Test hidden `nonce` content attribute behavior. by mikewest · Pull Request #5423 · web-platform-tests/wpt

mikewest · 2017-04-07T11:25:34Z

mikewest · 2017-04-07T11:26:41Z

First pass at tests for whatwg/html#2373. What else would y'all like to see, @annevk, @arturjanc, and @zcorpan?

wpt-pr-bot · 2017-04-07T11:26:43Z

Notifying @hillbrad. (Learn how reviewing works.)

annevk · 2017-04-07T11:37:09Z

This all looks resaonable to me. Wouldn't getComputedStyle be an easier way to test CSS? Or did you specifically want to test that event? It seems with that event you don't know if it failed if the browser decided not to fetch the image for some other reason.

ghost · 2017-04-07T11:53:51Z

View the complete job log.

Firefox (nightly channel)

Testing web-platform-tests at revision 91f34f2
Using browser at version BuildID 20170406100208; SourceStamp 3c68d659c2b715f811708f043a1e7169d77be2ba
Starting 10 test iterations
All results were stable

All results

1 test ran

/content-security-policy/script-src/script-nonces-hidden.html

Subtest	Results	Messages
	OK
`HTML: Reading 'nonce' content attribute and IDL attribute.`	FAIL	`assert_equals: expected Element node <script nonce="abc" id="testScript" executed="yay">\n doc... but got null`
`HTML: Cloned node retains nonce.`	FAIL	`assert_equals: IDL attribute expected (string) "abc" but got (undefined) undefined`
`HTML: Cloned node retains nonce when inserted.`	FAIL	`assert_equals: expected (string) "abc" but got (undefined) undefined`
`HTML: Writing 'nonce' content attribute.`	FAIL	`assert_equals: expected (string) "abc" but got (undefined) undefined`
`HTML: Writing 'nonce' IDL attribute.`	PASS
`Document-written script executes.`	PASS
`HTML: Document-written script's nonce value.`	FAIL	`assert_equals: expected "" but got "abc"`
`HTML: createElement.nonce.`	FAIL	`assert_equals: expected (string) "yay" but got (object) null`
`HTML: createElement.setAttribute.`	FAIL	`assert_equals: Pre-insertion IDL expected (string) "" but got (undefined) undefined`
`Nonces don't leak via CSS side-channels.`	FAIL	`assert_equals: expected "none" but got "url(\"http://web-platform.test:8000/security/resources/abe.png\")"`

ghost · 2017-04-07T11:53:51Z

View the complete job log.

Chrome (unstable channel)

Testing web-platform-tests at revision 91f34f2
Using browser at version 59.0.3063.4 dev
Starting 10 test iterations

mikewest · 2017-04-07T12:06:48Z

Ah, I didn't think about getComputedStyle. :) That's simpler.

ghost · 2017-04-07T13:55:08Z

These tests are now available on w3c-test.org

mikewest · 2017-04-07T13:56:09Z

Updated the last test to use getComputedStyle. Not sure if the requestAnimationFrame is necessary; I have no idea what the timing of CSS style resolution/application is in relation to the current JavaScript task...

annevk · 2017-04-07T15:32:58Z

getComputedStyle forces style resolution, but the loading of background images is not deterministic, so that event might never fire I suppose.

annevk · 2017-04-07T15:33:22Z

(Does it fire on time in browsers today?)

mikewest · 2017-04-07T15:42:00Z

It doesn't. :( I'll drop the event. It's just going to be flaky even if it works, and the getComputedStyle bit is good enough in itself.

zcorpan · 2017-04-10T11:58:56Z

content-security-policy/script-src/script-nonces-hidden.html

+</style>
+<script nonce="abc" id="cssTest">
+    async_test(t => {
+      requestAnimationFrame(t.step_func_done(_ => {


No need for rAF. Can just make this a sync test().

zcorpan · 2017-04-10T12:02:14Z

content-security-policy/script-src/script-nonces-hidden.html

+
+      window.addEventListener('load', t.step_func_done(_ => {
+        assert_equals(s.nonce, 'abc', "Post-insertion IDL");
+        assert_equals(s.getAttribute('nonce'), '', "Post-insertion content");


