ChangeLog

2016-02-24  Daniel Bates  <dabates@apple.com>

        CSP: Make SecurityPolicyViolationEvent more closely conform to CSP spec and enable it by default

        https://bugs.webkit.org/show_bug.cgi?id=154522

        <rdar://problem/24762078>

        Reviewed by NOBODY (OOPS!).

        Include attributes statusCode and columnNumber in a dispatched SecurityPolicyViolationEvent and

        as part of the SecurityPolicyViolationEventInit dictionary as per section Violation DOM Events

        of the Content Security Policy Level 3 spec., <https://w3c.github.io/webappsec-csp/> (24 February 2016).

        Additionally, enable dispatching of this event when a Content Security Policy violation occurs regardless

        of whether ENABLE(CSP_NEXT) is enabled.

        Test: http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html

        * WebCore.xcodeproj/project.pbxproj: Add files JSSecurityPolicyViolationEvent.{cpp, h}.

        * dom/EventNames.in: Enable support for SecurityPolicyViolationEvent unconditionally.

        * dom/SecurityPolicyViolationEvent.h: Remove ENABLE(CSP_NEXT)-guard so that we compile this

        code unconditionally. Modified SecurityPolicyViolationEventInit and SecurityPolicyViolationEvent

        to support attributes statusCode and columnNumebr.

        * dom/SecurityPolicyViolationEvent.idl: Add attributes statusCode and columnNumber.

        * page/csp/ContentSecurityPolicy.cpp:

        (WebCore::ContentSecurityPolicy::reportViolation): Modified to both dispatch a SecurityPolicyViolationEvent

        and send a violation report (if applicable).

2016-02-23  Daniel Bates  <dabates@apple.com>

        CSP: Enable base-uri directive by default

Source/WebCore/WebCore.xcodeproj/project.pbxproj

		CECADFCD1537791D00E37068 /* TextInsertionBaseCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CECADFCB1537791D00E37068 /* TextInsertionBaseCommand.cpp */; };

		CECADFCE1537791D00E37068 /* TextInsertionBaseCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = CECADFCC1537791D00E37068 /* TextInsertionBaseCommand.h */; };

		CECCFC3B141973D5002A0AC1 /* DecodeEscapeSequences.h in Headers */ = {isa = PBXBuildFile; fileRef = CECCFC3A141973D5002A0AC1 /* DecodeEscapeSequences.h */; };

6236 CED06AD01C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CED06ACE1C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.cpp */; };

6237 CED06AD11C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = CED06ACF1C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.h */; };

		CEDA12D7152CA1CB00D9E08D /* AlternativeTextClient.h in Headers */ = {isa = PBXBuildFile; fileRef = CEDA12D6152CA1CB00D9E08D /* AlternativeTextClient.h */; settings = {ATTRIBUTES = (Private, ); }; };

		CEE27ACB1BBB53A20072400A /* pthreadSPI.h in Headers */ = {isa = PBXBuildFile; fileRef = CEE27ACA1BBB53A20072400A /* pthreadSPI.h */; settings = {ATTRIBUTES = (Private, ); }; };

		CEEFCD7919DB31F7003876D7 /* MediaResourceLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CEEFCD7719DB31F7003876D7 /* MediaResourceLoader.cpp */; };

		CECADFCB1537791D00E37068 /* TextInsertionBaseCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextInsertionBaseCommand.cpp; sourceTree = "<group>"; };

		CECADFCC1537791D00E37068 /* TextInsertionBaseCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextInsertionBaseCommand.h; sourceTree = "<group>"; };

		CECCFC3A141973D5002A0AC1 /* DecodeEscapeSequences.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecodeEscapeSequences.h; sourceTree = "<group>"; };

14236 CED06ACE1C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSecurityPolicyViolationEvent.cpp; sourceTree = "<group>"; };

14237 CED06ACF1C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSecurityPolicyViolationEvent.h; sourceTree = "<group>"; };

		CEDA12D6152CA1CB00D9E08D /* AlternativeTextClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AlternativeTextClient.h; sourceTree = "<group>"; };

		CEE27ACA1BBB53A20072400A /* pthreadSPI.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = pthreadSPI.h; sourceTree = "<group>"; };

