From 07b63bb4d273b001a5bebf2f2e9cd3cb3d806749 Mon Sep 17 00:00:00 2001
From: Anne van Kesteren <annevk@annevk.nl>
Date: Fri, 9 Nov 2018 16:56:56 +0000
Subject: [PATCH] Bug 1499659 [wpt PR 13559] - Fetch: test nosniff parsing
 better, a=testonly

Automatic update from web-platform-testsFetch: X-Content-Type-Options: nosniff parsing

For https://github.com/whatwg/fetch/pull/818.
--

wpt-commits: 10f708e6f13141fc92ca9318c7606590f659fcf2
wpt-pr: 13559
---
 .../tests/fetch/nosniff/parsing-nosniff.html  | 28 ---------
 .../fetch/nosniff/parsing-nosniff.window.js   | 24 ++++++++
 .../nosniff/resources/nosniff-first.asis      |  7 ---
 .../fetch/nosniff/resources/nosniff-last.asis |  7 ---
 .../fetch/nosniff/resources/nosniff-no-x.asis |  6 --
 .../resources/nosniff-quoted-single.asis      |  6 --
 .../nosniff/resources/nosniff-quoted.asis     |  6 --
 .../nosniff/resources/nosniff-uppercase.asis  |  6 --
 .../tests/fetch/nosniff/resources/nosniff.py  | 10 ++++
 .../resources/x-content-type-options.json     | 58 +++++++++++++++++++
 10 files changed, 92 insertions(+), 66 deletions(-)
 delete mode 100644 testing/web-platform/tests/fetch/nosniff/parsing-nosniff.html
 create mode 100644 testing/web-platform/tests/fetch/nosniff/parsing-nosniff.window.js
 delete mode 100644 testing/web-platform/tests/fetch/nosniff/resources/nosniff-first.asis
 delete mode 100644 testing/web-platform/tests/fetch/nosniff/resources/nosniff-last.asis
 delete mode 100644 testing/web-platform/tests/fetch/nosniff/resources/nosniff-no-x.asis
 delete mode 100644 testing/web-platform/tests/fetch/nosniff/resources/nosniff-quoted-single.asis
 delete mode 100644 testing/web-platform/tests/fetch/nosniff/resources/nosniff-quoted.asis
 delete mode 100644 testing/web-platform/tests/fetch/nosniff/resources/nosniff-uppercase.asis
 create mode 100644 testing/web-platform/tests/fetch/nosniff/resources/nosniff.py
 create mode 100644 testing/web-platform/tests/fetch/nosniff/resources/x-content-type-options.json

diff --git a/testing/web-platform/tests/fetch/nosniff/parsing-nosniff.html b/testing/web-platform/tests/fetch/nosniff/parsing-nosniff.html
deleted file mode 100644
index 10c5cadfcaadd..0000000000000
--- a/testing/web-platform/tests/fetch/nosniff/parsing-nosniff.html
+++ /dev/null
@@ -1,28 +0,0 @@
-<script src=/resources/testharness.js></script>
-<script src=/resources/testharnessreport.js></script>
-<div id=log></div>
-<script>
-  var fails = ["first", "uppercase"],
-      passes = ["last", "quoted", "quoted-single", "no-x"]
-
-  fails.forEach(function(urlpart) {
-    async_test(function(t) {
-      var script = document.createElement("script")
-      script.onerror = t.step_func_done(function(){})
-      script.onload = t.unreached_func("Unexpected load event")
-      script.src = "resources/nosniff-" + urlpart + ".asis"
-      document.body.appendChild(script)
-    }, "URL query: " + urlpart)
-  })
-
-  passes.forEach(function(urlpart) {
-    async_test(function(t) {
-      var script = document.createElement("script")
-      script.onerror = t.unreached_func("Unexpected error event")
-      script.onload = t.step_func_done(function(){})
-      script.src = "resources/nosniff-" + urlpart + ".asis"
-      document.body.appendChild(script)
-    }, "URL query: " + urlpart)
-  })
-
-</script>
diff --git a/testing/web-platform/tests/fetch/nosniff/parsing-nosniff.window.js b/testing/web-platform/tests/fetch/nosniff/parsing-nosniff.window.js
new file mode 100644
index 0000000000000..043e659127b2c
--- /dev/null
+++ b/testing/web-platform/tests/fetch/nosniff/parsing-nosniff.window.js
@@ -0,0 +1,24 @@
+promise_test(() => fetch("resources/x-content-type-options.json").then(res => res.json()).then(runTests), "Loading JSON…");
+
+function runTests(allTestData) {
+  for (let i = 0; i < allTestData.length; i++) {
+    const testData = allTestData[i],
+          input = encodeURIComponent(testData.input);
+    async_test(t => {
+      const script = document.createElement("script");
+      t.add_cleanup(() => script.remove());
+      // A <script> element loading a classic script does not care about the MIME type, unless
+      // X-Content-Type-Options: nosniff is specified, in which case a JavaScript MIME type is
+      // enforced, which x/x is not.
