<?php
    header("Content-Security-Policy: sandbox allow-scripts; upgrade-insecure-requests");
?>
<!DOCTYPE html>
<title>Upgrade Insecure Requests: Basics.</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script>

(function() {
    // This is a bit of a hack. UPGRADE doesn't upgrade the port number, so we
    // specify this non-existent URL ('http' over port 8443). If UPGRADE doesn't
    // work, it won't load.
    var insecureImage = "http://example.test:8443/security/resources/abe.png";

    var t = async_test("Verify that images are upgraded.");
    t.step(function () {
        var i = document.createElement('img');
        i.onload = t.step_func(function () {
            assert_equals(i.naturalHeight, 103, "Height.");
            assert_equals(i.naturalWidth, 76, "Width.");
            t.done();
        });
        i.onerror = t.step_func(function () {
            assert_unreached("The image should load successfully.");
        });

        i.src = insecureImage;
    });
}());

(function() {
    var insecureImage = "http://127.0.0.1:8000/security/resources/abe.png";
    var t = async_test("Verify that loopback images are not upgraded.");
    t.step(function () {
        var i = document.createElement('img');
        i.onload = t.step_func(function () {
            assert_equals(i.naturalHeight, 103, "Height.");
            assert_equals(i.naturalWidth, 76, "Width.");
            t.done();
        });
        i.onerror = t.step_func(function () {
            assert_unreached("The image should load successfully.");
        });

        i.src = insecureImage;
    });
}());

(function() {
    // This is a bit of a hack. UPGRADE doesn't upgrade the port number, so we
    // specify this non-existent URL ('http' over port 8443). If UPGRADE doesn't
    // work, it won't load.
    var insecureImage = "http://example.test:8443/security/resources/abe.png";
    var t = async_test("Verify that images have correct cross-origin behavior.");
    t.step(function () {
        var i = document.createElement('img');
        i.onload = t.step_func(function () {
            // Draw the image onto a canvas.
            var canvas = document.createElement('canvas');
            var ctx = canvas.getContext('2d');
            ctx.drawImage(i, 0, 0);

            // Grab a pixel to verify that the image is cross-origin (because sandbox):
            try {
                var pixel = ctx.getImageData(0, 0, 1, 1);
                assert_unreached("The image should be cross-origin with this document.");
            } catch (e) {
                t.done();
            }
        });
        i.onerror = t.step_func(function () {
            assert_unreached("The image should load successfully.");
        });

        i.src = insecureImage;
    });
}());
</script>