Skip to content

Commit 6981356

Browse files
fred-wangfred-wang
committed
Verify script enforcement applies even if the source text is modified before require-trusted-types-for 'script' is set.
Current spec [1] essentially caches the "script text" associated to a script element: it is initially empty and updated by various APIs calls. The "prepare the script element" algorithm is modified [2], so that "child text content" would go through the default policy if it does not match the cached "script text" [3]. Script enforcement could be alternatively be implemented by flags [4]. In that case, it might be tempting not to update the flags when the API calls modifying a script are performed before Trusted Types are actually enforced, with the rationale that these API calls are not considered untrusted at that time. For a cache-based implementations, this would be equivalent to not caching the "script text" until the first time it is set in a context when Trusted Types is enforced. However, WebKit and Chromium follow the spec and really try and run the default policy on the script text, even if the script text was modified before TrustedTypes enforcement got enabled. This PR adds tests to verify this behavior for HTML and SVG scripts. For completeness, this also verifies that if we remove the require-trusted-types-for meta tag before the test is executed, then TrustedTypes enforcement remains enabled per [5]. [1] https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts [2] https://w3c.github.io/trusted-types/dist/spec/#slot-value-verification [3] https://w3c.github.io/trusted-types/dist/spec/#prepare-the-script-text [4] w3c/trusted-types#579 [5] https://www.w3.org/TR/CSP3/#meta-element
1 parent 2a87738 commit 6981356

File tree

6 files changed

+129
-0
lines changed

6 files changed

+129
-0
lines changed

‎trusted-types/script-enforcement-012.html‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="support/passthroughpolicy.js"></script>
5+
<script src="support/script-messages.js"></script>
6+
<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts">
7+
<!-- This is similar to script-enforcement-001.html, but the CSP policy to
8+
enforce TrustedTypes is only set *after* the script source is modified. -->
9+
<div id="container"></div>
10+
<script>
11+
promise_test(async t => {
12+
await no_script_message_for(_ => {
13+
let script = create_html_script_with_trusted_source_text(";");
14+
script.appendChild(document.createTextNode(LOG_RUN_MESSAGE));
15+
document.head.insertAdjacentHTML("beforeend", `<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">`)
16+
container.appendChild(script);
17+
});
18+
}, "HTML script is untrusted even if its source was set before TrustedTypes got enabled.");
19+
</script>

‎trusted-types/script-enforcement-013.html‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="support/namespaces.js"></script>
5+
<script src="support/passthroughpolicy.js"></script>
6+
<script src="support/script-messages.js"></script>
7+
<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts">
8+
<!-- This is similar to script-enforcement-012.html, but for SVG script. -->
9+
<svg>
10+
<script type="unknown">;</script>
11+
</svg>
12+
<svg id="container"></svg>
13+
<script>
14+
promise_test(async t => {
15+
await no_script_message_for(_ => {
16+
let script = create_svg_script_with_trusted_source_text(";");
17+
script.appendChild(document.createTextNode(LOG_RUN_MESSAGE));
18+
document.head.insertAdjacentHTML("beforeend", `<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">`)
19+
container.appendChild(script);
20+
});
21+
}, "SVG script is untrusted even if source was set before TrustedTypes got enabled.");
22+
</script>

‎trusted-types/script-enforcement-014.html‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="support/passthroughpolicy.js"></script>
5+
<script src="support/script-messages.js"></script>
6+
<meta id="requireTrustedTypesForScriptMetaTag" http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script';">
7+
<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts">
8+
<link rel="help" href="https://www.w3.org/TR/CSP3/#meta-element">
9+
<!-- This is similar to script-enforcement-001.html, but the meta tag for
10+
require-trusted-types-for is removed at the beginning of the test. Per
11+
the CSP specification, TrustedTypes should still be enforced. -->
12+
<div id="container"></div>
13+
<script>
14+
promise_test(async t => {
15+
requireTrustedTypesForScriptMetaTag.remove();
16+
await no_script_message_for(_ => {
17+
let script = create_html_script_with_trusted_source_text(";");
18+
script.appendChild(document.createTextNode(LOG_RUN_MESSAGE));
19+
container.appendChild(script);
20+
});
21+
}, "HTML script is untrusted even if meta tag for require-trusted-types-for is removed.");
22+
</script>

‎trusted-types/script-enforcement-015.html‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="support/namespaces.js"></script>
5+
<script src="support/passthroughpolicy.js"></script>
6+
<script src="support/script-messages.js"></script>
7+
<meta id="requireTrustedTypesForScriptMetaTag" http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script';">
8+
<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts">
9+
<link rel="help" href="https://www.w3.org/TR/CSP3/#meta-element">
10+
<!-- This is similar to script-enforcement-014.html, but for SVG script. -->
11+
<svg>
12+
<script type="unknown">;</script>
13+
</svg>
14+
<svg id="container"></svg>
15+
<script>
16+
promise_test(async t => {
17+
requireTrustedTypesForScriptMetaTag.remove();
18+
await no_script_message_for(_ => {
19+
let script = create_svg_script_with_trusted_source_text(";");
20+
script.appendChild(document.createTextNode(LOG_RUN_MESSAGE));
21+
container.appendChild(script);
22+
});
23+
}, "SVG script is untrusted even if meta tag for require-trusted-types-for is removed.");
24+
</script>

‎trusted-types/script-enforcement-016.html‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="support/passthroughpolicy.js"></script>
5+
<script src="support/script-messages.js"></script>
6+
<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts">
7+
<!-- This is the same as script-enforcement-012.html but for modules. -->
8+
<div id="container"></div>
9+
<script>
10+
promise_test(async t => {
11+
await no_script_message_for(_ => {
12+
let script = create_html_script_with_trusted_source_text(";");
13+
script.setAttribute("type", "module");
14+
script.appendChild(document.createTextNode(LOG_RUN_MESSAGE));
15+
document.head.insertAdjacentHTML("beforeend", `<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">`)
16+
container.appendChild(script);
17+
});
18+
}, "HTML script with type=module is untrusted even if its source was set before TrustedTypes got enabled.");
19+
</script>

‎trusted-types/script-enforcement-017.html‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="support/namespaces.js"></script>
5+
<script src="support/passthroughpolicy.js"></script>
6+
<script src="support/script-messages.js"></script>
7+
<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts">
8+
<!-- This is similar to script-enforcement-016.html, but for SVG script. -->
9+
<svg>
10+
<script type="unknown">;</script>
11+
</svg>
12+
<svg id="container"></svg>
13+
<script>
14+
promise_test(async t => {
15+
await no_script_message_for(_ => {
16+
let script = create_svg_script_with_trusted_source_text(";");
17+
script.setAttribute("type", "module");
18+
script.appendChild(document.createTextNode(LOG_RUN_MESSAGE));
19+
document.head.insertAdjacentHTML("beforeend", `<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'">`)
20+
container.appendChild(script);
21+
});
22+
}, "SVG script with type=module is untrusted even if source was set before TrustedTypes got enabled.");
23+
</script>

0 commit comments

Comments
 (0)