Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Test some more edge cases for X-Frame-Options #24618

Merged
merged 15 commits into from
Aug 18, 2020
Merged

Test some more edge cases for X-Frame-Options #24618

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
fb41769
Test some more edge cases for X-Frame-Options
domenic Jul 15, 2020
2857fcc
Fix typos in test descriptions per review
domenic Jul 17, 2020
3a6be8a
Explicit quoted value tests
domenic Jul 23, 2020
3989c90
Update for quotes being invalid
domenic Aug 5, 2020
bd999ab
Use a test framework to make the tests easier to write and read
domenic Aug 5, 2020
df97970
Incorporate everything from https://github.com/web-platform-tests/wpt…
domenic Aug 5, 2020
a89394a
Delete extra file
domenic Aug 5, 2020
ebd0f0c
Test ALLOWALL for good measure
domenic Aug 5, 2020
0d9ee15
Test INVALID + DENY
domenic Aug 5, 2020
ee94a9b
Whitespace
domenic Aug 5, 2020
df9f0ff
Helper JS cleanup
domenic Aug 5, 2020
9642279
Even moar test generation
domenic Aug 6, 2020
e5fb76e
Add embed/object TODO
domenic Aug 6, 2020
1e8df76
Some whitespace tests
domenic Aug 6, 2020
4ece5d1
Move to Chrome/Safari processing model. Even more tests.
domenic Aug 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions html/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,3 +17,4 @@ For historical reasons, parts of HTML have their own directories:
* [/websockets](/websockets)
* [/webstorage](/webstorage)
* [/workers](/workers)
* [/x-frame-options](/x-frame-options)
3 changes: 2 additions & 1 deletion x-frame-options/META.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
spec: https://tools.ietf.org/html/rfc7034
spec: https://html.spec.whatwg.org/#the-x-frame-options-header
suggested_reviewers:
- annevk
- mikewest
- domenic
5 changes: 3 additions & 2 deletions x-frame-options/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
This directory contains tests for
[HTTP Header Field X-Frame-Options](https://tools.ietf.org/html/rfc7034).
This directory contains tests for [`X-Frame-Options`](https://html.spec.whatwg.org/#the-x-frame-options-header).

Currently it only tests `<iframe>`. It would be nice to test `<embed>` and `<object>` as well.
43 changes: 43 additions & 0 deletions x-frame-options/deny.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
<!DOCTYPE html>
<meta charset="utf-8">
<title>X-Frame-Options variations of DENY</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="./support/helper.sub.js"></script>

<body>
<script>
"use strict";

xfo_simple_tests({
headerValue: `DENY`,
sameOriginAllowed: false,
crossOriginAllowed: false
});

xfo_simple_tests({
headerValue: `denY`,
sameOriginAllowed: false,
crossOriginAllowed: false
});

xfo_simple_tests({
headerValue: ` DENY `,
sameOriginAllowed: false,
crossOriginAllowed: false
});

xfo_simple_tests({
headerValue: `DENY`,
cspValue: `default-src 'self'`,
sameOriginAllowed: false,
crossOriginAllowed: false
});

xfo_simple_tests({
headerValue: `DENY`,
cspValue: `frame-ancestors 'self'`,
sameOriginAllowed: true,
crossOriginAllowed: false
});
</script>
61 changes: 0 additions & 61 deletions x-frame-options/deny.sub.html
View file
Open in desktop

This file was deleted.

23 changes: 23 additions & 0 deletions x-frame-options/get-decode-split.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
<!DOCTYPE html>
<meta charset="utf-8">
<title>X-Frame-Options headers use the get, decode, and split algorithm</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="support/helper.sub.js"></script>

<body>
<script>
"use strict";

xfo_simple_tests({
headerValue: `,SAMEORIGIN,,DENY,`,
sameOriginAllowed: false,
crossOriginAllowed: false
});

xfo_simple_tests({
headerValue: ` SAMEORIGIN, DENY`,
sameOriginAllowed: false,
crossOriginAllowed: false
});
</script>
59 changes: 59 additions & 0 deletions x-frame-options/invalid.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
<!DOCTYPE html>
<meta charset="utf-8">
<title>X-Frame-Options invalid values</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="./support/helper.sub.js"></script>

<body>
<script>
"use strict";

xfo_simple_tests({
headerValue: `INVALID`,
sameOriginAllowed: true,
crossOriginAllowed: true
});

xfo_simple_tests({
headerValue: `ALLOW-FROM https://example.com/`,
sameOriginAllowed: true,
crossOriginAllowed: true
});

xfo_simple_tests({
headerValue: `ALLOW-FROM=https://example.com/`,
sameOriginAllowed: true,
crossOriginAllowed: true
});

xfo_simple_tests({
headerValue: `ALLOWALL`,
sameOriginAllowed: true,
crossOriginAllowed: true
});

xfo_simple_tests({
headerValue: `"DENY"`,
sameOriginAllowed: true,
crossOriginAllowed: true
});

xfo_simple_tests({
headerValue: `"SAMEORIGIN"`,
sameOriginAllowed: true,
crossOriginAllowed: true
});

xfo_simple_tests({
headerValue: `"SAMEORIGIN,DENY"`,
sameOriginAllowed: true,
crossOriginAllowed: true
});

xfo_simple_tests({
headerValue: ``,
sameOriginAllowed: true,
crossOriginAllowed: true
});
</script>
84 changes: 0 additions & 84 deletions x-frame-options/invalid.sub.html
View file
Open in desktop

This file was deleted.

Loading