[HTML5] tests/content/base/test/test_CSP.html fails

RESOLVED FIXED

Status

()

Core
HTML: Parser
P1
normal
RESOLVED FIXED
8 years ago
8 years ago

People

(Reporter: hsivonen, Unassigned)

Tracking

Trunk
x86
Linux
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

tests/content/base/test/test_CSP.html fails with:
img_bad test: http://example.org/tests/content/base/test/file_CSP.sjs?testid=img_bad&type=img/png allowed by csp - got false, expected true
The test was backed out.
Status: NEW → RESOLVED
Last Resolved: 8 years ago
Resolution: --- → WORKSFORME
This was caused by an <img> tag not being closed properly.  I changed the test from this:

<img src="URI" />

to this:

<img src="URI"></img>

And the test passed. Additionally, changing the tag to have no closing tag:

<img src="URI">

Also caused the test to fail. The reason the test was failing is not clear, but I believe it has something to do with a malformed tag ignoring results from nsIContentPolicys.  We will be checking this test in again (but I will fix it to play nice with the current html5 parser). 

The <img> tag is defined as a "void element" by HTML5 (http://www.w3.org/TR/html5/syntax.html#void-elements), which means it doesn't require a closing tag.  Because adding a closing tag makes this test succeed, I think there might be a bug in the parser.

I'll try to create a reduced testcase for this, since I don't think it's a problem isolated to CSP or our test case.
Status: RESOLVED → REOPENED
Resolution: WORKSFORME → ---
(In reply to comment #2)
> This was caused by an <img> tag not being closed properly.  I changed the test
> from this:
> 
> <img src="URI" />
> 
> to this:
> 
> <img src="URI"></img>
> 
> And the test passed.

I see <img ... /> only in file_CSP_main.html, but it seems to me that file gets loaded via XHR on the server side and never directly into e.g. an iframe. Does the file get mangled before it reaches the HTML5 parser?

As far as I can tell, <img>, <img/>, <img /> and <img></img> all create the same DOM in the HTML5 parser.
The XHR (which is just there to provide the CSP HTTP header) doesn't seem to mangle the file at all.  I just verified that the content served is the same as the source.  

One thing that's kind of strange is reproducing the failure doesn't work all the time.  It seems re-running the tests after switching the parser on makes them pass:

1.  Launch CSP tests:
  TEST_PATH=content/base/test/test_CSP.html make -C $OBJDIR mochitest-plain
2.  Watch the 16 tests pass
3.  Load about:config in a new tab and toggle html5.enabled to true
4.  Reload the test page, watch the one test fail.
5.  Reload the test page, watch all 16 pass.

So now I'm confused...
It appears that content policies weren't always consulted when preloading images.  This revision seems to have fixed the problem.  I no longer see the broken unit test using the steps in comment 4.

http://hg.mozilla.org/mozilla-central/rev/02135cbe7432
Status: REOPENED → RESOLVED
Last Resolved: 8 years ago8 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.