I think the above two should be asserted directly after document.head.appendChild(s);

zcorpan · 2017-04-10T12:02:42Z

content-security-policy/script-src/script-nonces-hidden.html

+
+      window.addEventListener('load', t.step_func_done(_ => {
+        assert_equals(s.nonce, 'abc');
+        assert_equals(s.getAttribute('nonce'), null);


I think the above two should be asserted directly after document.head.appendChild(s);

zcorpan · 2017-04-10T12:04:01Z

content-security-policy/script-src/script-nonces-hidden.html

+    async_test(t => {
+      var s = document.createElement('script');
+      s.innerText = script.innerText;
+      s.nonce = 'abc';


Assert pre-insertion IDL and content attribute here?

For whatwg/html#5300. Supersedes #5423.

annevk · 2020-02-18T13:14:00Z

This is now #21853. I didn't address @zcorpan's nits though and they still seem valid...

annevk · 2020-02-18T13:22:17Z

Remaining nits now addressed in the other PR. Some were already addressed.

For whatwg/html#5300. Supersedes #5423

Test nonce-hiding behavior.

53ba945

As specified in whatwg/html#2373.

wpt-pr-bot added the content-security-policy label Apr 7, 2017

fixup getcomputedstyle

c7d506e

zcorpan self-requested a review April 7, 2017 14:14

annevk added the status:needs-spec-decision label Apr 7, 2017

fixup drop flaky bit of the test.

a1e68e5

mikewest mentioned this pull request Apr 10, 2017

Hide nonce content attribute values. (#2369) whatwg/html#2373

Merged

zcorpan reviewed Apr 10, 2017

View reviewed changes

mikewest changed the title ~~Test nonce-hiding behavior.~~ Test hidden nonce content attribute behavior. Apr 11, 2017

gsnedders closed this Jan 24, 2020

gsnedders deleted the nonce-hiding branch January 24, 2020 18:07

gsnedders restored the nonce-hiding branch January 24, 2020 18:45

Hexcles reopened this Jan 24, 2020

annevk added a commit that referenced this pull request Feb 18, 2020

nonce attribute: no longer tentative

878b7c8

For whatwg/html#5300. Supersedes #5423.

annevk mentioned this pull request Feb 18, 2020

nonce attribute: no longer tentative #21853

Merged

wpt-pr-bot requested a deployment to wpt-preview-5423 February 18, 2020 13:17 Abandoned

annevk closed this Feb 18, 2020

annevk deleted the nonce-hiding branch February 18, 2020 13:22

annevk added a commit that referenced this pull request Feb 19, 2020

nonce attribute: no longer tentative

2ca72d0

For whatwg/html#5300. Supersedes #5423

Conversation

mikewest commented Apr 7, 2017 • edited by foolip Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mikewest commented Apr 7, 2017

Uh oh!

wpt-pr-bot commented Apr 7, 2017

Uh oh!

annevk commented Apr 7, 2017

Uh oh!

ghost commented Apr 7, 2017 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Firefox (nightly channel)

All results

Uh oh!

ghost commented Apr 7, 2017 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Chrome (unstable channel)

Uh oh!

mikewest commented Apr 7, 2017

Uh oh!

ghost commented Apr 7, 2017 • edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mikewest commented Apr 7, 2017

Uh oh!

annevk commented Apr 7, 2017

Uh oh!

annevk commented Apr 7, 2017

Uh oh!

mikewest commented Apr 7, 2017

Uh oh!

zcorpan Apr 10, 2017

Choose a reason for hiding this comment

Uh oh!

zcorpan Apr 10, 2017

Choose a reason for hiding this comment

Uh oh!

zcorpan Apr 10, 2017

Choose a reason for hiding this comment

Uh oh!

zcorpan Apr 10, 2017

Choose a reason for hiding this comment

Uh oh!

annevk commented Feb 18, 2020

Uh oh!

annevk commented Feb 18, 2020

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

mikewest commented Apr 7, 2017 •

edited by foolip

Loading

ghost commented Apr 7, 2017 •

edited by ghost

Loading

ghost commented Apr 7, 2017 •

edited by ghost

Loading

ghost commented Apr 7, 2017 •

edited by ghost

Loading