|
| 1 | +// META: script=/common/subset-tests-by-key.js |
| 2 | +// META: script=/common/dispatcher/dispatcher.js |
| 3 | +// META: script=/common/utils.js |
| 4 | +// META: script=/resources/testdriver.js |
| 5 | +// META: script=/resources/testdriver-vendor.js |
| 6 | +// META: script=resources/support.sub.js |
| 7 | +// META: timeout=long |
| 8 | +// META: variant=?include=from-loopback |
| 9 | +// META: variant=?include=from-local |
| 10 | +// META: variant=?include=from-public |
| 11 | +// META: variant=?include=from-treat-as-public |
| 12 | +// |
| 13 | +// Spec: https://wicg.github.io/local-network-access/#integration-fetch |
| 14 | +// |
| 15 | +// These tests verify that secure contexts can navigate iframes to less-public |
| 16 | +// address spaces iff the initiating document has been granted the LNA |
| 17 | +// permission. |
| 18 | +// |
| 19 | +// This file covers only those tests that must execute in a secure context. |
| 20 | + |
| 21 | +setup(() => { |
| 22 | + assert_true(window.isSecureContext); |
| 23 | +}); |
| 24 | + |
| 25 | +// Source: secure loopback context. |
| 26 | +// |
| 27 | +// All iframe navigations unaffected by Local Network Access. |
| 28 | + |
| 29 | +subsetTestByKey( |
| 30 | + 'from-loopback', promise_test, t => iframeTest(t, { |
| 31 | + source: Server.HTTP_LOOPBACK, |
| 32 | + target: Server.HTTPS_LOOPBACK, |
| 33 | + expected: NavigationTestResult.SUCCESS, |
| 34 | + }), |
| 35 | + 'loopback to loopback: no permission required.'); |
| 36 | + |
| 37 | +subsetTestByKey( |
| 38 | + 'from-loopback', promise_test, t => iframeTest(t, { |
| 39 | + source: Server.HTTP_LOOPBACK, |
| 40 | + target: Server.HTTPS_LOCAL, |
| 41 | + expected: NavigationTestResult.SUCCESS, |
| 42 | + }), |
| 43 | + 'loopback to local: no permission required.'); |
| 44 | + |
| 45 | +subsetTestByKey( |
| 46 | + 'from-loopback', promise_test, t => iframeTest(t, { |
| 47 | + source: Server.HTTP_LOOPBACK, |
| 48 | + target: Server.HTTPS_PUBLIC, |
| 49 | + expected: NavigationTestResult.SUCCESS, |
| 50 | + }), |
| 51 | + 'loopback to public: no permission required.'); |
| 52 | + |
| 53 | +// Source: local secure context. |
| 54 | +// |
| 55 | +// All iframe navigations unaffected by Local Network Access. |
| 56 | + |
| 57 | +// Requests from the `local` address space to the `loopback` address space |
| 58 | +// are not yet restricted by LNA. |
| 59 | +subsetTestByKey( |
| 60 | + 'from-local', promise_test, t => iframeTest(t, { |
| 61 | + source: Server.HTTP_LOCAL, |
| 62 | + target: Server.HTTPS_LOOPBACK, |
| 63 | + expected: NavigationTestResult.SUCCESS, |
| 64 | + }), |
| 65 | + 'local to loopback: no permission required.'); |
| 66 | + |
| 67 | +subsetTestByKey( |
| 68 | + 'from-local', promise_test, t => iframeTest(t, { |
| 69 | + source: Server.HTTP_LOCAL, |
| 70 | + target: Server.HTTPS_LOCAL, |
| 71 | + expected: NavigationTestResult.SUCCESS, |
| 72 | + }), |
| 73 | + 'local to local: no permission required.'); |
| 74 | + |
| 75 | +subsetTestByKey( |
| 76 | + 'from-local', promise_test, t => iframeTest(t, { |
| 77 | + source: Server.HTTP_LOCAL, |
| 78 | + target: Server.HTTPS_PUBLIC, |
| 79 | + expected: NavigationTestResult.SUCCESS, |
| 80 | + }), |
| 81 | + 'local to public: no permission required.'); |
| 82 | + |
| 83 | + |
| 84 | +// Generates tests of permission behavior for a single (source, target) pair. |
| 85 | +// |
| 86 | +// Scenarios: |
| 87 | +// |
| 88 | +// - parent (source) navigates child (target): |
| 89 | +// - parent has been denied the LNA permission (failure) |
| 90 | +// - parent has been granted the LNA permission (success) |
| 91 | +// |
| 92 | +function makePermissionTests({ |
| 93 | + key, |
