Skip to main content

Browse the archive

https://github.com/web-platform-tests/wpt
26 December 2018, 22:31:15 UTC
Raw File
Tip revision: 9ab15c4be9aa0ecef8a7ae08cc5b45f1836abad7 authored by Stephen McGruer on 05 April 2018, 13:37:39 UTC
Web Animations: remove timing objects
Tip revision: 9ab15c4
script-sample.html 
<!doctype html>
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abc' 'report-sample'; style-src 'self'; img-src 'none'">
<script nonce="abc" src="/resources/testharness.js"></script>
<script nonce="abc" src="/resources/testharnessreport.js"></script>
<body>
<script nonce="abc">
    function waitForViolation(el) {
      return new Promise(resolve => {
        el.addEventListener('securitypolicyviolation', e => resolve(e));
      });
    }

    async_test(t => {
      var s = document.createElement('script');
      s.innerText = "assert_unreached('inline script block')";

      waitForViolation(s)
        .then(t.step_func_done(e => {
          assert_equals(e.blockedURI, "inline");
          assert_equals(e.sample, "assert_unreached('inline script block')");
        }));

      document.head.append(s);
    }, "Inline script should have a sample.");

    async_test(t => {
      var a = document.createElement("a");
      a.setAttribute("onclick", "assert_unreached('inline event handler')");

      waitForViolation(a)
        .then(t.step_func_done(e => {
          assert_equals(e.blockedURI, "inline");
          assert_equals(e.sample, "assert_unreached('inline event handler')");
        }));     
      
      document.body.append(a);
      a.click();
    }, "Inline event handlers should have a sample.");

    async_test(t => {
      var i = document.createElement("iframe");
      i.src = "javascript:'inline url'";

      waitForViolation(i)
        .then(t.step_func_done(e => {
          assert_equals(e.blockedURI, "inline");
          assert_equals(e.sample, "javascript:'inline url'");
        }));     
      
      document.body.append(i);
    }, "JavaScript URLs in iframes should have a sample.");

    async_test(t => {
      document.addEventListener('securitypolicyviolation', t.step_func(e => {
        if (e.blockedURI == "eval" &&
            e.sample == "assert_unreached('eval')") {
          t.done();
        }
      }));
      try {
        eval("assert_unreached('eval')");
        assert_unreached('eval');
      } catch (e) {
      }
    }, "eval() should have a sample.");

    async_test(t => {
      document.addEventListener('securitypolicyviolation', t.step_func(e => {
        if (e.blockedURI == "eval" &&
            e.sample == "assert_unreached('interval')") {
          t.done();
        }
      }));
      try {
        setInterval("assert_unreached('interval')", 1000);
        assert_unreached('interval');
      } catch (e) {
      }
    }, "setInterval() should have a sample.");

    async_test(t => {
      document.addEventListener('securitypolicyviolation', t.step_func(e => {
        if (e.blockedURI == "eval" &&
            e.sample == "assert_unreached('timeout')") {
          t.done();
        }
      }));
      try {
        setTimeout("assert_unreached('timeout')", 1000);
        assert_unreached('timeout');
      } catch (e) {
      }
    }, "setTimeout() should have a sample.");
</script>
back to top