dynamic-integrity.html | Explore in Territory

<!DOCTYPE html>
<html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script type="importmap">
{
  "imports": {
    "./resources/log.js?pipe=sub&name=ResolvesToBadHash": "./resources/log.js?pipe=sub&name=BadHash",
    "./resources/log.js?pipe=sub&name=ResolvesToNoHash": "./resources/log.js?pipe=sub&name=NoHash",
    "./resources/log.js?pipe=sub&name=GoodHash": "./resources/log.js?pipe=sub&name=GoodHash",
    "bare": "./resources/log.js?pipe=sub&name=BareURL",
    "bare2": "./resources/log.js?pipe=sub&name=F"
  },
  "integrity": {
    "./resources/log.js?pipe=sub&name=BadHash": "sha384-foobar",
    "./resources/log.js?pipe=sub&name=ResolvesToNoHash": "sha384-foobar",
    "./resources/log.js?pipe=sub&name=GoodHash": "sha384-SwfgBqInhSlLziU454cYhGgwPpae+d3VHZcY+vjZIO/gxRGt2u3Jsfyvure/Ww0u",
    "./resources/log.js?pipe=sub&name=InvalidExtra": "sha384-WsKk8nzJFPhk/4pWR4LYoPhEu3xaAc6PdIm4vmqoZVWqEgMYmZgOg9XJKxgD1+8v foobar-rOJN8igD0+jW6lwNN3+InhXTgQztVHlq/HJ0riswXp8kMoiIDx5JpmCwuVem6Ll9q2LFNSu1xq23bsBMMQk1rg==",
    "./resources/log.js?pipe=sub&name=Suffix": "sha384-lbOWldbmji7sCHI/L8iVJ+elmFIMp41p+aYOLxqQfZMqtoFeHFVe/ASRA0IyZ1/9?foobar",
    "./resources/log.js?pipe=sub&name=Multiple": "sha384-foobar sha512-rOJN8igD0+jW6lwNN3+InhXTgQztVHlq/HJ0riswXp8kMoiIDx5JpmCwuVem6Ll9q2LFNSu1xq23bsBMMQk1rg==",
    "./resources/log.js?pipe=sub&name=BadHashWithNoImport": "sha384-foobar",
    "./resources/log.js?pipe=sub&name=BareURL": "sha384-foobar",
    "./resources/log.js?pipe=sub&name=EventHandlerPass": "sha384-d4yrBK8a55vlyYz2QEnlaU64PPpdKBkblD2KmfozI61mC1ij6RrZJaGCTsVxPuJ2",
    "./resources/log.js?pipe=sub&name=EventHandlerFail": "sha384-foobar",
    "bare2": "sha384-foobar",
    "resources/log.js?pipe=sub&name=Bare": "sha384-foobar"
  }
}
</script>
<script>
let log;
const test_not_loaded = (url, description) => {
  promise_test(async t => {
    log = [];
    await promise_rejects_js(t, TypeError, import(url));
    assert_array_equals(log, []);
  }, description);
};

const test_loaded = (url, log_expectation, description) => {
  promise_test(async t => {
    log = [];
    await import(url);
    assert_array_equals(log, log_expectation);
  }, description);
};

test_not_loaded(
  "./resources/log.js?pipe=sub&name=ResolvesToBadHash",
  "script was not loaded, as its resolved URL failed its integrity check"
);
test_loaded(
  "./resources/log.js?pipe=sub&name=ResolvesToNoHash",
  ["log:NoHash"],
  "script was loaded, as its resolved URL had no integrity check, despite its specifier having one"
);
test_loaded(
  "./resources/log.js?pipe=sub&name=GoodHash",
  ["log:GoodHash"],
  "script was loaded, as its integrity check passed"
);
test_not_loaded(
  "./resources/log.js?pipe=sub&name=BadHashWithNoImport",
  "Script with no import definition was not loaded, as it failed its integrity check"
);
test_not_loaded(
  "bare",
  "Bare specifier script was not loaded, as it failed its integrity check"
);
test_loaded(
  "bare2",
  ["log:F"],
  "Bare specifier used for integrity loaded, as its definition should have used the URL"
);
test_loaded(
  "./resources/log.js?pipe=sub&name=InvalidExtra",
  ["log:InvalidExtra"],
  "script was loaded, as its integrity check passed, despite having an extra invalid hash"
);
test_loaded(
  "./resources/log.js?pipe=sub&name=Suffix",
  ["log:Suffix"],
  "script was loaded, as its integrity check passed, despite having an invalid suffix"
);
test_loaded(
  "./resources/log.js?pipe=sub&name=Multiple",
  ["log:Multiple"],
  "script was loaded, as its integrity check passed given multiple hashes. This also makes sure that the larger hash is picked"
);
test_loaded(
  "./resources/log.js?pipe=sub&name=Bare",
  ["log:Bare"],
  "script was loaded, as its integrity check was ignored, as it was defined using a URL that looks like a bare specifier"
);

promise_test(async () => {
  log = [];
  const img = new Image();
  const promise = new Promise((resolve, reject) => {
    img.onload = () => {
      import('./resources/log.js?pipe=sub&name=EventHandlerPass').then(resolve).catch(reject);
    };
    img.src = "/images/green.png?1";
  });

  await promise;
  assert_equals(log.length, 1);
  assert_equals(log[0], "log:EventHandlerPass");
}, "Script imported inside an event handler was loaded as its valid integrity check passed");

promise_test(async t => {
  log = [];
  const img = new Image();
  const promise = new Promise((resolve, reject) => {
    img.onload = () => {
      import('./resources/log.js?pipe=sub&name=EventHandlerFail').then(resolve).catch(reject);
    };
    img.src = "/images/green.png?2";
  });

  await promise_rejects_js(t, TypeError, promise);
}, "Script imported inside an event handler was not loaded as its integrity check failed");
</script>
chromium/third_party/blink/web_tests/external/wpt/import-maps/dynamic-integrity.html
