1184781 - Additional referrer policy tests

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Franziskus Kiefer [:franziskus]]

More tests for referrer policies [1].

[1] https://w3c.github.io/webappsec/specs/referrer-policy/

Comment 1

[Franziskus Kiefer [:franziskus]]

Attachment: testing img and iframe referrer on redirect delivered with meta or attribute

this requires src and tests from bug 1175736 and bug 1174913

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8636197 [details] [diff] [review]
testing img and iframe referrer on redirect delivered with meta or attribute

Review of attachment 8636197 [details] [diff] [review]:
-----------------------------------------------------------------

r=me, but consider what I've suggested about https in regards of B2g (see comment further down).

::: dom/base/test/referrer_testserver.sjs
@@ +7,5 @@
>  Components.utils.importGlobalProperties(["URLSearchParams"]);
> +const SJS = 'referrer_testserver.sjs?';
> +const BASE_URL = 'example.com/tests/dom/base/test/' + SJS;
> +const SAME_ORIGIN = 'mochi.test:8888/tests/dom/base/test/' + SJS;
> +const OTHER_ORIGIN = 'test1.example.com/tests/dom/base/test/' + SJS;

nit: CROSS_ORIGIN

@@ +185,5 @@
> +    // 302 found, 301 Moved Permanently, 303 See Other, 307 Temporary Redirect
> +    response.setStatusLine('1.1', 302, 'found');
> +    response.setHeader('Location',  scheme + "://" + OTHER_ORIGIN + params.toString(), false);
> +    return;
> +  }

Nit: sometimes you use single quotes, sometimes double quotes when you compare the action against the string literal, please be consistent.

::: dom/base/test/test_referrer_redirect.html
@@ +12,5 @@
> +  -->
> +
> +  <script type="application/javascript;version=1.8">
> +
> +  const sjs = "/tests/dom/base/test/referrer_testserver.sjs?";

why is sjs lower case and all other consts are uppercase?

@@ +33,5 @@
> +        {ATTRIBUTE_POLICY: 'no-referrer',
> +         NAME: 'no-referrer-with-no-meta',
> +         DESC: "no-referrer (img/iframe) with no meta",
> +         RESULT: 'none',
> +         SCHEME: 'http'},

Looks good, but please use curly braces on their own lines:
{
  ATTRIBUTE_POLICY: 'no-referrer',
  NAME: 'no-referrer-with-no-meta',
  DESC: "no-referrer (img/iframe) with no meta",
  RESULT: 'none',
  SCHEME: 'http'
},
{
  bla bla bla

@@ +38,5 @@
> +        {ATTRIBUTE_POLICY: 'no-referrer',
> +         NAME: 'no-referrer-with-no-meta',
> +         DESC: "no-referrer (img/iframe) with no meta",
> +         RESULT: 'none',
> +         SCHEME: 'https'},

Does https work on B2G now? Otherwise you would have to disable that test on some platforms. I wouldn't mind if you just remove the https tests, should have enough test coverage without the different schemes. I'd prefer to have some redirect tests working on B2G then having all of them disabled. Up to you though!

Comment 3

[Franziskus Kiefer [:franziskus]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=8c56fc9b2d16

Comment 4

[Franziskus Kiefer [:franziskus]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=3a84ebba1c18

Comment 5

[Franziskus Kiefer [:franziskus]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=5c5f74a0dc60

Comment 6

[Franziskus Kiefer [:franziskus]]

Attachment: testing img and iframe referrer on redirect delivered with meta or attribute

r+ carries over (rebase & clean up)

https://treeherder.mozilla.org/#/jobs?repo=try&revision=86f130480823

Comment 7

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/8ff628c09e0d

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/8ff628c09e0d

Comment 9

[Firefox Bug Husbandry Bot]

Removing leave-open keyword from resolved bugs, per :sylvestre.