		CEEC6034187DD962003E43BB /* TextTrackRepresentationIOS.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextTrackRepresentationIOS.h; sourceTree = "<group>"; };

				E1284BAF10449FFA00EAEB52 /* JSPageTransitionEvent.h */,

				5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */,

				5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */,

20905 CED06ACE1C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.cpp */,

20906 CED06ACF1C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.h */,

				933A14B60B7D1D5200A53FFD /* JSTextEvent.cpp */,

				933A14B70B7D1D5200A53FFD /* JSTextEvent.h */,

				0FDA7C10188322EB00C954B5 /* JSTouch.cpp */,

				FDA15ECE12B03F61003A583A /* JSScriptProcessorNode.h in Headers */,

				9FA37EFB1172FDA600C4CD55 /* JSScriptProfile.h in Headers */,

				9FA37EFD1172FDA600C4CD55 /* JSScriptProfileNode.h in Headers */,

26736 CED06AD11C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.h in Headers */,

				9BDA64D81B975CF2009C4387 /* JSShadowRoot.h in Headers */,

				CD9DE17B17AAC75B00EA386D /* JSSourceBuffer.h in Headers */,

				CD9DE17D17AAC75B00EA386D /* JSSourceBufferList.h in Headers */,

				FDA15ECD12B03F61003A583A /* JSScriptProcessorNode.cpp in Sources */,

				9FA37EFA1172FDA600C4CD55 /* JSScriptProfile.cpp in Sources */,

				9FA37EFC1172FDA600C4CD55 /* JSScriptProfileNode.cpp in Sources */,

30484 CED06AD01C77754800FDFAF1 /* JSSecurityPolicyViolationEvent.cpp in Sources */,

				9BDA64D71B975CE5009C4387 /* JSShadowRoot.cpp in Sources */,

				CD9DE17A17AAC75B00EA386D /* JSSourceBuffer.cpp in Sources */,

				CD9DE17C17AAC75B00EA386D /* JSSourceBufferList.cpp in Sources */,

Source/WebCore/dom/EventNames.in

@@MediaKeyNeededEvent conditional=ENCRYPTED_MEDIA_V2

TrackEvent conditional=VIDEO_TRACK

AutocompleteErrorEvent conditional=REQUEST_AUTOCOMPLETE

CSSFontFaceLoadEvent conditional=FONT_LOAD_EVENTS

60 SecurityPolicyViolationEvent ~~conditional=CSP_NEXT~~

60SecurityPolicyViolationEvent

UIRequestEvent conditional=INDIE_UI

GestureEvent conditional=IOS_GESTURE_EVENTS|MAC_GESTURE_EVENTS

WebKitPlaybackTargetAvailabilityEvent conditional=WIRELESS_PLAYBACK_TARGET

Source/WebCore/dom/SecurityPolicyViolationEvent.h

11/*

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

#ifndef SecurityPolicyViolationEvent_h

#define SecurityPolicyViolationEvent_h

28 #if ENABLE(CSP_NEXT)

29

#include "Event.h"

namespace WebCore {

@@struct SecurityPolicyViolationEventInit : public EventInit {

    String effectiveDirective;

    String originalPolicy;

    String sourceFile;

41 unsigned short statusCode { 0 };

4242 int lineNumber { 0 };

43 int columnNumber { 0 };

};

class SecurityPolicyViolationEvent final : public Event {

public:

47 static Ref<SecurityPolicyViolationEvent> create(const AtomicString& type, bool canBubble, bool cancelable, const String& documentURI, const String& referrer, const String& blockedURI, const String& violatedDirective, const String& effectiveDirective, const String& originalPolicy, const String& sourceFile, int lineNumber)

48 static Ref<SecurityPolicyViolationEvent> create(const AtomicString& type, bool canBubble, bool cancelable, const String& documentURI, const String& referrer, const String& blockedURI, const String& violatedDirective, const String& effectiveDirective, const String& originalPolicy, const String& sourceFile, unsigned short statusCode, int lineNumber, int columnNumber)

4849 {

49 return adoptRef(*new SecurityPolicyViolationEvent(type, canBubble, cancelable, documentURI, referrer, blockedURI, violatedDirective, effectiveDirective, originalPolicy, sourceFile, lineNumber));

