Skip to content

Commit c732e39

Browse files
fred-wangmoz-wptsync-bot
fred-wang
authored and
moz-wptsync-bot
committed
Bug 1940948 [wpt PR 50022] - Add test for innerHTML, innerText, textContent, text and src IDL prop…, a=testonly
Automatic update from web-platform-tests Add test for innerHTML, innerText, textContent, text and src IDL prop… (#50022) These properties allow to change a script text or URL and need special attention. Existing tests for them are scattered over multiple files and check many other things. This new test focuses on checking whether setting these properties to a plain string would be blocked by a default policy, and what trusted type name and sink names would be passed to the corresponding create callback. We try setting the properties on HTMLDivElement, HTMLScriptElement or SVGScriptElement when they exist. -- wpt-commits: 17ba65b32982b4a553977ae1800a859fc3105e92 wpt-pr: 50022
1 parent e07112d commit c732e39

File tree

1 file changed

+124
-0
lines changed

1 file changed

+124
-0
lines changed

‎testing/web-platform/tests/trusted-types/block-string-assignment-to-text-and-url-sinks.html

+124
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
<!DOCTYPE html>
2+
<script src="/resources/testharness.js"></script>
3+
<script src="/resources/testharnessreport.js"></script>
4+
<script src="support/namespaces.js"></script>
5+
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script';">
6+
<script>
7+
const plain_string = "Hello World!";
8+
9+
let divElement;
10+
let scriptElement;
11+
let svgScriptElement;
12+
let seenTrustedTypeName;
13+
let seenSinkName;
14+
function resetGlobalVariables() {
15+
divElement = document.createElement('div');
16+
scriptElement = document.createElement('script');
17+
svgScriptElement = document.createElementNS(NSURI_SVG, 'script');
18+
seenTrustedTypeName = undefined;
19+
seenSinkName = undefined;
20+
}
21+
resetGlobalVariables();
22+
23+
function createTrustedType(value, trustedTypeName, sinkName) {
24+
seenTrustedTypeName = trustedTypeName;
25+
seenSinkName = sinkName;
26+
}
27+
window.trustedTypes.createPolicy("default", {
28+
createHTML: createTrustedType,
29+
createScript: createTrustedType,
30+
createScriptURL: createTrustedType,
31+
});
32+
33+
// Basic test for the Element.innerHTML Trusted Type sink.
34+
test(t => {
35+
t.add_cleanup(resetGlobalVariables);
36+
assert_throws_js(TypeError, _ => { divElement.innerHTML = plain_string; });
37+
assert_equals(seenTrustedTypeName, "TrustedHTML");
38+
assert_equals(seenSinkName, "Element innerHTML");
39+
}, "Setting HTMLDivElement.innerHTML to a plain string");
40+
41+
// Same but on HTMLScriptElement (should have the same sink name).
42+
test(t => {
43+
t.add_cleanup(resetGlobalVariables);
44+
assert_throws_js(TypeError, _ => { scriptElement.innerHTML = plain_string; });
45+
assert_equals(seenTrustedTypeName, "TrustedHTML");
46+
assert_equals(seenSinkName, "Element innerHTML");
47+
}, "Setting HTMLScriptElement.innerHTML to a plain string");
48+
49+
// Same but on SVGScriptElement (should have the same sink name).
50+
test(t => {
51+
t.add_cleanup(resetGlobalVariables);
52+
assert_throws_js(TypeError, _ => { svgScriptElement.innerHTML = plain_string; });
53+
assert_equals(seenTrustedTypeName, "TrustedHTML");
54+
assert_equals(seenSinkName, "Element innerHTML");
55+
}, "Setting SVGScriptElement.innerHTML to a plain string");
56+
57+
// innerText is not a Trusted Type sink for HTMLDivElement.
58+
test(t => {
59+
t.add_cleanup(resetGlobalVariables);
60+
divElement.innerText = plain_string;
61+
assert_equals(seenTrustedTypeName, undefined);
62+
assert_equals(seenSinkName, undefined);
63+
assert_equals(divElement.innerText, plain_string);
64+
}, "Setting HTMLDivElement.innerText to a plain string");
65+
66+
// However, innerText is a sink for HTMLScriptElement.
67+
test(t => {
68+
t.add_cleanup(resetGlobalVariables);
69+
assert_throws_js(TypeError, _ => { scriptElement.innerText = plain_string; });
70+
assert_equals(seenTrustedTypeName, "TrustedScript");
71+
assert_equals(seenSinkName, "HTMLScriptElement innerText");
72+
}, "Setting HTMLScriptElement.innerText to a plain string");
73+
74+
// innerText is not a Trusted Type sink for SVGScriptElement.
75+
test(t => {
76+
t.add_cleanup(resetGlobalVariables);
77+
svgScriptElement.innerText = plain_string;
78+
assert_equals(seenTrustedTypeName, undefined);
79+
assert_equals(seenSinkName, undefined);
80+
assert_equals(svgScriptElement.innerText, plain_string);
81+
}, "Setting SVGScriptElement.innerText to a plain string");
82+
83+
// textContent is not a Trusted Type sink for HTMLDivElement.
84+
test(t => {
85+
t.add_cleanup(resetGlobalVariables);
86+
divElement.textContent = plain_string;
87+
assert_equals(seenTrustedTypeName, undefined);
88+
assert_equals(seenSinkName, undefined);
89+
assert_equals(divElement.textContent, plain_string);
90+
}, "Setting HTMLDivElement.textContent to a plain string");
91+
92+
// However, textContent is a sink for HTMLScriptElement.
93+
test(t => {
94+
t.add_cleanup(resetGlobalVariables);
95+
assert_throws_js(TypeError, _ => { scriptElement.textContent = plain_string; });
96+
assert_equals(seenTrustedTypeName, "TrustedScript");
97+
assert_equals(seenSinkName, "HTMLScriptElement textContent");
98+
}, "Setting HTMLScriptElement.textContent to a plain string");
99+
100+
// textContent is not a Trusted Type sink for SVGScriptElement.
101+
test(t => {
102+
t.add_cleanup(resetGlobalVariables);
103+
svgScriptElement.textContent = plain_string;
104+
assert_equals(seenTrustedTypeName, undefined);
105+
assert_equals(seenSinkName, undefined);
106+
assert_equals(svgScriptElement.textContent, plain_string);
107+
}, "Setting SVGScriptElement.textContent to a plain string");
108+
109+
// Basic test for the HTMLScriptElement.text Trusted Type sink.
110+
test(t => {
111+
t.add_cleanup(resetGlobalVariables);
112+
assert_throws_js(TypeError, _ => { scriptElement.text = plain_string; });
113+
assert_equals(seenTrustedTypeName, "TrustedScript");
114+
assert_equals(seenSinkName, "HTMLScriptElement text");
115+
}, "Setting HTMLScriptElement.text to a plain string");
116+
117+
// Basic test for the HTMLScriptElement.src Trusted Type sink.
118+
test(t => {
119+
t.add_cleanup(resetGlobalVariables);
120+
assert_throws_js(TypeError, _ => { scriptElement.src = plain_string; });
121+
assert_equals(seenTrustedTypeName, "TrustedScriptURL");
122+
assert_equals(seenSinkName, "HTMLScriptElement src");
123+
}, "Setting HTMLScriptElement.src to a plain string");
124+
</script>

0 commit comments

Comments
 (0)