+      if (testData.nosniff) {
+        script.onerror = t.step_func_done();
+        script.onload = t.unreached_func("Script should not have loaded");
+      } else {
+        script.onerror = t.unreached_func("Script should have loaded");
+        script.onload = t.step_func_done();
+      }
+      script.src = "resources/nosniff.py?nosniff=" + input;
+      document.body.appendChild(script);
+    }, input);
+  }
+}
diff --git a/testing/web-platform/tests/fetch/nosniff/resources/nosniff-first.asis b/testing/web-platform/tests/fetch/nosniff/resources/nosniff-first.asis
deleted file mode 100644
index bccc53eef8acd..0000000000000
--- a/testing/web-platform/tests/fetch/nosniff/resources/nosniff-first.asis
+++ /dev/null
@@ -1,7 +0,0 @@
-HTTP/1.1 200 YOU HAVE NO POWER HERE
-Content-Length: 22
-Content-Type: x/x
-X-Content-Type-options: nosniff
-X-Content-Type-Options: no
-
-// nothing to see here
diff --git a/testing/web-platform/tests/fetch/nosniff/resources/nosniff-last.asis b/testing/web-platform/tests/fetch/nosniff/resources/nosniff-last.asis
deleted file mode 100644
index e3de0733e4fb6..0000000000000
--- a/testing/web-platform/tests/fetch/nosniff/resources/nosniff-last.asis
+++ /dev/null
@@ -1,7 +0,0 @@
-HTTP/1.1 200 YOU HAVE NO POWER HERE
-Content-Length: 22
-Content-Type: x/x
-X-Content-Type-Options: no
-X-Content-Type-options: nosniff
-
-// nothing to see here
diff --git a/testing/web-platform/tests/fetch/nosniff/resources/nosniff-no-x.asis b/testing/web-platform/tests/fetch/nosniff/resources/nosniff-no-x.asis
deleted file mode 100644
index 329d0f72143a4..0000000000000
--- a/testing/web-platform/tests/fetch/nosniff/resources/nosniff-no-x.asis
+++ /dev/null
@@ -1,6 +0,0 @@
-HTTP/1.1 200 YOU HAVE NO POWER HERE
-Content-Length: 22
-Content-Type: x/x
-Content-Type-Options: nosniff
-
-// nothing to see here
diff --git a/testing/web-platform/tests/fetch/nosniff/resources/nosniff-quoted-single.asis b/testing/web-platform/tests/fetch/nosniff/resources/nosniff-quoted-single.asis
deleted file mode 100644
index 501f18999d074..0000000000000
--- a/testing/web-platform/tests/fetch/nosniff/resources/nosniff-quoted-single.asis
+++ /dev/null
@@ -1,6 +0,0 @@
-HTTP/1.1 200 YOU HAVE NO POWER HERE
-Content-Length: 22
-Content-Type: x/x
-X-Content-Type-Options: 'NosniFF'
-
-// nothing to see here
diff --git a/testing/web-platform/tests/fetch/nosniff/resources/nosniff-quoted.asis b/testing/web-platform/tests/fetch/nosniff/resources/nosniff-quoted.asis
deleted file mode 100644
index c6de62b689e2f..0000000000000
--- a/testing/web-platform/tests/fetch/nosniff/resources/nosniff-quoted.asis
+++ /dev/null
@@ -1,6 +0,0 @@
-HTTP/1.1 200 YOU HAVE NO POWER HERE
-Content-Length: 22
-Content-Type: x/x
-X-Content-Type-Options: "nosniFF"
-
-// nothing to see here
