238 lines
11 KiB
HTML
238 lines
11 KiB
HTML
<!DOCTYPE HTML>
|
|
<html>
|
|
<head>
|
|
<title>Bug 1716706 : Write referrer-policy tests for https-first </title>
|
|
<script src="/tests/SimpleTest/SimpleTest.js"></script>
|
|
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
|
|
</head>
|
|
<body>
|
|
|
|
<script class="testbody" type="text/javascript">
|
|
"use strict";
|
|
/*
|
|
* Description of the test:
|
|
* We perform each test with 8 different settings.
|
|
* The first is a same origin request from an http site to an https site.
|
|
* The second is a same origin request from an https -> https.
|
|
* The third is a cross-origin request from an http -> https.
|
|
* The fourth is a cross-origin request from an https -> https.
|
|
* The fifth is a same origin request from an http -> http site.
|
|
* The sixth is a same origin request from an https -> http.
|
|
* The seventh is a cross-origin request from an http -> http.
|
|
* The last is a cross-origin request from an https -> http.
|
|
*/
|
|
|
|
SimpleTest.waitForExplicitFinish();
|
|
// This test performs a lot of requests and checks (64 requests).
|
|
// So to prevent to get a timeout before executing all test request longer timeout.
|
|
SimpleTest.requestLongerTimeout(2);
|
|
const SAME_ORIGIN =
|
|
"http://example.com/tests/dom/security/test/https-first/file_referrer_policy.sjs?";
|
|
// SAME ORIGIN with "https" instead of "http"
|
|
const SAME_ORIGIN_HTTPS = SAME_ORIGIN.replace("http", "https");
|
|
|
|
const CROSS_ORIGIN =
|
|
"http://example.org/tests/dom/security/test/https-first/file_referrer_policy.sjs?";
|
|
// CROSS ORIGIN with "https" instead of "http"
|
|
const CROSS_ORIGIN_HTTPS = CROSS_ORIGIN.replace("http", "https");
|
|
|
|
// Define test cases. Query equals the test case referrer policy.
|
|
// We will set in the final request the url parameters such that 'rp=' equals the referrer policy
|
|
//and 'upgrade=' equals '1' if the request should be https.
|
|
// For a 'upgrade=0' url parameter the server lead to a timeout such that https-first downgrades
|
|
// the request to http.
|
|
const testCases = [
|
|
{
|
|
query: "no-referrer",
|
|
expectedResultSameOriginDownUp: "",
|
|
expectedResultSameOriginUpUp: "",
|
|
expectedResultCrossOriginDownUp:"",
|
|
expectedResultCrossOriginUpUp:"",
|
|
expectedResultSameOriginDownDown: "",
|
|
expectedResultSameOriginUpDown: "",
|
|
expectedResultCrossOriginDownDown:"",
|
|
expectedResultCrossOriginUpDown: "",
|
|
},
|
|
{
|
|
query: "no-referrer-when-downgrade",
|
|
expectedResultSameOriginDownUp: SAME_ORIGIN + "rp=no-referrer-when-downgrade&upgrade=http-https",
|
|
expectedResultSameOriginUpUp: SAME_ORIGIN_HTTPS + "rp=no-referrer-when-downgrade&upgrade=https-https",
|
|
expectedResultCrossOriginDownUp: CROSS_ORIGIN + "rp=no-referrer-when-downgrade&upgrade=http-https",
|
|
expectedResultCrossOriginUpUp: CROSS_ORIGIN_HTTPS + "rp=no-referrer-when-downgrade&upgrade=https-https",
|
|
expectedResultSameOriginDownDown: SAME_ORIGIN + "rp=no-referrer-when-downgrade&upgrade=http-http",
|
|
expectedResultSameOriginUpDown: "",
|
|
expectedResultCrossOriginDownDown: CROSS_ORIGIN + "rp=no-referrer-when-downgrade&upgrade=http-http",
|
|
expectedResultCrossOriginUpDown:"",
|
|
},
|
|
{
|
|
query: "origin",
|
|
expectedResultSameOriginDownUp: "http://example.com/",
|
|
expectedResultSameOriginUpUp: "https://example.com/",
|
|
expectedResultCrossOriginDownUp:"http://example.org/",
|
|
expectedResultCrossOriginUpUp:"https://example.org/",
|
|
expectedResultSameOriginDownDown: "http://example.com/",
|
|
expectedResultSameOriginUpDown: "https://example.com/",
|
|
expectedResultCrossOriginDownDown:"http://example.org/",
|
|
expectedResultCrossOriginUpDown:"https://example.org/",
|
|
},
|
|
{
|
|
query: "origin-when-cross-origin",
|
|
expectedResultSameOriginDownUp: "http://example.com/",
|
|