50 return adoptRef(*new SecurityPolicyViolationEvent(type, canBubble, cancelable, documentURI, referrer, blockedURI, violatedDirective, effectiveDirective, originalPolicy, sourceFile, statusCode, lineNumber, columnNumber));

    }

    static Ref<SecurityPolicyViolationEvent> createForBindings()

@@public:

    const String& effectiveDirective() const { return m_effectiveDirective; }

    const String& originalPolicy() const { return m_originalPolicy; }

    const String& sourceFile() const { return m_sourceFile; }

70 unsigned short statusCode() const { return m_statusCode; }

6971 int lineNumber() const { return m_lineNumber; }

72 int columnNumber() const { return m_columnNumber; }

    virtual EventInterface eventInterface() const { return SecurityPolicyViolationEventInterfaceType; }

@@private:

    {

    }

78 SecurityPolicyViolationEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& documentURI, const String& referrer, const String& blockedURI, const String& violatedDirective, const String& effectiveDirective, const String& originalPolicy, const String& sourceFile, int lineNumber)

81 SecurityPolicyViolationEvent(const AtomicString& type, bool canBubble, bool cancelable, const String& documentURI, const String& referrer, const String& blockedURI, const String& violatedDirective, const String& effectiveDirective, const String& originalPolicy, const String& sourceFile, unsigned short statusCode, int lineNumber, int columnNumber)

        : Event(type, canBubble, cancelable)

        , m_documentURI(documentURI)

        , m_referrer(referrer)

@@private:

        , m_effectiveDirective(effectiveDirective)

        , m_originalPolicy(originalPolicy)

        , m_sourceFile(sourceFile)

90 , m_statusCode(statusCode)

8791 , m_lineNumber(lineNumber)

92 , m_columnNumber(columnNumber)

    {

    }

@@private:

        , m_effectiveDirective(initializer.effectiveDirective)

        , m_originalPolicy(initializer.originalPolicy)

        , m_sourceFile(initializer.sourceFile)

105 , m_statusCode(initializer.statusCode)

100106 , m_lineNumber(initializer.lineNumber)

107 , m_columnNumber(initializer.columnNumber)

    {

    }

@@private:

    String m_effectiveDirective;

    String m_originalPolicy;

    String m_sourceFile;

118 unsigned short m_statusCode;

111119 int m_lineNumber;

120 int m_columnNumber;

};

} // namespace WebCore

116 #endif // ENABLE(CSP_NEXT)

117

118125#endif // SecurityPolicyViolationEvent_h

Source/WebCore/dom/SecurityPolicyViolationEvent.idl

11/*

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 */

[

26 Conditional=CSP_NEXT,

    ConstructorTemplate=Event,

] interface SecurityPolicyViolationEvent : Event {

    [InitializedByEventConstructor] readonly attribute DOMString documentURI;

    [InitializedByEventConstructor] readonly attribute DOMString effectiveDirective;

    [InitializedByEventConstructor] readonly attribute DOMString originalPolicy;

    [InitializedByEventConstructor] readonly attribute DOMString sourceFile;

36 [InitializedByEventConstructor] readonly attribute long lineNumber;

    [InitializedByEventConstructor] readonly attribute unsigned short statusCode;

    [InitializedByEventConstructor] readonly attribute long lineNumber;

    [InitializedByEventConstructor] readonly attribute long columnNumber;

3739};

Source/WebCore/page/csp/ContentSecurityPolicy.cpp

@@void ContentSecurityPolicy::reportViolation(const String& directiveText, const S

    if (!frame)

        return;

#if ENABLE(CSP_NEXT)

    if (experimentalFeaturesEnabled()) {

        // FIXME: This code means that we're gathering information like line numbers twice. Once we can bring this out from behind the flag, we should reuse the data gathered here when generating the JSON report below.

