.
14+
Pass Non-event handler offIcon should not be blocked.
15+
Pass Non-event handler blubb should not be blocked.
16+
Pass Non-event handler div.align should not be blocked.
17+
Pass Non-event handler div.title should not be blocked.
18+
Pass Non-event handler div.inert should not be blocked.
19+
Pass Non-event handler div.draggable should not be blocked.
20+
Pass Event handler div.onabort should be blocked.
21+
Pass Event handler div.onauxclick should be blocked.
22+
Pass Event handler div.onbeforeinput should be blocked.
23+
Pass Event handler div.onbeforematch should be blocked.
24+
Pass Event handler div.onbeforetoggle should be blocked.
25+
Pass Event handler div.onblur should be blocked.
26+
Pass Event handler div.oncancel should be blocked.
27+
Pass Event handler div.oncanplay should be blocked.
28+
Pass Event handler div.oncanplaythrough should be blocked.
29+
Pass Event handler div.onchange should be blocked.
30+
Pass Event handler div.onclick should be blocked.
31+
Pass Event handler div.onclose should be blocked.
32+
Pass Event handler div.oncommand should be blocked.
33+
Pass Event handler div.oncontextlost should be blocked.
34+
Pass Event handler div.oncontextmenu should be blocked.
35+
Pass Event handler div.oncontextrestored should be blocked.
36+
Pass Event handler div.oncopy should be blocked.
37+
Pass Event handler div.oncuechange should be blocked.
38+
Pass Event handler div.oncut should be blocked.
39+
Pass Event handler div.ondblclick should be blocked.
40+
Pass Event handler div.ondrag should be blocked.
41+
Pass Event handler div.ondragend should be blocked.
42+
Pass Event handler div.ondragenter should be blocked.
43+
Pass Event handler div.ondragleave should be blocked.
44+
Pass Event handler div.ondragover should be blocked.
45+
Pass Event handler div.ondragstart should be blocked.
46+
Pass Event handler div.ondrop should be blocked.
47+
Pass Event handler div.ondurationchange should be blocked.
48+
Pass Event handler div.onemptied should be blocked.
49+
Pass Event handler div.onended should be blocked.
50+
Pass Event handler div.onerror should be blocked.
51+
Pass Event handler div.onfocus should be blocked.
52+
Pass Event handler div.onfocusin should be blocked.
53+
Pass Event handler div.onfocusout should be blocked.
54+
Pass Event handler div.onformdata should be blocked.
55+
Pass Event handler div.oninput should be blocked.
56+
Pass Event handler div.oninvalid should be blocked.
57+
Pass Event handler div.onkeydown should be blocked.
58+
Pass Event handler div.onkeypress should be blocked.
59+
Pass Event handler div.onkeyup should be blocked.
60+
Pass Event handler div.onload should be blocked.
61+
Pass Event handler div.onloadeddata should be blocked.
62+
Pass Event handler div.onloadedmetadata should be blocked.
63+
Pass Event handler div.onloadstart should be blocked.
64+
Pass Event handler div.onmousedown should be blocked.
65+
Pass Event handler div.onmouseenter should be blocked.
66+
Pass Event handler div.onmouseleave should be blocked.
67+
Pass Event handler div.onmousemove should be blocked.
68+
Pass Event handler div.onmouseout should be blocked.
69+
Pass Event handler div.onmouseover should be blocked.
70+
Pass Event handler div.onmouseup should be blocked.
71+
Pass Event handler div.onpaste should be blocked.
72+
Pass Event handler div.onpause should be blocked.
73+
Pass Event handler div.onplay should be blocked.
74+
Pass Event handler div.onplaying should be blocked.
75+
Pass Event handler div.onprogress should be blocked.
76+
Pass Event handler div.onratechange should be blocked.
77+
Pass Event handler div.onreset should be blocked.
78+
Pass Event handler div.onresize should be blocked.
79+
Pass Event handler div.onscroll should be blocked.
80+
Pass Event handler div.onscrollend should be blocked.
81+
Pass Event handler div.onsecuritypolicyviolation should be blocked.
82+
Pass Event handler div.onseeked should be blocked.
83+
Pass Event handler div.onseeking should be blocked.
84+
Pass Event handler div.onselect should be blocked.
85+
Pass Event handler div.onselectionchange should be blocked.
86+
Pass Event handler div.onslotchange should be blocked.
87+
Pass Event handler div.onstalled should be blocked.
88+
Pass Event handler div.onsubmit should be blocked.
89+
Pass Event handler div.onsuspend should be blocked.
90+
Pass Event handler div.ontimeupdate should be blocked.
91+
Pass Event handler div.ontoggle should be blocked.
92+
Pass Event handler div.onvolumechange should be blocked.
93+
Pass Event handler div.onwaiting should be blocked.
94+
Pass Event handler div.onwebkitanimationend should be blocked.
95+
Pass Event handler div.onwebkitanimationiteration should be blocked.
96+
Pass Event handler div.onwebkitanimationstart should be blocked.
97+
Pass Event handler div.onwebkittransitionend should be blocked.
98+
Pass Event handler div.onwheel should be blocked.
99+
Pass Event handler div.onpointerover should be blocked.
100+
Pass Event handler div.onpointerenter should be blocked.
101+
Pass Event handler div.onpointerdown should be blocked.
102+
Pass Event handler div.onpointermove should be blocked.
103+
Pass Event handler div.onpointerrawupdate should be blocked.
104+
Pass Event handler div.onpointerup should be blocked.
105+
Pass Event handler div.onpointercancel should be blocked.
106+
Pass Event handler div.onpointerout should be blocked.
107+
Pass Event handler div.onpointerleave should be blocked.
108+
Pass Event handler div.ongotpointercapture should be blocked.
109+
Pass Event handler div.onlostpointercapture should be blocked.

