-
Notifications
You must be signed in to change notification settings - Fork 3.9k
Expand file tree
/
Copy pathget-trusted-types-compliant-attribute-value.html
More file actions
91 lines (84 loc) · 2.8 KB
/
Copy pathget-trusted-types-compliant-attribute-value.html
File metadata and controls
91 lines (84 loc) · 2.8 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script';">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="support/namespaces.js"></script>
<link rel="help" href="https://github.com/whatwg/dom/pull/1268">
<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#abstract-opdef-get-trusted-types-compliant-attribute-value">
</head>
<body>
<script>
const kAssertSinkIsElementOnclick = "assertSinkIsElementOnclick";
const kAssertSinkIsHTMLIframeElementSrcdoc = "assertSinkIsHTMLIframeElementSrcdoc";
const kAssertSinkIsHTMLScriptElementSrc = "assertSinkIsHTMLScriptElementSrc";
const kAssertSinkIsSVGScriptElementHref = "assertSinkIsSVGScriptElementHref";
trustedTypes.createPolicy("default", {
createScriptURL: (s, _, sink) => {
if (s == kAssertSinkIsHTMLScriptElementSrc) {
assert_equals(sink, "HTMLScriptElement src");
} else if (s == kAssertSinkIsSVGScriptElementHref) {
assert_equals(sink, "SVGScriptElement href");
}
return s;
},
createHTML: (s, _, sink) => {
if (kAssertSinkIsHTMLIframeElementSrcdoc) {
assert_equals(sink, "HTMLIFrameElement srcdoc");
}
return s;
},
createScript: (s, _, sink) => {
if (s == kAssertSinkIsElementOnclick) {
assert_equals(sink, "Element onclick");
}
return s;
}
});
const kSinkTests = [
{ element: "div",
elementNamespace: NSURI_HTML,
attribute: "onclick",
attributeNamespace: null,
value: kAssertSinkIsElementOnclick,
},
{ element: "iframe",
elementNamespace: NSURI_HTML,
attribute: "srcdoc",
attributeNamespace: null,
value: kAssertSinkIsHTMLIframeElementSrcdoc,
},
{ element: "script",
elementNamespace: NSURI_HTML,
attribute: "src",
attributeNamespace: null,
value: kAssertSinkIsHTMLScriptElementSrc,
},
{ element: "script",
elementNamespace: NSURI_SVG,
attribute: "href",
attributeNamespace: null,
value: kAssertSinkIsSVGScriptElementHref,
},
{ element: "script",
elementNamespace: NSURI_SVG,
attribute: "href",
attributeNamespace: NSURI_XLINK,
value: kAssertSinkIsSVGScriptElementHref,
}
];
for (const testData of kSinkTests) {
test(t => {
const element = document.createElementNS(testData.elementNamespace,
testData.element);
document.body.append(element);
element.setAttributeNS(testData.attributeNamespace, testData.attribute,
testData.value);
}, `Test sink for ${testData.element}.setAttributeNS(${testData.attributeNamespace}, ${testData.attribute})`
);
}
</script>
</body>
</html>