expectedResultSameOriginUpUp: SAME_ORIGIN_HTTPS + "rp=origin-when-cross-origin&upgrade=https-https",
|
|
expectedResultCrossOriginDownUp:"http://example.org/",
|
|
expectedResultCrossOriginUpUp:"https://example.org/",
|
|
expectedResultSameOriginDownDown: SAME_ORIGIN + "rp=origin-when-cross-origin&upgrade=http-http",
|
|
expectedResultSameOriginUpDown: "https://example.com/",
|
|
expectedResultCrossOriginDownDown:"http://example.org/",
|
|
expectedResultCrossOriginUpDown:"https://example.org/",
|
|
},
|
|
{
|
|
query: "same-origin",
|
|
expectedResultSameOriginDownUp: "",
|
|
expectedResultSameOriginUpUp: SAME_ORIGIN_HTTPS + "rp=same-origin&upgrade=https-https",
|
|
expectedResultCrossOriginDownUp:"",
|
|
expectedResultCrossOriginUpUp:"",
|
|
expectedResultSameOriginDownDown: SAME_ORIGIN + "rp=same-origin&upgrade=http-http",
|
|
expectedResultSameOriginUpDown: "",
|
|
expectedResultCrossOriginDownDown: "",
|
|
expectedResultCrossOriginUpDown:"",
|
|
},
|
|
{
|
|
query: "strict-origin",
|
|
expectedResultSameOriginDownUp: "http://example.com/",
|
|
expectedResultSameOriginUpUp: "https://example.com/",
|
|
expectedResultCrossOriginDownUp:"http://example.org/",
|
|
expectedResultCrossOriginUpUp:"https://example.org/",
|
|
expectedResultSameOriginDownDown: "http://example.com/",
|
|
expectedResultSameOriginUpDown: "",
|
|
expectedResultCrossOriginDownDown:"http://example.org/",
|
|
expectedResultCrossOriginUpDown:"",
|
|
},
|
|
{
|
|
query: "strict-origin-when-cross-origin",
|
|
expectedResultSameOriginDownUp: "http://example.com/",
|
|
expectedResultSameOriginUpUp: SAME_ORIGIN_HTTPS + "rp=strict-origin-when-cross-origin&upgrade=https-https",
|
|
expectedResultCrossOriginDownUp:"http://example.org/",
|
|
expectedResultCrossOriginUpUp:"https://example.org/",
|
|
expectedResultSameOriginDownDown: SAME_ORIGIN + "rp=strict-origin-when-cross-origin&upgrade=http-http",
|
|
expectedResultSameOriginUpDown: "",
|
|
expectedResultCrossOriginDownDown:"http://example.org/",
|
|
expectedResultCrossOriginUpDown:"",
|
|
},
|
|
{
|
|
query: "unsafe-url",
|
|
expectedResultSameOriginDownUp: SAME_ORIGIN + "rp=unsafe-url&upgrade=http-https",
|
|
expectedResultSameOriginUpUp: SAME_ORIGIN_HTTPS + "rp=unsafe-url&upgrade=https-https",
|
|
expectedResultCrossOriginDownUp: CROSS_ORIGIN + "rp=unsafe-url&upgrade=http-https",
|
|
expectedResultCrossOriginUpUp: CROSS_ORIGIN_HTTPS + "rp=unsafe-url&upgrade=https-https",
|
|
expectedResultSameOriginDownDown: SAME_ORIGIN + "rp=unsafe-url&upgrade=http-http",
|
|
expectedResultSameOriginUpDown: SAME_ORIGIN_HTTPS + "rp=unsafe-url&upgrade=https-http",
|
|
expectedResultCrossOriginDownDown:CROSS_ORIGIN + "rp=unsafe-url&upgrade=http-http",
|
|
expectedResultCrossOriginUpDown:CROSS_ORIGIN_HTTPS + "rp=unsafe-url&upgrade=https-http",
|
|
},
|
|
];
|
|
|
|
|
|
let currentTest = 0;
|
|
let sameOriginRequest = true;
|
|
let testWin;
|
|
let currentQuery;
|
|
window.addEventListener("message", receiveMessage);
|
|
let currentRun = 0;
|
|
// All combinations, HTTP -> HTTPS, HTTPS -> HTTPS, HTTP -> HTTP, HTTPS -> HTTP
|
|
const ALL_COMB = ["http-https", "https-https" ,"http-http", "https-http"];
|
|
|
|
// Receive message and verify that we receive the expected referrer header
|
|
async function receiveMessage(event) {
|
|
let data = event.data;
|
|
currentQuery = testCases[currentTest].query;
|
|
let currentComb = ALL_COMB[currentRun];
|
|
// if request was http -> https
|
|
if (currentComb === "http-https") {
|
|
if (sameOriginRequest){
|
|
is(data.result, testCases[currentTest].expectedResultSameOriginDownUp ,
|
|
"We received for the downgraded same site request with referrer policy: " + currentQuery + " the correct referrer");
|
|
is(data.location, SAME_ORIGIN_HTTPS + "sendMe","Opened correct location");
|
|
} else {
|
|
is(data.result, testCases[currentTest].expectedResultCrossOriginDownUp ,
|
|
"We received for the downgraded cross site request with referrer policy: " + currentQuery + " the correct referrer");