diff --git a/testing/web-platform/tests/fetch/nosniff/resources/nosniff-uppercase.asis b/testing/web-platform/tests/fetch/nosniff/resources/nosniff-uppercase.asis
deleted file mode 100644
index 8097fddce106a..0000000000000
--- a/testing/web-platform/tests/fetch/nosniff/resources/nosniff-uppercase.asis
+++ /dev/null
@@ -1,6 +0,0 @@
-HTTP/1.1 200 YOU HAVE NO POWER HERE
-Content-Length: 22
-Content-Type: x/x
-X-Content-Type-Options: NOSNIFF
-
-// nothing to see here
diff --git a/testing/web-platform/tests/fetch/nosniff/resources/nosniff.py b/testing/web-platform/tests/fetch/nosniff/resources/nosniff.py
new file mode 100644
index 0000000000000..9b59d35b925ef
--- /dev/null
+++ b/testing/web-platform/tests/fetch/nosniff/resources/nosniff.py
@@ -0,0 +1,10 @@
+def main(request, response):
+    response.add_required_headers = False
+    output =  "HTTP/1.1 220 YOU HAVE NO POWER HERE\r\n"
+    output += "Content-Length: 22\r\n"
+    output += "Content-Type: x/x\r\n"
+    output += request.GET.first("nosniff") + "\r\n"
+    output += "\r\n"
+    output += "// nothing to see here"
+    response.writer.write(output)
+    response.close_connection = True
diff --git a/testing/web-platform/tests/fetch/nosniff/resources/x-content-type-options.json b/testing/web-platform/tests/fetch/nosniff/resources/x-content-type-options.json
new file mode 100644
index 0000000000000..0a8c490756e67
--- /dev/null
+++ b/testing/web-platform/tests/fetch/nosniff/resources/x-content-type-options.json
@@ -0,0 +1,58 @@
+[
+  {
+    "input": "X-Content-Type-Options: NOSNIFF",
+    "nosniff": true
+  },
+  {
+    "input": "x-content-type-OPTIONS: nosniff",
+    "nosniff": true
+  },
+  {
+    "input": "X-Content-Type-Options: nosniff,,@#$#%%&^&^*()()11!",
+    "nosniff": true
+  },
+  {
+    "input": "X-Content-Type-Options: @#$#%%&^&^*()()11!,nosniff",
+    "nosniff": false
+  },
+  {
+    "input": "X-Content-Type-Options: nosniff\r\nX-Content-Type-Options: no",
+    "nosniff": true
+  },
+  {
+    "input": "X-Content-Type-Options: no\r\nX-Content-Type-Options: nosniff",
+    "nosniff": false
+  },
+  {
+    "input": "X-Content-Type-Options:\r\nX-Content-Type-Options: nosniff",
+    "nosniff": false
+  },
+  {
+    "input": "X-Content-Type-Options: ,nosniff",
+    "nosniff": false
+  },
+  {
+    "input": "X-Content-Type-Options: nosniff\u000C",
+    "nosniff": false
+  },
+  {
+    "input": "X-Content-Type-Options: nosniff\u000B",
+    "nosniff": false
+  },
+  {
+    "input": "X-Content-Type-Options: nosniff\u000B,nosniff",
+    "nosniff": false
+  },
+  {
+    "input": "X-Content-Type-Options: 'NosniFF'",
+    "nosniff": false
+  },
+  {
+    "input": "X-Content-Type-Options: \"nosniFF\"",
+    "nosniff": false
+  },
+  {
+    "input": "Content-Type-Options: nosniff",
+    "nosniff": false
+  }
+]