1968383 - Trusted Type: Improve WPT test coverage for script enforcements

Status: RESOLVED FIXED

(Core :: DOM: Security, task)

Comment 1

[Frédéric Wang Nélar]

Attachment: Bug 1968383 - Add more Trusted Type tests for HTML/SVG script enforcements. r=smaug

Comment 2

[Frédéric Wang Nélar]

I just uploaded more tests for script enforcement: https://phabricator.services.mozilla.com/D251094

• WebKit passes all of them except the ones for Node.moveBefore() (not implemented yet)
• Chromium passes all the tests, except the ones were it currently implements Trusted checks not defined in the spec (Node.prepend() etc)

This should cover many cases detected in the WIP patch for bug 1928932.

Comment 3

[Frédéric Wang Nélar]

Attachment: Bug 1968383 Add more Trusted Types enforcement tests testing a source text transformed by the default policy. r=smaug

This verifies that the source text transformed by the default policy is used
for various steps of "prepare the script element":

https://html.spec.whatwg.org/#prepare-the-script-element
PR https://github.com/w3c/trusted-types/pull/579

Comment 4

[Frédéric Wang Nélar]

Attachment: Bug 1968383 Add CSP violation report tests for trusted types script enforcement. r=smaug

This verifies sink mismatch violation report for script enforcement
rules. When a default policy is specified, this is reported as a
script-src-elem violation and the script's text source is actually
not reported to the user.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/1b64fcb3375e
https://hg.mozilla.org/integration/autoland/rev/5966d24c9bcd
Add more Trusted Type tests for HTML/SVG script enforcements. r=smaug
https://github.com/mozilla-firefox/firefox/commit/fa24f94cae55
https://hg.mozilla.org/integration/autoland/rev/b40ba3e6cd66
Add more Trusted Types enforcement tests testing a source text transformed by the default policy. r=smaug
https://github.com/mozilla-firefox/firefox/commit/73060e373402
https://hg.mozilla.org/integration/autoland/rev/06d9162cd877
Add CSP violation report tests for trusted types script enforcement. r=smaug

Comment 6

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/52885 for changes under testing/web-platform/tests

Comment 7

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/5966d24c9bcd
https://hg.mozilla.org/mozilla-central/rev/b40ba3e6cd66
https://hg.mozilla.org/mozilla-central/rev/06d9162cd877

Comment 8

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR was closed without merging

Comment 9

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR was closed without merging

Comment 10

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Upstream PR merged by moz-wptsync-bot