script-src-multiple-allowed.php | Explore in Territory

<?php
    header("Content-Security-Policy: script-src 'nonce-abcdefg' 'strict-dynamic', script-src * 'unsafe-inline'");
?>
<!DOCTYPE html>
<html>
<head>
    <script src="/resources/testharness.js" nonce="abcdefg"></script>
    <script src="/resources/testharnessreport.js" nonce="abcdefg"></script>
    <script src="../resources/securitypolicyviolation-helper.js" nonce="abcdefg"></script>
</head>
<body>
    <!-- Need to individually wrap test cases in script blocks. Violation reports triggered by document.write() calls while the parser is waiting on blocking scipts are missing line numbers. See: https://crbug.com/649085. -->
    <script nonce="abcdefg">
        async_test(function (t) {
          var e = document.createElement('script');
          e.src = generateURL("append");
          e.onerror = t.unreached_func("Error should not be triggered.");
          assert_script_loads(t, generateURL("append"), 16);
          document.body.appendChild(e);
        }, "Script injected via 'appendChild' is allowed with 'strict-dynamic'.");
    </script>
    <script nonce="abcdefg">
        async_test(function (t) {
          var e = document.createElement('script');
          e.src = generateURL("append-async");
          e.async = true;
          e.onerror = t.unreached_func("Error should not be triggered.");
          assert_script_loads(t, generateURL("append-async"), 26);
          document.body.appendChild(e);
        }, "Async script injected via 'appendChild' is allowed with 'strict-dynamic'.");
    </script>
    <script nonce="abcdefg">
        async_test(function (t) {
          var e = document.createElement('script');
          e.src = generateURL("append-defer");
          e.defer = true;
          e.onerror = t.unreached_func("Error should not be triggered.");
          assert_script_loads(t, generateURL("append-defer"), 26);
          document.body.appendChild(e);
        }, "Deferred script injected via 'appendChild' is allowed with 'strict-dynamic'.");
    </script>
    <script nonce="abcdefg">
        async_test(function (t) {
          assert_script_failed(t, generateURL("write"), 42);
          document.write("<scr" + "ipt src='" + generateURL("write") + "'></scr" + "ipt>");
        }, "Script injected via 'document.write' is not allowed with 'strict-dynamic'.");
    </script>
    <script nonce="abcdefg">
        async_test(function (t) {
          assert_script_failed(t, generateURL("write-defer"), 48);
          document.write("<scr" + "ipt defer src='" + generateURL("write-defer") + "'></scr" + "ipt>");
        }, "Deferred script injected via 'document.write' is not allowed with 'strict-dynamic'.");
    </script>
    <script nonce="abcdefg">
        async_test(function (t) {
          assert_script_failed(t, generateURL("write-async"), 54);
          document.write("<scr" + "ipt async src='" + generateURL("write-async") + "'></scr" + "ipt>");
        }, "Async script injected via 'document.write' is not allowed with 'strict-dynamic'.");
    </script>
    <script nonce="abcdefg" defer>
        async_test(function (t) {
          var e = document.createElement('script');
          e.src = generateURL("defer-append");
          e.onerror = t.unreached_func("Error should not be triggered.");
          assert_script_loads(t, generateURL("defer-append"), 63);
          document.body.appendChild(e);
        }, "Script injected via deferred 'appendChild' is allowed with 'strict-dynamic'.");
    </script>
    <script nonce="abcdefg" defer>
        async_test(function (t) {
          var e = document.createElement('script');
          e.src = generateURL("defer-append-async");
          e.async = true;
          e.onerror = t.unreached_func("Error should not be triggered.");
          assert_script_loads(t, generateURL("defer-append-async"), 73);
          document.body.appendChild(e);
        }, "Async script injected via deferred 'appendChild' is allowed with 'strict-dynamic'.");
    </script>
    <script nonce="abcdefg" defer>
        async_test(function (t) {
          var e = document.createElement('script');
          e.src = generateURL("defer-append-defer");
          e.defer = true;
          e.onerror = t.unreached_func("Error should not be triggered.");
          assert_script_loads(t, generateURL("defer-append-defer"), 83);
          document.body.appendChild(e);
        }, "Deferred script injected via deferred 'appendChild' is allowed with 'strict-dynamic'.");
    </script>
    <script nonce="abcdefg" defer>
        async_test(function (t) {
          assert_script_failed(t, generateURL("defer-write"), 89);
          document.write("<scr" + "ipt src='" + generateURL("defer-write") + "'></scr" + "ipt>");
        }, "Script injected via deferred 'document.write' is not allowed with 'strict-dynamic'.");
    </script>
    <script nonce="abcdefg" defer>
        async_test(function (t) {
          assert_script_failed(t, generateURL("defer-write-defer"), 95);
          document.write("<scr" + "ipt defer src='" + generateURL("defer-write-defer") + "'></scr" + "ipt>");
        }, "Deferred script injected via deferred 'document.write' is not allowed with 'strict-dynamic'.");
    </script>
    <script nonce="abcdefg" defer>
        async_test(function (t) {
          assert_script_failed(t, generateURL("defer-write-async"), 101);
          document.write("<scr" + "ipt async src='" + generateURL("defer-write-async") + "'></scr" + "ipt>");
        }, "Async script injected via deferred 'document.write' is not allowed with 'strict-dynamic'.");
    </script>
</body>
</html>
chromium/third_party/blink/web_tests/http/tests/security/contentSecurityPolicy/strict-dynamic/script-src-multiple-allowed.php