| 94 | + sourceName, |
| 95 | + sourceServer, |
| 96 | + sourceTreatAsPublic, |
| 97 | + targetName, |
| 98 | + targetServer, |
| 99 | +}) { |
| 100 | + const prefix = `${sourceName} to ${targetName}: `; |
| 101 | + |
| 102 | + const source = { |
| 103 | + server: sourceServer, |
| 104 | + treatAsPublic: sourceTreatAsPublic, |
| 105 | + }; |
| 106 | + |
| 107 | + promise_test( |
| 108 | + t => iframeTest(t, { |
| 109 | + source, |
| 110 | + target: { |
| 111 | + server: targetServer, |
| 112 | + }, |
| 113 | + expected: NavigationTestResult.FAILURE, |
| 114 | + permission: 'denied', |
| 115 | + }), |
| 116 | + prefix + 'permission denied.'); |
| 117 | + |
| 118 | + promise_test( |
| 119 | + t => iframeTest(t, { |
| 120 | + source, |
| 121 | + target: { |
| 122 | + server: targetServer, |
| 123 | + }, |
| 124 | + expected: NavigationTestResult.SUCCESS, |
| 125 | + permission: 'granted', |
| 126 | + }), |
| 127 | + prefix + 'success.'); |
| 128 | +} |
| 129 | + |
| 130 | + |
| 131 | +// Source: public secure context. |
| 132 | +// |
| 133 | +// iframe navigations to the loopback and local address spaces require the LNA |
| 134 | +// permission. |
| 135 | + |
| 136 | +subsetTestByKey('from-public', makePermissionTests, { |
| 137 | + sourceServer: Server.HTTPS_PUBLIC, |
| 138 | + sourceName: 'public', |
| 139 | + targetServer: Server.HTTPS_LOOPBACK, |
| 140 | + targetName: 'loopback', |
| 141 | +}); |
| 142 | + |
| 143 | +subsetTestByKey('from-public', makePermissionTests, { |
| 144 | + sourceServer: Server.HTTPS_PUBLIC, |
| 145 | + sourceName: 'public', |
| 146 | + targetServer: Server.HTTPS_LOCAL, |
| 147 | + targetName: 'local', |
| 148 | +}); |
| 149 | + |
| 150 | +subsetTestByKey( |
| 151 | + 'from-public', promise_test, t => iframeTest(t, { |
| 152 | + source: Server.HTTPS_PUBLIC, |
| 153 | + target: Server.HTTPS_PUBLIC, |
| 154 | + expected: NavigationTestResult.SUCCESS, |
| 155 | + }), |
| 156 | + 'public to public: no permission required.'); |
| 157 | + |
| 158 | +// The following tests verify that `CSP: treat-as-public-address` makes |
| 159 | +// documents behave as if they had been served from a public IP address. |
| 160 | + |
| 161 | +subsetTestByKey('from-treat-as-public', makePermissionTests, { |
| 162 | + sourceServer: Server.HTTPS_LOOPBACK, |
| 163 | + sourceTreatAsPublic: true, |
| 164 | + sourceName: 'treat-as-public-address', |
| 165 | + targetServer: Server.OTHER_HTTPS_LOOPBACK, |
| 166 | + targetName: 'loopback', |
| 167 | +}); |
| 168 | + |
| 169 | +subsetTestByKey( |
| 170 | + 'from-treat-as-public', promise_test, |
| 171 | + t => iframeTest(t, { |
| 172 | + source: { |
| 173 | + server: Server.HTTPS_LOOPBACK, |
| 174 | + treatAsPublic: true, |
| 175 | + }, |
| 176 | + target: Server.HTTPS_LOOPBACK, |
| 177 | + expected: NavigationTestResult.SUCCESS, |
| 178 | + }), |
| 179 | + 'treat-as-public-address to local (same-origin): no permission required.'); |
| 180 | + |
| 181 | +subsetTestByKey('from-treat-as-public', makePermissionTests, { |
| 182 | + sourceServer: Server.HTTPS_LOOPBACK, |
| 183 | + sourceTreatAsPublic: true, |
| 184 | + sourceName: 'treat-as-public-address', |
| 185 | + targetServer: Server.HTTPS_LOCAL, |
| 186 | + targetName: 'local', |
| 187 | +}); |
| 188 | + |
| 189 | +subsetTestByKey( |
| 190 | + 'from-treat-as-public', promise_test, |
| 191 | + t => iframeTest(t, { |
| 192 | + source: { |
| 193 | + server: Server.HTTPS_LOOPBACK, |
| 194 | + treatAsPublic: true, |
| 195 | + }, |
| 196 | + target: Server.HTTPS_PUBLIC, |
| 197 | + expected: NavigationTestResult.SUCCESS, |
| 198 | + }), |
| 199 | + 'treat-as-public-address to public: no permission required.'); |
0 commit comments