1939805 - (trusted types) Audit test coverage, making sure that the remaining annotations are timeouts, but not failures - part 2

Status: NEW

(Core :: DOM: Security, task)

Description

[Frédéric Wang (:fredw)]

Follow-up of bug 1907849. Remaining work:

1. Audit test coverage ("See also" URLs and dependencies):

• Add WPTs for report-uri with Workers
• Add WPTs for CSP sandbox allow-scripts combined with Trusted Types
• Improve test coverage of sink values
• Examine tests which are commented out in GlobalEventHandlers-onclick.html
• What shoud script element's textContent's sink string be?
• Add test for event handler content attribute handling for false positive event handler attributes
• Add tests for "Should Trusted Type policy creation be blocked by Content Security Policy" in workers
• Add test for policies with disposition=report in workers
• Improve/Rewrite tests checking for CSP violations
• Check WPT content-security-policy/securitypolicyviolation/source-file.html
• Probably worth going again over the different specs and see if anything is missing.

2. Making sure that the remaining annotations are timeouts, but not failures
   • https://searchfox.org/mozilla-central/search?q=&path=meta%2Ftrusted-types%2F*.ini&case=false&regexp=false

Comment 1

[Frédéric Wang (:fredw)]

Remaining failures at https://searchfox.org/mozilla-central/source/testing/web-platform/meta/trusted-types:

• block-string-assignment-to-attribute-via-attribute-node.html: Fixed by bug 1944511
• block-string-assignment-to-Element-setAttribute.html: Fixed by bug 1944511
• block-text-node-insertion-into-script-element.html: likely bug 1928932
• block-text-node-insertion-into-svg-script-element.html: likely bug 1928932
• Element-setAttribute-respects-Elements-node-documents-globals-CSP-after-adoption-from-non-TT-realm.html: bug 1944511 + likely some other actual bug to check.
• HTMLScriptElement-internal-slot.html: likely bug 1928932
• set-event-handlers-content-attributes.tentative.html: Fixed by bug 1944504
• trusted-types-event-handlers.html: Some touch events only work on Android.
• trusted-types-from-literal.tentative.html: This was from https://github.com/w3c/trusted-types/issues/347 but no longer seems part of the spec.
• trusted-types-navigation.html: likely bug 1915629
• TrustedTypePolicyFactory-blocking.tentative.html: Need to check this.
• TrustedTypePolicyFactory-getAttributeType-event-handler-content-attributes.tentative.html: Fixed by bug 1944504

Comment 2

[Frédéric Wang (:fredw)]

Remaining failures at https://searchfox.org/mozilla-central/source/testing/web-platform/meta/trusted-types after 1944511 is fixed:

• block-text-node-insertion-into-script-element.html: likely bug 1928932
• block-text-node-insertion-into-svg-script-element.html: likely bug 1928932
• Element-setAttribute-respects-Elements-node-documents-globals-CSP-after-adoption-from-non-TT-realm.html: Need to check this.
• HTMLScriptElement-internal-slot.html: likely bug 1928932
• trusted-types-event-handlers.html: Some touch events only work on Android.
• trusted-types-from-literal.tentative.html: This was from https://github.com/w3c/trusted-types/issues/347 but no longer seems part of the spec.
• trusted-types-navigation.html: likely bug 1915629
• TrustedTypePolicyFactory-blocking.tentative.html: Need to check this.

Comment 3

[Frédéric Wang (:fredw)]

Updated analysis of remaining failures:

block-text-node-insertion-into-script-element.html: likely bug 1928932
block-text-node-insertion-into-svg-script-element.html: likely bug 1928932
Element-setAttribute-respects-Elements-node-documents-globals-CSP-after-adoption-from-non-TT-realm.html: Incorrect test, see bug 1950626.
HTMLScriptElement-internal-slot.html: likely bug 1928932
trusted-types-event-handlers.html: likely we can just remove the .ini, see bug 1950601.
trusted-types-from-literal.tentative.html: not part of the spec, see bug 1950600.
trusted-types-navigation.html: likely bug 1915629
TrustedTypePolicyFactory-blocking.tentative.html: not part of the spec, see bug 1950598.

Comment 4

[Frédéric Wang (:fredw)]

Remaining failures at https://hg-edge.mozilla.org/mozilla-central/file/579be884653b93d808e818f2f1a9b0a784ed36b1/testing/web-platform/meta/trusted-types:

• HTMLScriptElement-internal-slot.html: bug 1928932
• SVGScriptElement-internal-slot.html.ini: bug 1928932
• TrustedTypePolicyFactory-blocking.tentative.html: bug 1950598
• block-text-node-insertion-into-script-element.html: bug 1928932
• block-text-node-insertion-into-svg-script-element.html: bug 1928932
• trusted-types-from-literal.tentative.html: bug 1950600
• trusted-types-navigation.html: bug 1915629

Comment 5

[Frédéric Wang (:fredw)]

Remaining failures at https://github.com/mozilla-firefox/firefox/tree/8f85432344cfd6d6ae425801b16319f90b687400/testing/web-platform/meta/trusted-types

• beforecreatepolicy not implemented (bug 1950598): TrustedTypePolicyFactory-blocking.tentative.html
• fromLiteral not implemented (bug 1950600): trusted-types-from-literal.tentative.html
• win flaky tests (bug 1986597): block-string-assignment-to-Element-setAttribute.html, set-attributes-no-require-trusted-types.html, trusted-types-reporting-for-ServiceWorker-ServiceWorkerContainer-register.https.html
• Android pre-navigation check failures (bug 1986598): navigate-to-javascript-url-001.html, navigate-to-javascript-url-003.html, navigate-to-javascript-url-004.html, trusted-types-navigation.html

Also relevant tests in content-security-policy are:

• trusted-types-eval (bug 1940493): script-src/script-src-trusted_types_*
• sample in report (bug 1986599): content-security-policy/reporting/report-clips-sample.https

(note that securitypolicyviolation/source-file.html uses Trusted Types to generate a violation, but it's not actually specific to Trusted Types, see bug 1944479)

Comment 6

[Frédéric Wang (:fredw)]

Remaining failures at https://github.com/mozilla-firefox/firefox/tree/7620954e589eb74f20e94e284b250848a159fca0/testing/web-platform/meta/trusted-types

• beforecreatepolicy not implemented (bug 1950598): TrustedTypePolicyFactory-blocking.tentative.html
• fromLiteral not implemented (bug 1950600): trusted-types-from-literal.tentative.html
• Android pre-navigation check failures (bug 1986598): navigate-to-javascript-url-001.html, navigate-to-javascript-url-003.html, navigate-to-javascript-url-004.html, trusted-types-navigation.html

Other relevant tests in content-security-policy we pass:

• script-src/script-src-trusted_types_*
• content-security-policy/reporting/report-clips-sample.https.html

Comment 7

[Frédéric Wang (:fredw)]

Remaining failures at https://github.com/mozilla-firefox/firefox/tree/3c23ce1368431d49bae08e8e211f7f2bf4e4829d/testing/web-platform/meta/trusted-types

• beforecreatepolicy not implemented (bug 1950598): TrustedTypePolicyFactory-blocking.tentative.html
• fromLiteral not implemented (bug 1950600): trusted-types-from-literal.tentative.html

Other relevant tests in content-security-policy we pass:

• script-src/script-src-trusted_types_*
• content-security-policy/reporting/report-clips-sample.https.html

Comment 8

[Frédéric Wang (:fredw)]

TrustedTypePolicyFactory-blocking.tentative.html was removed in https://chromium-review.googlesource.com/c/chromium/src/+/6842536 ; so we are only failing fromLiteral tests.