        String documentURI = document.url().string();

        String referrer = document.referrer();

        String blockedURI = stripURLForUseInReport(document, blockedURL);

        String violatedDirective = directiveText;

        String originalPolicy = header;

        String sourceFile = String();

        int lineNumber = 0;

        Ref<ScriptCallStack> stack = createScriptCallStack(JSMainThreadExecState::currentState(), 2);

        const ScriptCallFrame* callFrame = stack->firstNonNativeCallFrame();

        if (callFrame && callFrame->lineNumber()) {

            URL source = URL(URL(), callFrame->sourceURL());

            sourceFile = stripURLForUseInReport(document, source);

            lineNumber = callFrame->lineNumber();

        }

        document.enqueueDocumentEvent(SecurityPolicyViolationEvent::create(eventNames().securitypolicyviolationEvent, false, false, documentURI, referrer, blockedURI, violatedDirective, effectiveDirective, originalPolicy, sourceFile, lineNumber));

    String documentURI = document.url().strippedForUseAsReferrer();

    String referrer = document.referrer();

    String blockedURI = stripURLForUseInReport(document, blockedURL);

    String violatedDirective = directiveText;

    String originalPolicy = header;

    ASSERT(document.loader());

    unsigned short statusCode = document.url().protocolIs("http") && document.loader() ? document.loader()->response().httpStatusCode() : 0;

    String sourceFile;

    int lineNumber;

    int columnNumber;

    RefPtr<ScriptCallStack> stack = createScriptCallStack(JSMainThreadExecState::currentState(), 2);

    const ScriptCallFrame* callFrame = stack->firstNonNativeCallFrame();

    if (callFrame && callFrame->lineNumber()) {

        sourceFile = stripURLForUseInReport(document, URL(URL(), callFrame->sourceURL()));

        lineNumber = callFrame->lineNumber();

        columnNumber = callFrame->columnNumber();

    } else {

        lineNumber = 0;

        columnNumber = 0;

365365 }

366 #endif

367366

    // 1. Dispatch violation event.

    bool canBubble = false;

    bool cancelable = false;

    document.enqueueDocumentEvent(SecurityPolicyViolationEvent::create(eventNames().securitypolicyviolationEvent, canBubble, cancelable, documentURI, referrer, blockedURI, violatedDirective, effectiveDirective, originalPolicy, sourceFile, statusCode, lineNumber, columnNumber));

    // 2. Send violation report (if applicable).

    if (reportURIs.isEmpty())

        return;

@@void ContentSecurityPolicy::reportViolation(const String& directiveText, const S

    // harmless information.

    RefPtr<InspectorObject> cspReport = InspectorObject::create();

382 cspReport->setString(ASCIILiteral("document-uri"), document~~.url().strippedForUseAsReferrer()~~);

383 cspReport->setString(ASCIILiteral("referrer"), ~~document.~~referrer());

387 cspReport->setString(ASCIILiteral("document-uri"), documentURI);

388 cspReport->setString(ASCIILiteral("referrer"), referrer);

384389 cspReport->setString(ASCIILiteral("violated-directive"), directiveText);

385390 cspReport->setString(ASCIILiteral("effective-directive"), effectiveDirective);

    cspReport->setString(ASCIILiteral("original-policy"), header);

    cspReport->setString(ASCIILiteral("blocked-uri"), stripURLForUseInReport(document, blockedURL));

    ASSERT(document.loader());

    cspReport->setInteger(ASCIILiteral("status-code"), document.url().protocolIs("http") && document.loader() ? document.loader()->response().httpStatusCode() : 0);

    RefPtr<ScriptCallStack> stack = createScriptCallStack(JSMainThreadExecState::currentState(), 2);

    const ScriptCallFrame* callFrame = stack->firstNonNativeCallFrame();

    if (callFrame && callFrame->lineNumber()) {

        URL source = URL(URL(), callFrame->sourceURL());

        cspReport->setString(ASCIILiteral("source-file"), stripURLForUseInReport(document, source));

        cspReport->setInteger(ASCIILiteral("line-number"), callFrame->lineNumber());

        cspReport->setInteger(ASCIILiteral("column-number"), callFrame->columnNumber());

    cspReport->setString(ASCIILiteral("original-policy"), originalPolicy);

    cspReport->setString(ASCIILiteral("blocked-uri"), blockedURI);

    cspReport->setInteger(ASCIILiteral("status-code"), statusCode);

    if (!sourceFile.isNull()) {

        cspReport->setString(ASCIILiteral("source-file"), sourceFile);

        cspReport->setInteger(ASCIILiteral("line-number"), lineNumber);

        cspReport->setInteger(ASCIILiteral("column-number"), columnNumber);

    }

    RefPtr<InspectorObject> reportObject = InspectorObject::create();

    reportObject->setObject(ASCIILiteral("csp-report"), cspReport.release());

