Skip to content

Commit 0fa493d

Browse files
fred-wangmoz-wptsync-bot
fred-wang
authored and
moz-wptsync-bot
committed
Bug 1941278 [wpt PR 50046] - Add tests for setAttribute/setAttributeNS and non-event-handler attri…, a=testonly
Automatic update from web-platform-tests Add tests for setAttribute/setAttributeNS and non-event-handler attributes (#50046) This is a tentative test for [1] covering bullet 3 from [2]. There is a separate PR to cover the bullet 2 [3]. Most of these are probably already covered by other tests but assertions are scattered into multiple files as a side check in the default policy callback, so they are hard to understand and to guarantee they actually run (some mistakes were previously found about this in the past). Additionally, this new test cover both setAttribute and setAttributeNS and ensure the correct callback is called exactly once with proper attributes (e.g. to verify a call to setAttribute does not trigger the callback with the parameters of a reflected IDL attribute). [1] whatwg/dom#1268 [2] https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute [3] web-platform-tests/wpt#50025 -- wpt-commits: 35de05425036bf714b270c76dd00892900002963 wpt-pr: 50046
1 parent a31b618 commit 0fa493d

File tree

1 file changed

+98
-0
lines changed

1 file changed

+98
-0
lines changed

‎testing/web-platform/tests/trusted-types/Element-setAttribute-setAttributeNS-sinks.tentative.html

+98
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
<!DOCTYPE html>
2+
<head>
3+
<script src="/resources/testharness.js"></script>
4+
<script src="/resources/testharnessreport.js"></script>
5+
<script src="support/namespaces.js"></script>
6+
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">
7+
<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#get-trusted-type-data-for-attribute">
8+
<link rel="help" href="https://github.com/whatwg/dom/pull/1268">
9+
</head>
10+
<script>
11+
const input_string = "unsafe string";
12+
const output_string = "safe string";
13+
let iframeElement;
14+
let scriptElement;
15+
let svgScriptElement;
16+
let seenSinkName;
17+
let seenTrustedTypeName;
18+
function resetGlobalVariables() {
19+
iframeElement = document.createElement('iframe');
20+
scriptElement = document.createElement('script');
21+
svgScriptElement = document.createElementNS(NSURI_SVG, 'script');
22+
seenSinkName = undefined;
23+
seenTrustedTypeName = undefined;
24+
}
25+
resetGlobalVariables();
26+
27+
function createTrustedType(input, trustedTypeName, sinkName) {
28+
assert_equals(input, input_string);
29+
assert_equals(seenSinkName, undefined);
30+
seenSinkName = sinkName;
31+
assert_equals(seenTrustedTypeName, undefined);
32+
seenTrustedTypeName = trustedTypeName;
33+
return output_string;
34+
}
35+
trustedTypes.createPolicy("default", {
36+
createHTML: createTrustedType,
37+
createScript: createTrustedType,
38+
createScriptURL: createTrustedType,
39+
});
40+
41+
test(t => {
42+
t.add_cleanup(resetGlobalVariables);
43+
iframeElement.setAttribute("srcdoc", input_string);
44+
assert_equals(seenTrustedTypeName, "TrustedHTML");
45+
assert_equals(seenSinkName, "HTMLIFrameElement srcdoc");
46+
assert_equals(iframeElement.getAttribute("srcdoc"), output_string);
47+
}, "HTMLIFrameElement.setAttribute('srcdoc', plain_string)");
48+
49+
test(t => {
50+
t.add_cleanup(resetGlobalVariables);
51+
iframeElement.setAttributeNS(null, "srcdoc", input_string);
52+
assert_equals(seenTrustedTypeName, "TrustedHTML");
53+
assert_equals(seenSinkName, "HTMLIFrameElement srcdoc");
54+
assert_equals(iframeElement.getAttribute("srcdoc"), output_string);
55+
}, "HTMLIFrameElement.setAttributeNS(null, 'srcdoc', plain_string)");
56+
57+
test(t => {
58+
t.add_cleanup(resetGlobalVariables);
59+
scriptElement.setAttribute("src", input_string);
60+
assert_equals(seenTrustedTypeName, "TrustedScriptURL");
61+
assert_equals(seenSinkName, "HTMLScriptElement src");
62+
assert_equals(scriptElement.getAttribute("src"), output_string);
63+
}, "HTMLScriptElement.setAttribute('src', plain_string)");
64+
65+
test(t => {
66+
t.add_cleanup(resetGlobalVariables);
67+
scriptElement.setAttributeNS(null, "src", input_string);
68+
assert_equals(seenTrustedTypeName, "TrustedScriptURL");
69+
assert_equals(seenSinkName, "HTMLScriptElement src");
70+
assert_equals(scriptElement.getAttribute("src"), output_string);
71+
}, "HTMLScriptElement.setAttributeNS(null, 'src', plain_string)");
72+
73+
test(t => {
74+
t.add_cleanup(resetGlobalVariables);
75+
svgScriptElement.setAttribute("href", input_string);
76+
assert_equals(seenTrustedTypeName, "TrustedScriptURL");
77+
assert_equals(seenSinkName, "SVGScriptElement href");
78+
assert_equals(svgScriptElement.getAttribute("href"), output_string);
79+
}, "SVGScriptElement.setAttribute('href', plain_string)");
80+
81+
test(t => {
82+
t.add_cleanup(resetGlobalVariables);
83+
svgScriptElement.setAttributeNS(null, "href", input_string);
84+
assert_equals(seenTrustedTypeName, "TrustedScriptURL");
85+
assert_equals(seenSinkName, "SVGScriptElement href");
86+
assert_equals(svgScriptElement.getAttribute("href"), output_string);
87+
}, "SVGScriptElement.setAttributeNS(null, 'href', plain_string)");
88+
89+
test(t => {
90+
t.add_cleanup(resetGlobalVariables);
91+
svgScriptElement.setAttributeNS(NSURI_XLINK, "href", input_string);
92+
assert_equals(seenTrustedTypeName, "TrustedScriptURL");
93+
assert_equals(seenSinkName, "SVGScriptElement href");
94+
assert_equals(svgScriptElement.getAttributeNS(NSURI_XLINK, "href"),
95+
output_string);
96+
assert_equals(svgScriptElement.getAttribute("href"), output_string);
97+
}, "SVGScriptElement.setAttributeNS(NSURI_XLINK, 'href', plain_string)");
98+
</script>

0 commit comments

Comments
 (0)