|
|
is(data.location, SAME_ORIGIN_HTTPS + "sendMe", "Opened correct location");
|
|
}
|
|
// if request was https -> https
|
|
} else if (currentComb === "https-https") {
|
|
if (sameOriginRequest){
|
|
is(data.result, testCases[currentTest].expectedResultSameOriginUpUp ,
|
|
"We received for the upgraded same site request with referrer policy: " + currentQuery + " the correct referrer");
|
|
is(data.location, SAME_ORIGIN_HTTPS + "sendMe", "Opened correct location");
|
|
} else {
|
|
is(data.result, testCases[currentTest].expectedResultCrossOriginUpUp,
|
|
"We received for the upgraded cross site request with referrer policy: " + currentQuery + " the correct referrer");
|
|
is(data.location, SAME_ORIGIN_HTTPS + "sendMe", "Opened correct location");
|
|
}
|
|
} else if (currentComb === "http-http") {
|
|
if (sameOriginRequest){
|
|
is(data.result, testCases[currentTest].expectedResultSameOriginDownDown ,
|
|
"We received for the upgraded same site request with referrer policy: " + currentQuery + " the correct referrer");
|
|
is(data.location, SAME_ORIGIN + "sendMe2","Opened correct location for" + currentQuery + currentComb);
|
|
} else {
|
|
is(data.result, testCases[currentTest].expectedResultCrossOriginDownDown,
|
|
"We received for the upgraded cross site request with referrer policy: " + currentQuery + " the correct referrer");
|
|
is(data.location, SAME_ORIGIN + "sendMe2", "Opened correct location " + currentQuery + currentComb);
|
|
}
|
|
} else if (currentComb === "https-http") {
|
|
if (sameOriginRequest){
|
|
is(data.result, testCases[currentTest].expectedResultSameOriginUpDown ,
|
|
"We received for the upgraded same site request with referrer policy: " + currentQuery + " the correct referrer");
|
|
is(data.location, SAME_ORIGIN + "sendMe2","Opened correct location " + currentQuery + currentComb);
|
|
} else {
|
|
is(data.result, testCases[currentTest].expectedResultCrossOriginUpDown,
|
|
"We received for the upgraded cross site request with referrer policy: " + currentQuery + " the correct referrer");
|
|
is(data.location, SAME_ORIGIN + "sendMe2", "Opened correct location " + currentQuery + currentComb);
|
|
}
|
|
}
|
|
testWin.close();
|
|
currentRun++;
|
|
if (currentTest >= testCases.length -1 && currentRun === ALL_COMB.length && !sameOriginRequest) {
|
|
window.removeEventListener("message", receiveMessage);
|
|
SimpleTest.finish();
|
|
return;
|
|
}
|
|
runTest();
|
|
}
|
|
|
|
async function runTest() {
|
|
currentQuery = testCases[currentTest].query;
|
|
// send same origin request
|
|
if (sameOriginRequest && currentRun < ALL_COMB.length) {
|
|
// if upgrade = 0 downgrade request, else upgrade
|
|
testWin = window.open(SAME_ORIGIN + "rp=" +currentQuery + "&upgrade=" + ALL_COMB[currentRun], "_blank");
|
|
} else {
|
|
// if same origin isn't set, check if we need to send cross origin requests
|
|
// eslint-disable-next-line no-lonely-if
|
|
if (!sameOriginRequest && currentRun < ALL_COMB.length ) {
|
|
// if upgrade = 0 downgrade request, else upgrade
|
|
testWin = window.open(CROSS_ORIGIN + "rp=" +currentQuery + "&upgrade=" + ALL_COMB[currentRun], "_blank");
|
|
} // else we completed all test case of the current query for the current origin. Prepare and call next test
|
|
else {
|
|
// reset currentRun and go to next query
|
|
currentRun = 0;
|
|
if(!sameOriginRequest){
|
|
currentTest++;
|
|
}
|
|
// run same test again for crossOrigin or start new test with sameOrigin
|
|
sameOriginRequest = !sameOriginRequest;
|
|
currentQuery = testCases[currentTest].query;
|
|
runTest();
|
|
}
|
|
}
|
|
}
|
|
|
|
SpecialPowers.pushPrefEnv({ set: [
|
|
["dom.security.https_first", true],
|
|
["dom.security.https_first_add_exception_on_failiure", false],
|
|
["network.http.referer.disallowCrossSiteRelaxingDefault", false],
|
|
]}, runTest);
|
|
|
|
</script>
|
|
</body>
|
|
</html>
|