‎Tests/LibWeb/Text/expected/wpt-import/trusted-types/trusted-types-reporting-for-Element-innerHTML.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Harness status: OK
2+
3+
Found 2 tests
4+
5+
2 Pass
6+
Pass No violation reported for TrustedHTML.
7+
Pass Violation report for plain string.

‎Tests/LibWeb/Text/input/wpt-import/trusted-types/DOMParser-parseFromString-regression.html‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
<!DOCTYPE html>
2+
<script src="../resources/testharness.js"></script>
3+
<script src="../resources/testharnessreport.js"></script>
4+
<meta http-equiv="Content-Security-Policy" content="blabla">
5+
<body>
6+
<div id="target"></div>
7+
<div id="probe"></div>
8+
<script>
9+
test(t => {
10+
// Regression test for crbug.com/1030830. (Should work in any browser, though.)
11+
//
12+
// The top-level doc has a CSP that doesn't do anything interesting. We'll
13+
// parse a doc and create an iframe with an embedded CSP, and will ensure that
14+
// the CSP applies to the frame, but not the top-level doc.
15+
const target = document.getElementById("target");
16+
const probe = document.getElementById("probe");
17+
probe.innerHTML = "probe";
18+
19+
const doc = new DOMParser().parseFromString(`
20+
<body><div id="probe"></div></body>"`, "text/html");
21+
probe.innerHTML = "probe";
22+
23+
const frame = document.createElement("iframe");
24+
frame.src = `data:text/html;${encodeURI(doc.documentElement.outerHTML)}`;
25+
frame.id = "frame";
26+
target.appendChild(frame);
27+
const frame_probe = document.getElementById("frame").contentDocument.getElementById("probe");
28+
probe.innerHTML = "probe";
29+
assert_throws_js(TypeError, _ => { frame_probe.innnerHTML = "probe" });
30+
}, "Regression test for TT changes to parseFromString.");
31+
</script>
32+
</body>

