| <!DOCTYPE html> |
| <html> |
| <head> |
| <meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abcdefg' 'strict-dynamic'"> |
| <script src="/resources/testharness.js" nonce="abcdefg"></script> |
| <script src="/resources/testharnessreport.js" nonce="abcdefg"></script> |
| <script src="../resources/securitypolicyviolation-helper.js" nonce="abcdefg"></script> |
| </head> |
| <body> |
| <!-- Need to individually wrap test cases in script blocks. Violation reports triggered by document.write() calls while the parser is waiting on blocking scipts are missing line numbers. See: https://crbug.com/649085. --> |
| <script nonce="abcdefg"> |
| async_test(function (t) { |
| var e = document.createElement('script'); |
| e.src = generateURL("append"); |
| e.onerror = t.unreached_func("Error should not be triggered."); |
| assert_script_loads(t, generateURL("append"), 17); |
| document.body.appendChild(e); |
| }, "Script injected via 'appendChild' is allowed with 'strict-dynamic'."); |
| </script> |
| <script nonce="abcdefg"> |
| async_test(function (t) { |
| var e = document.createElement('script'); |
| e.src = generateURL("append-async"); |
| e.async = true; |
| e.onerror = t.unreached_func("Error should not be triggered."); |
| assert_script_loads(t, generateURL("append-async"), 27); |
| document.body.appendChild(e); |
| }, "Async script injected via 'appendChild' is allowed with 'strict-dynamic'."); |
| </script> |
| <script nonce="abcdefg"> |
| async_test(function (t) { |
| var e = document.createElement('script'); |
| e.src = generateURL("append-defer"); |
| e.defer = true; |
| e.onerror = t.unreached_func("Error should not be triggered."); |
| assert_script_loads(t, generateURL("append-defer"), 37); |
| document.body.appendChild(e); |
| }, "Deferred script injected via 'appendChild' is allowed with 'strict-dynamic'."); |
| </script> |
| <script nonce="abcdefg"> |
| async_test(function (t) { |
| assert_script_failed(t, generateURL("write"), 43); |
| document.write("<scr" + "ipt src='" + generateURL("write") + "'></scr" + "ipt>"); |
| }, "Script injected via 'document.write' is not allowed with 'strict-dynamic'."); |
| </script> |
| <script nonce="abcdefg"> |
| async_test(function (t) { |
| assert_script_failed(t, generateURL("write-defer"), 49); |
| document.write("<scr" + "ipt defer src='" + generateURL("write-defer") + "'></scr" + "ipt>"); |
| }, "Deferred script injected via 'document.write' is not allowed with 'strict-dynamic'."); |
| </script> |
| <script nonce="abcdefg"> |
| async_test(function (t) { |
| assert_script_failed(t, generateURL("write-async"), 55); |
| document.write("<scr" + "ipt async src='" + generateURL("write-async") + "'></scr" + "ipt>"); |
| }, "Async script injected via 'document.write' is not allowed with 'strict-dynamic'."); |
| </script> |
| <script nonce="abcdefg" defer> |
| async_test(function (t) { |
| var e = document.createElement('script'); |
| e.src = generateURL("defer-append"); |
| e.onerror = t.unreached_func("Error should not be triggered."); |
| assert_script_loads(t, generateURL("defer-append"), 64); |
| document.body.appendChild(e); |
| }, "Script injected via deferred 'appendChild' is allowed with 'strict-dynamic'."); |
| </script> |
| <script nonce="abcdefg" defer> |
| async_test(function (t) { |
| var e = document.createElement('script'); |
| e.src = generateURL("defer-append-async"); |
| e.async = true; |
| e.onerror = t.unreached_func("Error should not be triggered."); |
| assert_script_loads(t, generateURL("defer-append-async"), 74); |
| document.body.appendChild(e); |
| }, "Async script injected via deferred 'appendChild' is allowed with 'strict-dynamic'."); |
| </script> |
| <script nonce="abcdefg" defer> |
| async_test(function (t) { |
| var e = document.createElement('script'); |
| e.src = generateURL("defer-append-defer"); |
| e.defer = true; |
| e.onerror = t.unreached_func("Error should not be triggered."); |
| assert_script_loads(t, generateURL("defer-append-defer"), 84); |
| document.body.appendChild(e); |
| }, "Deferred script injected via deferred 'appendChild' is allowed with 'strict-dynamic'."); |
| </script> |
| <script nonce="abcdefg" defer> |
| async_test(function (t) { |
| assert_script_failed(t, generateURL("defer-write"), 90); |
| document.write("<scr" + "ipt src='" + generateURL("defer-write") + "'></scr" + "ipt>"); |
| }, "Script injected via deferred 'document.write' is not allowed with 'strict-dynamic'."); |
| </script> |
| <script nonce="abcdefg" defer> |
| async_test(function (t) { |
| assert_script_failed(t, generateURL("defer-write-defer"), 96); |
| document.write("<scr" + "ipt defer src='" + generateURL("defer-write-defer") + "'></scr" + "ipt>"); |
| }, "Deferred script injected via deferred 'document.write' is not allowed with 'strict-dynamic'."); |
| </script> |
| <script nonce="abcdefg" defer> |
| async_test(function (t) { |
| assert_script_failed(t, generateURL("defer-write-async"), 102); |
| document.write("<scr" + "ipt async src='" + generateURL("defer-write-async") + "'></scr" + "ipt>"); |
| }, "Async script injected via deferred 'document.write' is not allowed with 'strict-dynamic'."); |
| </script> |
| </body> |
| </html> |
