Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

nonce attribute: no longer tentative #21853

Merged
merged 6 commits into from
Feb 19, 2020
Merged

nonce attribute: no longer tentative #21853

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
878b7c8
nonce attribute: no longer tentative
annevk Feb 18, 2020
e877182
nonce: remove incorrect SVG tests
annevk Feb 18, 2020
5248ff9
address nits
annevk Feb 18, 2020
a6f341e
basic nonce tests
annevk Feb 18, 2020
ccd7eb6
test removal of content attribute
annevk Feb 19, 2020
8dbdbe7
test more after all
annevk Feb 19, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions content-security-policy/nonce-hiding/nonces.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
<!DOCTYPE html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<div id=log></div>
<script>
[["meh", ""],
["div", ""],
["script", ""],
["meh", "http://www.w3.org/2000/svg"],
["svg", "http://www.w3.org/2000/svg"], ,
["script", "http://www.w3.org/2000/svg"]].forEach(([localName, namespace]) => {
test(t => {
const element = namespace === "" ? document.createElement(localName) : document.createElementNS(namespace, localName);
t.add_cleanup(() => element.remove());
assert_equals(element.nonce, "", "Initial IDL attribute value");
element.setAttribute("nonce", "x");
assert_equals(element.nonce, "x", "IDL attribute is modified after content attribute set");
assert_equals(element.getAttribute("nonce"), "x", "Content attribute is modified after content attribute set");
document.body.appendChild(element);
assert_equals(element.nonce, "x", "IDL attribute is unchanged after element insertion");
assert_equals(element.getAttribute("nonce"), "", "Content attribute is changed after element insertion");
}, `Basic nonce tests for ${localName} in ${namespace === "" ? "HTML" : "SVG"} namespace`);

test(t => {
const element = namespace === "" ? document.createElement(localName) : document.createElementNS(namespace, localName);
element.setAttribute("nonce", "x");
assert_equals(element.nonce, "x", "IDL attribute is modified after content attribute set");
element.removeAttribute("nonce");
assert_equals(element.nonce, "", "IDL attribute is empty after content attribute removal");
}, `Ensure that removal of content attribute does not affect IDL attribute for ${localName} in ${namespace === "" ? "HTML" : "SVG"} namespace`);
});
</script>
1 change: 1 addition & 0 deletions content-security-policy/nonce-hiding/nonces.html.headers
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Content-Security-Policy: img-src 'none'
15 changes: 8 additions & 7 deletions ...ipt-nonces-hidden-meta.tentative.sub.html → ...hiding/script-nonces-hidden-meta.sub.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,8 @@
var s = document.createElement('script');
s.innerText = script.innerText;
s.nonce = 'abc';
assert_equals(s.nonce, 'abc');
assert_equals(s.getAttribute('nonce'), null);
document.head.appendChild(s);
assert_equals(s.nonce, 'abc');
assert_equals(s.getAttribute('nonce'), null);
Expand Down Expand Up @@ -119,12 +121,11 @@
#cssTest[nonce=abc] { background: url(/security/resources/abe.png); }
</style>
<script nonce="abc" id="cssTest">
async_test(t => {
requestAnimationFrame(t.step_func_done(_ => {
var script = document.querySelector('#cssTest');
var style = getComputedStyle(script);
assert_equals(style['display'], 'block');
assert_equals(style['background-image'], "url(\"http://{{domains[]}}:{{ports[http][0]}}/security/resources/abe.png\")");
}));
test(t => {
const script = document.querySelector('#cssTest');
t.add_cleanup(() => script.remove());
var style = getComputedStyle(script);
assert_equals(style['display'], 'block');
assert_equals(style['background-image'], "url(\"http://{{domains[]}}:{{ports[http][0]}}/security/resources/abe.png\")");
}, "Nonces leak via CSS side-channels.");
</script>
15 changes: 8 additions & 7 deletions ...iding/script-nonces-hidden.tentative.html → ...cy/nonce-hiding/script-nonces-hidden.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,8 @@
var s = document.createElement('script');
s.innerText = script.innerText;
s.nonce = 'abc';
assert_equals(s.nonce, 'abc');
assert_equals(s.getAttribute('nonce'), null);
document.head.appendChild(s);
assert_equals(s.nonce, 'abc');
assert_equals(s.getAttribute('nonce'), null);
Expand Down Expand Up @@ -160,12 +162,11 @@
#cssTest[nonce=abc] { background: url(/security/resources/abe.png); }
</style>
<script nonce="abc" id="cssTest">
async_test(t => {
requestAnimationFrame(t.step_func_done(_ => {
var script = document.querySelector('#cssTest');
var style = getComputedStyle(script);
assert_equals(style['display'], 'block');
assert_equals(style['background-image'], 'none');
}));
test(t => {
const script = document.querySelector('#cssTest');
t.add_cleanup(() => script.remove());
var style = getComputedStyle(script);
assert_equals(style['display'], 'block');
assert_equals(style['background-image'], 'none');
}, "Nonces don't leak via CSS side-channels.");
</script>
0 ...ript-nonces-hidden.tentative.html.headers → ...-hiding/script-nonces-hidden.html.headers
View file
Open in desktop
File renamed without changes.
18 changes: 0 additions & 18 deletions ...ipt-nonces-hidden-meta.tentative.sub.html → ...ing/svgscript-nonces-hidden-meta.sub.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,21 +96,3 @@
assert_equals(innerScript.getAttribute('nonce'), 'abc', "Post-insertion content");
}, "createElement.setAttribute.");
</script>

<!-- CSS Leakage -->
<style>
#cssTest { display: block; }
#cssTest[nonce=abc] { background: url(/security/resources/abe.png); }
</style>
<svg xmlns="http://www.w3.org/2000/svg">
<script nonce="abc" id="cssTest">
async_test(t => {
requestAnimationFrame(t.step_func_done(_ => {
var script = document.querySelector('#cssTest');
var style = getComputedStyle(script);
assert_equals(style['display'], 'block');
assert_equals(style['background-image'], "url(\"http://{{domains[]}}:{{ports[http][0]}}/security/resources/abe.png\")");
}));
}, "Nonces don't leak via CSS side-channels.");
</script>
</svg>
18 changes: 0 additions & 18 deletions ...ng/svgscript-nonces-hidden.tentative.html → ...nonce-hiding/svgscript-nonces-hidden.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,21 +96,3 @@
assert_equals(innerScript.getAttribute('nonce'), '', "Post-insertion content");
}, "createElement.setAttribute.");
</script>

<!-- CSS Leakage -->
<style>
#cssTest { display: block; }
#cssTest[nonce=abc] { background: url(/security/resources/abe.png); }
</style>
<svg xmlns="http://www.w3.org/2000/svg">
<script nonce="abc" id="cssTest">
async_test(t => {
requestAnimationFrame(t.step_func_done(_ => {
var script = document.querySelector('#cssTest');
var style = getComputedStyle(script);
assert_equals(style['display'], 'block');
assert_equals(style['background-image'], 'none');
}));
}, "Nonces don't leak via CSS side-channels.");
</script>
</svg>
0 ...ript-nonces-hidden.tentative.html.headers → ...ding/svgscript-nonces-hidden.html.headers
View file
Open in desktop
File renamed without changes.