Revision 83be7773ed3e2df8c2f8625d11ec35358586e48c authored by Anne van Kesteren on 13 March 2018, 17:31:34 UTC, committed by Anne van Kesteren on 13 March 2018, 17:31:34 UTC
See https://github.com/whatwg/html/pull/3562.
1 parent 970fca8
Raw File
block-string-assignment-to-script-src.tentative.html
<!DOCTYPE html>
<html>
<head>
  <script src="/resources/testharness.js"></script>
  <script src="/resources/testharnessreport.js"></script>
  <script src="./support/helper.js"></script>

  <meta http-equiv="Content-Security-Policy" content="require-trusted-types">
</head>
<body>
<script>
  // String assignments throw.
  test(t => {
    var s = document.createElement('script');
    assert_throws(new TypeError(), _ => {
      s.src = URLS.safe;
    });
    assert_equals('', s.src);
  }, "'string'");

  // TrustedURL assignments throw.
  test(t => {
    var url = TrustedURL.unsafelyCreate(URLS.safe);

    var s = document.createElement('script');
    assert_throws(new TypeError(), _ => {
      s.src = url;
    });
    assert_equals('', s.src);
  }, "TrustedURL(safe)");

  // TrustedScriptURL assignments work.
  test(t => {
    var url = TrustedScriptURL.unsafelyCreate(URLS.safe);

    var s = document.createElement('script');
    s.src = url;
    assert_equals(url + '', s.src);
  }, "TrustedScriptURL(safe)");

  test(t => {
    var url = TrustedScriptURL.unsafelyCreate(URLS.javascript);

    var s = document.createElement('script');
    s.src = url;
    assert_equals(url + '', s.src);
  }, "TrustedScriptURL(javascript)");

  test(t => {
    var url = TrustedScriptURL.unsafelyCreate(URLS.external);

    var s = document.createElement('script');
    s.src = url;
    assert_equals(url + '', s.src);
  }, "TrustedScriptURL(external)");
</script>
back to top