‎Tests/LibWeb/Text/input/wpt-import/trusted-types/Document-write-appending-line-feed.html‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
<!DOCTYPE html>
2+
<script src="../resources/testharness.js"></script>
3+
<script src="../resources/testharnessreport.js"></script>
4+
<link rel="help" href="https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#document-write-steps">
5+
<meta name="assert" content="U+000A LINE FEED is only appended for document.writeln() and only after the arguments are concatenated and sanitized.">
6+
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script';">
7+
<body>
8+
<script>
9+
trustedTypes.createPolicy('default', { createHTML: x => `[${x}]` });
10+
const customPolicy =
11+
trustedTypes.createPolicy('custom', { createHTML: x => `(${x})` });
12+
const cleanupPolicy =
13+
trustedTypes.createPolicy('cleanup', { createHTML: x => x });
14+
const doc = (new DOMParser()).parseFromString(`<body></body>`, "text/html");
15+
function cleanup() { doc.body.innerHTML = cleanupPolicy.createHTML(""); }
16+
17+
test(t => {
18+
t.add_cleanup(cleanup);
19+
let a = customPolicy.createHTML("1");
20+
let b = customPolicy.createHTML("2");
21+
let c = customPolicy.createHTML("3");
22+
let d = customPolicy.createHTML("4");
23+
doc.write(a, b, c, d);
24+
assert_equals(doc.body.innerHTML, "(1)(2)(3)(4)");
25+
}, "document.write() with TrustedHTML arguments only.");
26+
27+
test(t => {
28+
t.add_cleanup(cleanup);
29+
let a = "1"
30+
let b = "2"
31+
let c = "3";
32+
let d = "4"
33+
doc.write(a, b, c, d);
34+
assert_equals(doc.body.innerHTML, "[1234]");
35+
}, "document.write() with String arguments only.");
36+
37+
test(t => {
38+
t.add_cleanup(cleanup);
39+
let a = customPolicy.createHTML("1");
40+
let b = customPolicy.createHTML("2");
41+
let c = "3";
42+
let d = customPolicy.createHTML("4");
43+
doc.write(a, b, c, d);
44+
assert_equals(doc.body.innerHTML, "[(1)(2)3(4)]");
45+
}, "document.write() with TrustedHTML for all but one argument.");
46+
47+
test(t => {
48+
t.add_cleanup(cleanup);
49+
let a = customPolicy.createHTML("1");
50+
let b = customPolicy.createHTML("2");
51+
let c = customPolicy.createHTML("3");
52+
let d = customPolicy.createHTML("4");
53+
doc.writeln(a, b, c, d);
54+
assert_equals(doc.body.innerHTML, "(1)(2)(3)(4)\n");
55+
}, "document.writeln() with TrustedHTML arguments only.");
56+
57+
test(t => {
58+
t.add_cleanup(cleanup);
59+
let a = "1"
60+
let b = "2"
61+
let c = "3";
62+
let d = "4"
63+
doc.writeln(a, b, c, d);
64+
assert_equals(doc.body.innerHTML, "[1234]\n");
65+
}, "document.writeln() with String arguments only.");
66+
67+
test(t => {
68+
t.add_cleanup(cleanup);
69+
let a = customPolicy.createHTML("1");
70+
let b = customPolicy.createHTML("2");
71+
let c = "3";
72+
let d = customPolicy.createHTML("4");
73+
doc.writeln(a, b, c, d);
74+
assert_equals(doc.body.innerHTML, "[(1)(2)3(4)]\n");
75+
}, "document.writeln() with TrustedHTML for all but one argument.");
76+
</script>

