mirror of
https://github.com/servo/servo
synced 2026-05-12 01:46:28 +02:00
82 lines
2.9 KiB
HTML
82 lines
2.9 KiB
HTML
<!DOCTYPE html>
|
|
<script src=/resources/testharness.js></script>
|
|
<script src=/resources/testharnessreport.js></script>
|
|
<script src=/common/security-features/resources/common.js></script>
|
|
<script src=/fetch/sec-metadata/resources/helper.js></script>
|
|
<body>
|
|
<script>
|
|
// These tests reuse the `referrer-policy` infrastructure to load images that
|
|
// encode their request headers in their pixels. Fun stuff!
|
|
promise_test(() =>
|
|
loadImageInWindow(
|
|
"https://{{host}}:{{ports[https][0]}}/common/security-features/subresource/image.py",
|
|
[],
|
|
window)
|
|
.then(img => {
|
|
headers = decodeImageData(extractImageData(img)).headers;
|
|
got = {
|
|
"dest": headers["sec-fetch-dest"],
|
|
"mode": headers["sec-fetch-mode"],
|
|
"site": headers["sec-fetch-site"],
|
|
"user": headers["sec-fetch-user"]
|
|
};
|
|
assert_header_equals(got, {
|
|
"dest": "image",
|
|
"site": "same-origin",
|
|
// Note that we're using `undefined` here, as opposed to "" elsewhere because of the way
|
|
// that `image.py` encodes data.
|
|
"user": undefined,
|
|
"mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin`
|
|
});
|
|
}),
|
|
"Same-origin image");
|
|
|
|
promise_test(() =>
|
|
loadImageInWindow(
|
|
"https://{{hosts[][www]}}:{{ports[https][0]}}/common/security-features/subresource/image.py",
|
|
[],
|
|
window)
|
|
.then(img => {
|
|
headers = decodeImageData(extractImageData(img)).headers;
|
|
got = {
|
|
"dest": headers["sec-fetch-dest"],
|
|
"mode": headers["sec-fetch-mode"],
|
|
"site": headers["sec-fetch-site"],
|
|
"user": headers["sec-fetch-user"]
|
|
};
|
|
assert_header_equals(got, {
|
|
"dest": "image",
|
|
"site": "same-site",
|
|
// Note that we're using `undefined` here, as opposed to "" elsewhere because of the way
|
|
// that `image.py` encodes data.
|
|
"user": undefined,
|
|
"mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin`
|
|
});
|
|
}),
|
|
"Same-site image");
|
|
|
|
promise_test(() =>
|
|
loadImageInWindow(
|
|
"https://{{hosts[alt][www]}}:{{ports[https][0]}}/common/security-features/subresource/image.py",
|
|
[],
|
|
window)
|
|
.then(img => {
|
|
headers = decodeImageData(extractImageData(img)).headers;
|
|
got = {
|
|
"dest": headers["sec-fetch-dest"],
|
|
"mode": headers["sec-fetch-mode"],
|
|
"site": headers["sec-fetch-site"],
|
|
"user": headers["sec-fetch-user"]
|
|
};
|
|
assert_header_equals(got, {
|
|
"dest": "image",
|
|
"site": "cross-site",
|
|
// Note that we're using `undefined` here, as opposed to "" elsewhere because of the way
|
|
// that `image.py` encodes data.
|
|
"user": undefined,
|
|
"mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin`
|
|
});
|
|
}),
|
|
"Cross-site image");
|
|
</script>
|