[wdspec] Add tentative tests for script commands bypassing CSP #55853
Conversation
| """, | ||
| "window.inlineScriptEval()", | ||
| "window.preloadScriptEval()", | ||
| "window.document.body.onclick()", |
There was a problem hiding this comment.
Shouldn't this fail if the CSP disallows eval? In other words, if I am testing that my CSP works, I want this to fail, correct?
There was a problem hiding this comment.
Deciding this is the goal of the discussion in w3c/webdriver-bidi#1024
This test covers all the scenarios I could think about regarding eval/new Function usage from BiDi. At the moment Firefox fails all of them, and Chrome passes all of them except for the async use cases.
But I agree with you and I think it would be better if scripts defined in the content page were not allowed to bypass CSP, even if they are called from a WebDriver BiDi evaluated script. So both window.inlineScriptEval and window.document.body.onclick should fail IMO.
sadym-chromium
left a comment
There was a problem hiding this comment.
Really good coverage, thanks!
6f5235b to
a50d5e9
Compare
|
There was a lot of duplication between the two tests, so I extracted the common setup logic to a dedicated fixture and also moved the base expressions used for evaluation to a shared list. |
a86fcf2 to
0192419
Compare
0192419 to
b8d2bc4
Compare
whimboo
left a comment
There was a problem hiding this comment.
Thanks. Looks good to me, and the two failing tests for Firefox tests are unrelated to this change.
|
Thanks for the reviews! @jgraham could you admin merge this? |
|
Can someone from @web-platform-tests/admins help merge this? The flakes are unrelated to my patch here. |
This adds test cases for script commands bypassing CSP.
See w3c/webdriver-bidi#1024