    RefPtr<FormData> report = FormData::create(reportObject->toJSONString().utf8());

405

    for (const auto& url : reportURIs)

        PingLoader::sendViolationReport(*frame, document.completeURL(url), report.copyRef(), ViolationReportType::ContentSecurityPolicy);

}

LayoutTests/ChangeLog

2016-02-24  Daniel Bates  <dabates@apple.com>

        CSP: Make SecurityPolicyViolationEvent more closely conform to CSP spec and enable it by default

        https://bugs.webkit.org/show_bug.cgi?id=154522

        <rdar://problem/24762078>

        Reviewed by NOBODY (OOPS!).

        Add new test http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html

        to ensure that SecurityPolicyViolationEvent.statusCode is 0 when dispatched for a violation on an HTTPS-served

        document per section Reporting of the Content Security Policy 2.0 spec, <https://www.w3.org/TR/2015/CR-CSP2-20150721/>.

        Update existing test results and mark more tests as PASS in file LayoutTests/TestExpectations.

        * TestExpectations: Mark tests http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation*.html as PASS

        so that we run them.

        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-basics-expected.txt: Update expected result to

        reflect failing sub-test. We do not support the experimental JavaScript event listener onsecuritypolicyviolation when

        building with ENABLE(CSP_NEXT) disabled.

        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt: Update line and column numbers.

        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt: Ditto.

        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html: Ditto.

        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html: Ditto.

        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt: Ditto.

        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt: Ditto.

        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html: Ditto.

        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https-expected.txt: Added.

        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html: Added.

        * http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html: Update line and column numbers.

        * js/dom/global-constructors-attributes-expected.txt: Update expected results now that we expose SecurityPolicyViolationEvent.

        * platform/efl/js/dom/global-constructors-attributes-expected.txt: Ditto.

        * platform/mac-mavericks/js/dom/global-constructors-attributes-expected.txt: Ditto.

        * platform/mac-yosemite/js/dom/global-constructors-attributes-expected.txt: Ditto.

        * platform/mac/js/dom/global-constructors-attributes-expected.txt: Ditto.

2016-02-23  Daniel Bates  <dabates@apple.com>

        CSP: Enable base-uri directive by default

LayoutTests/TestExpectations

@@http/tests/security/contentSecurityPolicy/1.1/base-uri-allow.html [ Pass ]

http/tests/security/contentSecurityPolicy/1.1/base-uri-default-ignored.html [ Pass ]

http/tests/security/contentSecurityPolicy/1.1/base-uri-deny.html [ Pass ]

http/tests/security/contentSecurityPolicy/1.1/report-uri-effective-directive.php [ Pass ]

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-basics.html [ Pass ]

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html [ Pass ]

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html [ Pass ]

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html [ Pass ]

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html [ Pass ]

http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html [ Pass ]

webkit.org/b/154203 http/tests/security/contentSecurityPolicy/1.1/frame-ancestors/frame-ancestors-overrides-xfo.html

webkit.org/b/154203 http/tests/security/contentSecurityPolicy/1.1/scripthash-default-src.html

webkit.org/b/154203 http/tests/security/contentSecurityPolicy/1.1/stylehash-default-src.html

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-basics-expected.txt

@@Check that a SecurityPolicyViolationEvent handler exists, and that events can be

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

6 P~~ASS~~ typeof document.onsecuritypolicyviolation is "object"

6FAIL typeof document.onsecuritypolicyviolation should be object. Was undefined.

PASS typeof SecurityPolicyViolationEvent is "function"

PASS typeof window.e is "object"

PASS window.e.documentURI is "documentURIValue"

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-expected.txt

@@PASS window.e.violatedDirective is "img-src 'none'"

PASS window.e.effectiveDirective is "img-src"

PASS window.e.originalPolicy is "img-src 'none'"

PASS window.e.sourceFile is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html"

16 PASS window.e.lineNumber is 23

17 PASS window.e.columnNumber is 21

16PASS window.e.lineNumber is 25

17PASS window.e.columnNumber is 16

PASS window.e.statusCode is 200

PASS successfullyParsed is true

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script-expected.txt

@@PASS window.e.effectiveDirective is "img-src"

PASS window.e.originalPolicy is "img-src 'none'"

