import { defer } from "@commonfabric/utils/defer";
import "../src/common-iframe-sandbox.ts";
import {
assert,
assertDeepEquals,
assertEquals,
cleanupFixtures,
ContextShim,
invertPromise,
render,
waitForEvent,
} from "./utils.ts";
type TestCase = [string, string, string | null | RegExp];
// Cookies should not be set with SameSite=None, but
// used to test that cookies are not accessible to iframe.
document.cookie = "testcookie=1; SameSite=None;";
// When CSP is applied to an iframe, the `securitypolicyviolation`
// event is emitted on the iframe's `document`.
// As the host and iframe's do not share origin, and `securitypolicyviolation`
// events occur during load, we have to inject a CSP listener into
// the iframe content for these its.
// Outside of its/in app, we *may* want to inject this, though
// content may still work with some imports (e.g. styles/images) failing.
// If so, we may want to add a new post message "event" in addition
// to the not-very-CSP-compatible "error" event.
//
// Additionally, we want to propagate other errors to the parent frame
// for inspection.
const CSP_REPORTER = `
`;
// Raises a recognizable alarm once the guest has passed the point where a
// case's error would already have been posted.
//
// It is an alarm rather than a write, and that is what makes it a barrier. An
// error leaves the guest as a postMessage to its parent, which forwards it to
// the host on a second fixed pair of windows; this takes that same route, and
// each hop preserves the order it received messages in, so an alarm posted
// after an error arrives after it. A write would not do: it rides the guest's
// port, which is a channel of its own with no ordering against this one, and a
// barrier that can arrive before an error already sent bounds nothing.
//
// The load event is the point the cases below share. It fires once the document
// has parsed and its subresources have settled, and it lands after the
// violation for the two kinds of subresource those cases load: an `
`;
}
// `openWindow` with its guard inverted: throws when the window did not open,
// which is the outcome the real cases assert. Used by `barrierControls`.
function invertedOpenWindow(target: string) {
return ``;
}
// `clickAnchor` with a throw at the point the click happens, which the real
// cases reach without raising anything. Used by `barrierControls`.
function throwingClickAnchor(target: string) {
return `
`;
}
const cases: TestCase[] = [[
"allows inline script",
`foo
`,
null,
], [
"allows 1P img",
` => {
if (errors.length > 0) {
return Promise.resolve(errors[0]);
}
const deferred = defer();
noticeError = () => deferred.resolve(errors[0]);
return deferred.promise;
};
// Resolves once the barrier has arrived, which the same listener records.
const barrierSeen = (): Promise => {
if (barrierArrived) {
return Promise.resolve();
}
const deferred = defer();
noticeBarrier = () => deferred.resolve();
return deferred.promise;
};
try {
const context = new ContextShim();
const body = `
${CSP_REPORTER}
${html}
${BARRIER}
`;
await render(body, context);
if (expected == null) {
await barrierSeen();
assertDeepEquals(errors, []);
} else {
const description = await firstErrorDescription();
if (typeof expected === "string") {
assertEquals(description, expected);
} else {
assert(expected.test(description));
}
}
} finally {
document.removeEventListener("common-iframe-error", onError);
cleanupFixtures();
}
});
}
// Runs a `barrierControls` case: same body and same wait as a negative case in
// `defineTest`, against html that does break the policy. The error must be in
// hand at the moment the barrier arrives.
function defineBarrierControl(
name: string,
html: string,
expected: string,
) {
Deno.test(`barrier control: ${name}`, async () => {
cleanupFixtures();
const errors: string[] = [];
let barrierArrived = false;
let noticeBarrier: (() => void) | undefined;
const onError = (event: Event) => {
const description = (event as CustomEvent).detail.description as string;
if (description === BARRIER_DESCRIPTION) {
barrierArrived = true;
noticeBarrier?.();
return;
}
errors.push(description);
};
document.addEventListener("common-iframe-error", onError);
const barrierSeen = (): Promise => {
if (barrierArrived) {
return Promise.resolve();
}
const deferred = defer();
noticeBarrier = () => deferred.resolve();
return deferred.promise;
};
try {
const context = new ContextShim();
const body = `
${CSP_REPORTER}
${html}
${BARRIER}
`;
await render(body, context);
await barrierSeen();
assertDeepEquals(errors, [expected]);
} finally {
document.removeEventListener("common-iframe-error", onError);
cleanupFixtures();
}
});
}
// The pre-barrier shape, kept for the `unbarrierable` cases: wait out
// `waitForEvent`'s timeout and read the rejection as "no error fired". It
// bounds how late an error can arrive and still be caught, and it starts
// listening only once `render` has resolved.
function defineTimedNegativeTest(
name: string,
html: string,
expected: string | null | RegExp,
) {
if (expected != null) {
throw new Error(`${name}: expected a negative case.`);
}
Deno.test(name, async () => {
cleanupFixtures();
try {
const body = `
${CSP_REPORTER}
${html}
`;
const iframe = await render(body);
await invertPromise(waitForEvent(iframe, "common-iframe-error"));
} finally {
cleanupFixtures();
}
});
}
function definePending(
name: string,
_html: string,
_expected: string | null | RegExp,
) {
Deno.test(name, () => {});
}
`,
null,
], [
"allows data: img",
`