‎Tests/LibWeb/Text/input/wpt-import/trusted-types/block-Document-execCommand.html‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<!DOCTYPE html>
2+
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">
3+
<link rel="author" title="Daniel Vogelheim" href="mailto:[email protected]"></link>
4+
<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/"></link>
5+
<script src="../resources/testharness.js"></script>
6+
<script src="../resources/testharnessreport.js"></script>
7+
<body>
8+
<script>
9+
// Tests that certain execCommand commands will observe Trusted Types if
10+
// it's enforced.
11+
const commands = [ "insertHTML", "paste" ];
12+
const tt_commands = [ "insertHTML" ];
13+
14+
// A pass-through policy for testing.
15+
const a_policy = trustedTypes.createPolicy("a policy", {"createHTML": x => x});
16+
17+
for (const command of commands) {
18+
const requires_tt = tt_commands.includes(command);
19+
20+
// Test that execCommand with String throws, but only for commands that
21+
// require TT.
22+
if (requires_tt) {
23+
test(t => {
24+
assert_throws_js(TypeError, _ => document.execCommand(command, false, "<em>Hello World</em>"));
25+
}, `Document.execCommand("${command}") throws.`);
26+
} else {
27+
test(t => {
28+
document.execCommand(command, false, "<em>Hello World</em>");
29+
}, `Document.execCommand("${command}") works as usual."`);
30+
}
31+
// Test that execCommand succeeds with a TrustedHTML argument.
32+
test(t => {
33+
document.execCommand(command, false, a_policy.createHTML("<em>Hello World</em>"));
34+
}, `Document.execCommand("${command}") works with a TrustedHTML argument.`);
35+
}
36+
37+
// Test that with a default policy, all comamnds will work again.
38+
trustedTypes.createPolicy("default", {"createHTML": (x, _, sink) => {
39+
assert_equals(sink, 'Document execCommand');
40+
return x;
41+
}});
42+
43+
for (const command of commands) {
44+
test(t => {
45+
document.execCommand(command, false, "<em>Hello World</em>");
46+
}, `Document.execCommand("${command}") works as usual with a default policy.`);
47+
}
48+
</script>

‎Tests/LibWeb/Text/input/wpt-import/trusted-types/block-string-assignment-to-HTMLIFrameElement-srcdoc.html‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
<!DOCTYPE html>
2+
<script src="../resources/testharness.js"></script>
3+
<script src="../resources/testharnessreport.js"></script>
4+
<script src="support/helper.sub.js"></script>
5+
6+
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script';">
7+
<body>
8+
<script>
9+
// TrustedHTML assignments do not throw.
10+
test(t => {
11+
let p = createHTML_policy(window, 1);
12+
let html = p.createHTML(INPUTS.HTML);
13+
let iframe = document.createElement("iframe");
14+
iframe.srcdoc = html;
15+
assert_equals(iframe.srcdoc, RESULTS.HTML);
16+
}, "iframe.srcdoc assigned via policy (successful HTML transformation).");
17+
18+
// String assignments throw.
19+
test(t => {
20+
let iframe = document.createElement("iframe");
21+
assert_throws_js(TypeError, _ => {
22+
iframe.srcdoc = "A string";
23+
});
24+
}, "`iframe.srcdoc = string` throws.");
25+
26+
// Null assignment throws.
27+
test(t => {
28+
let iframe = document.createElement("iframe");
29+
assert_throws_js(TypeError, _ => {
30+
iframe.srcdoc = null;
31+
});
32+
}, "`iframe.srcdoc = null` throws.");
33+
34+
// After default policy creation string assignment implicitly calls createHTML
35+
test(t => {
36+
let p = window.trustedTypes.createPolicy("default", { createHTML:
37+
(value, _, sink) => {
38+
assert_equals(sink, "HTMLIFrameElement srcdoc");
39+
return createHTMLJS(value);
40+
}
41+
});
42+
43+
let iframe = document.createElement("iframe");
44+
iframe.srcdoc = INPUTS.HTML;
45+
assert_equals(iframe.srcdoc, RESULTS.HTML);
46+
}, "`iframe.srcdoc = string` assigned via default policy (successful HTML transformation).");
47+
48+
// After default policy creation null assignment implicitly calls createHTML.
49+
test(t => {
50+
let iframe = document.createElement("iframe");
51+
iframe.srcdoc = null;
52+
assert_equals(iframe.srcdoc, "null");
53+
}, "`iframe.srcdoc = null` assigned via default policy does not throw");
54+
</script>

0 commit comments

Comments
 (0)