From b9dc4df0c6bdf28698ba6eecda23a5984e79b70e Mon Sep 17 00:00:00 2001 From: Jun Kokatsu Date: Thu, 15 Feb 2024 09:58:46 -0800 Subject: [PATCH] Add more tests for dangling markup mitigation Adding more test per request[1]. [1] https://github.com/whatwg/html/pull/10022#pullrequestreview-1841928335 Change-Id: I7d4d3494fa3aa0ac41c48727c2f866ccf3f016d0 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5278680 Reviewed-by: Jonathan Hao Reviewed-by: Yifan Luo Auto-Submit: Jun Kokatsu Commit-Queue: Jun Kokatsu Cr-Commit-Position: refs/heads/main@{#1261160} --- ...ngling-markup-mitigation-allowed-apis.html | 26 ++++++++ ...gling-markup-mitigation-data-url.sub.html} | 0 ...e.html => dangling-markup-mitigation.html} | 0 .../dangling-markup-mitigation.https.html | 61 +++++++++++++++++++ .../dangling-markup/resources/empty.html | 1 + .../dangling-markup/service-worker.js | 35 +++++++++++ 6 files changed, 123 insertions(+) create mode 100644 fetch/security/dangling-markup/dangling-markup-mitigation-allowed-apis.html rename fetch/security/dangling-markup/{dangling-markup-mitigation-data-url.tentative.sub.html => dangling-markup-mitigation-data-url.sub.html} (100%) rename fetch/security/dangling-markup/{dangling-markup-mitigation.tentative.html => dangling-markup-mitigation.html} (100%) create mode 100644 fetch/security/dangling-markup/dangling-markup-mitigation.https.html create mode 100644 fetch/security/dangling-markup/resources/empty.html create mode 100644 fetch/security/dangling-markup/service-worker.js diff --git a/fetch/security/dangling-markup/dangling-markup-mitigation-allowed-apis.html b/fetch/security/dangling-markup/dangling-markup-mitigation-allowed-apis.html new file mode 100644 index 00000000000000..66456a8876b609 --- /dev/null +++ b/fetch/security/dangling-markup/dangling-markup-mitigation-allowed-apis.html @@ -0,0 +1,26 @@ + + + + + diff --git a/fetch/security/dangling-markup/dangling-markup-mitigation-data-url.tentative.sub.html b/fetch/security/dangling-markup/dangling-markup-mitigation-data-url.sub.html similarity index 100% rename from fetch/security/dangling-markup/dangling-markup-mitigation-data-url.tentative.sub.html rename to fetch/security/dangling-markup/dangling-markup-mitigation-data-url.sub.html diff --git a/fetch/security/dangling-markup/dangling-markup-mitigation.tentative.html b/fetch/security/dangling-markup/dangling-markup-mitigation.html similarity index 100% rename from fetch/security/dangling-markup/dangling-markup-mitigation.tentative.html rename to fetch/security/dangling-markup/dangling-markup-mitigation.html diff --git a/fetch/security/dangling-markup/dangling-markup-mitigation.https.html b/fetch/security/dangling-markup/dangling-markup-mitigation.https.html new file mode 100644 index 00000000000000..3f038cbb7be452 --- /dev/null +++ b/fetch/security/dangling-markup/dangling-markup-mitigation.https.html @@ -0,0 +1,61 @@ + + + + + + diff --git a/fetch/security/dangling-markup/resources/empty.html b/fetch/security/dangling-markup/resources/empty.html new file mode 100644 index 00000000000000..0e76edd65b7baf --- /dev/null +++ b/fetch/security/dangling-markup/resources/empty.html @@ -0,0 +1 @@ + diff --git a/fetch/security/dangling-markup/service-worker.js b/fetch/security/dangling-markup/service-worker.js new file mode 100644 index 00000000000000..837e216a013be4 --- /dev/null +++ b/fetch/security/dangling-markup/service-worker.js @@ -0,0 +1,35 @@ +const requests = new Set(); + +addEventListener('install', evt => { + evt.waitUntil(self.skipWaiting()); +}); + +addEventListener('activate', evt => { + evt.waitUntil(self.clients.claim()); +}); + +addEventListener('message', evt => { + evt.source.postMessage(requests); +}); + +addEventListener('fetch', evt => { + const url = new URL(evt.request.url); + const path = url.pathname; + const search = url.search || "?"; + if (path.includes('404')) { + const dir = path.split('/'); + const request = dir[dir.length-1] + search; + if (!requests.has(request)) { + requests.add(request); + } + evt.respondWith(new Response("")); + } else if (path.endsWith('resources.html')) { + const html = (new URLSearchParams(search)).get('html'); + evt.respondWith(new Response(html, { + headers: { + "Content-Type": "text/html" + } + })); + } + return; +});