PASS window.e.sourceFile is "http://localhost:8000"

PASS window.e.lineNumber is 3

17 PASS window.e.columnNumber is 7

17PASS window.e.columnNumber is 2

PASS window.e.statusCode is 200

PASS successfullyParsed is true

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image-from-script.html

            'originalPolicy': 'img-src \'none\'',

            'sourceFile': 'http://localhost:8000',

            'lineNumber': 3,

19 'columnNumber': 7,

19 'columnNumber': 2,

            'statusCode': 200,

        };

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-cross-origin-image.html

            'effectiveDirective': 'img-src',

            'originalPolicy': 'img-src \'none\'',

            'sourceFile': document.location.toString(),

18 'lineNumber': 23,

19 'columnNumber': 21,

18 'lineNumber': 25,

19 'columnNumber': 16,

            'statusCode': 200,

        };

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-expected.txt

@@PASS window.e.violatedDirective is "img-src 'none'"

PASS window.e.effectiveDirective is "img-src"

PASS window.e.originalPolicy is "img-src 'none'"

PASS window.e.sourceFile is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"

16 PASS window.e.lineNumber is 23

17 PASS window.e.columnNumber is 21

16PASS window.e.lineNumber is 25

17PASS window.e.columnNumber is 16

PASS window.e.statusCode is 200

PASS successfullyParsed is true

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script-expected.txt

@@PASS window.e.effectiveDirective is "img-src"

PASS window.e.originalPolicy is "img-src 'none'"

PASS window.e.sourceFile is "http://127.0.0.1:8000/security/contentSecurityPolicy/resources/inject-image.js"

PASS window.e.lineNumber is 3

17 PASS window.e.columnNumber is 7

17PASS window.e.columnNumber is 2

PASS window.e.statusCode is 200

PASS successfullyParsed is true

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-from-script.html

            'originalPolicy': 'img-src \'none\'',

            'sourceFile': 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/inject-image.js',

            'lineNumber': 3,

19 'columnNumber': 7,

19 'columnNumber': 2,

            'statusCode': 200,

        };

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https-expected.txt

CONSOLE MESSAGE: Refused to load the image 'http://127.0.0.1:8000/security/resources/abe.png' because it violates the following Content Security Policy directive: "img-src 'none'".

--------

Frame: '<!--framePath //<!--frame0-->-->'

--------

Check that a SecurityPolicyViolationEvent is fired upon blocking an image.

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

Kicking off the tests:

PASS window.e.documentURI is "https://127.0.0.1:8443/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"

PASS window.e.referrer is "http://127.0.0.1:8000/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html"

FAIL window.e.blockedURI should be http://127.0.0.1:8000/security/resources/abe.png. Was http://127.0.0.1:8000.

PASS window.e.violatedDirective is "img-src 'none'"

PASS window.e.effectiveDirective is "img-src"

PASS window.e.originalPolicy is "img-src 'none'"

PASS window.e.sourceFile is "https://127.0.0.1:8443/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"

PASS window.e.lineNumber is 25

PASS window.e.columnNumber is 16

PASS window.e.statusCode is 0

PASS successfullyParsed is true

TEST COMPLETE

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image-https.html

<!DOCTYPE html>

<html>

<head>

<script>

if (window.testRunner) {

    testRunner.dumpAsText();

    testRunner.dumpChildFramesAsText();

    testRunner.waitUntilDone();

}

</script>

</head>

<body>

<iframe src="https://127.0.0.1:8443/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html"></iframe>

</body>

</html>

LayoutTests/http/tests/security/contentSecurityPolicy/1.1/securitypolicyviolation-block-image.html

            'effectiveDirective': 'img-src',

            'originalPolicy': 'img-src \'none\'',

            'sourceFile': document.location.toString(),

            'lineNumber': 23,

            'columnNumber': 21,

            'statusCode': 200,

            'lineNumber': 25,

            'columnNumber': 16,

            'statusCode': document.location.protocol === 'http:' ? 200 : 0,

        };

        function run() {

            var img = document.createElement('img');

25 img.src = '/security/resources/abe.png';

25 img.src = 'http://127.0.0.1:8000/security/resources/abe.png';

            document.body.appendChild(img);

        }

    </script>

LayoutTests/js/dom/global-constructors-attributes-expected.txt