Test files without 2 passes: 384; Subtests without 2 passes: 911; Failure level: 911/911 (100.00%)
| Test | Ch73 |
|---|---|
| /content-security-policy/navigate-to/form-redirected-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the child iframe navigation is allowed | PASS |
| /content-security-policy/svg/svg-policy-with-resource.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["TEST COMPLETE"] | PASS |
| /content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image-from-script.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Non-redirected cross-origin URLs are not stripped. | PASS |
| /content-security-policy/generic/directive-name-case-insensitive.sub.html (3/3, 100.00%, 0.33% of total) | OK |
| Test that the www1 image is allowed to load | PASS |
| Test that the www2 image is not allowed to load | PASS |
| Test that the www2 image throws a violation event | PASS |
| /content-security-policy/img-src/img-src-self-unique-origin.html (1/1, 100.00%, 0.11% of total) | OK |
| Image's url must not match with 'self'. Image must be blocked. | PASS |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-nonces.html (8/8, 100.00%, 0.88% of total) | OK |
| A nonce has to be returned if required by the embedder. | PASS |
| Any nonce subsumes. | PASS |
| Exact nonce subsumes. | PASS |
| Multiples nonces returned subsume. | PASS |
| Nonce intersection is still done on exact match - matching nonces. | PASS |
| Nonce intersection is still done on exact match - non-matching nonces. | PASS |
| Other expressions still have to be subsumed - negative test | PASS |
| Other expressions still have to be subsumed - positive test. | PASS |
| /content-security-policy/meta/combine-header-and-meta-policies.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Expecting logs: ["TEST COMPLETE", "violated-directive=img-src", "violated-directive=style-src-elem"] | PASS |
| combine-header-and-meta-policies | PASS |
| /content-security-policy/style-src-attr-elem/style-src-attr-blocked-src-allowed.html (2/2, 100.00%, 0.22% of total) | TIMEOUT |
| Should fire a security policy violation event | NOTRUN |
| The attribute style should not be applied | PASS |
| /content-security-policy/style-src/style-src-star-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| * should allow any style | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-same-url-allow.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a URL value should block or allow rendering in nested frames as appropriate. | NOTRUN |
| /content-security-policy/navigate-to/meta-refresh-cross-origin-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the child iframe navigation is allowed | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-same-in-same-url-allow.html (1/1, 100.00%, 0.11% of total) | OK |
| A 'frame-ancestors' CSP directive with a URL value should block or allow rendering in nested frames as appropriate. | PASS |
| /content-security-policy/securitypolicyviolation/upgrade-insecure-requests-reporting.https.html (3/3, 100.00%, 0.33% of total) | OK |
| Navigated iframe is upgraded and reported | FAIL |
| Upgraded iframe is reported | FAIL |
| Upgraded image is reported | FAIL |
| /content-security-policy/navigate-to/meta-refresh-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the child iframe navigation is allowed | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-same-in-cross-url-block.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a URL value should block or allow rendering in nested frames as appropriate. | NOTRUN |
| /content-security-policy/connect-src/connect-src-xmlhttprequest-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["Pass","violated-directive=connect-src"] | PASS |
| /content-security-policy/reporting/report-multiple-violations-01.html (2/2, 100.00%, 0.22% of total) | OK |
| Test number of sent reports. | PASS |
| Violation report status OK. | PASS |
| /content-security-policy/child-src/child-src-redirect-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS IFrame #1 generated a load event.", "violated-directive=frame-src"] | PASS |
| /content-security-policy/connect-src/connect-src-xmlhttprequest-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["Pass"] | PASS |
| /content-security-policy/securitypolicyviolation/img-src-redirect-upgrade-reporting.https.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Image that redirects to http:// URL prohibited by Report-Only must generate a violation report, even with upgrade-insecure-requests | TIMEOUT |
| /content-security-policy/form-action/form-action-src-allowed-target-frame.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| form submission targetting a frame allowed | PASS |
| /content-security-policy/navigate-to/form-cross-origin-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that the child iframe navigation is not allowed | FAIL |
| Violation report status OK. | FAIL |
| /content-security-policy/script-src/scriptnonce-basic-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS (closely-quoted nonce)","PASS (nonce w/whitespace)", "violated-directive=script-src-elem", "violated-directive=script-src-elem", "violated-directive=script-src-elem"] | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-same-in-same-url-block.html (1/1, 100.00%, 0.11% of total) | OK |
| A 'frame-ancestors' CSP directive with a URL value should block or allow rendering in nested frames as appropriate. | FAIL |
| /content-security-policy/embedded-enforcement/allow_csp_from-header.html (11/11, 100.00%, 1.21% of total) | OK |
| Allow-CSP-From header enforces EmbeddingCSP. | PASS |
| Allow-CSP-From header with a star value can be returned. | PASS |
| Cross origin iframe with an empty Allow-CSP-From header gets blocked. | PASS |
| Cross origin iframe without Allow-CSP-From header gets blocked. | PASS |
| Iframe with improper Allow-CSP-From header gets blocked. | PASS |
| Same origin iframes are allowed even if Allow-CSP-From does not match origin. | PASS |
| Same origin iframes are allowed even if the Allow-CSP-From is empty. | PASS |
| Same origin iframes are allowed even if the Allow-CSP-From is not present. | PASS |
| Same origin iframes are always allowed. | PASS |
| Star Allow-CSP-From header enforces EmbeddingCSP. | PASS |
| iframe from cross origin does not load without Allow-CSP-From header. | PASS |
| /content-security-policy/unsafe-eval/eval-scripts-setInterval-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS","violated-directive=script-src"] | PASS |
| /content-security-policy/navigate-to/form-action/form-action-blocks-navigate-to-blocks.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that form-action overrides navigate-to when present. | PASS |
| /content-security-policy/img-src/img-src-port-wildcard-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| img-src with wildcard port should match any port | PASS |
| /content-security-policy/script-src/worker-function-function-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["Function() function blocked"] | PASS |
| /content-security-policy/style-src/style-src-inline-style-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Inline style should apply with 'unsafe-inline' | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-same-star-allow.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a value '*' should render in nested frames. | NOTRUN |
| /content-security-policy/navigate-to/form-cross-origin-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the child iframe navigation is allowed | PASS |
| /content-security-policy/style-src/style-src-hash-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| All style elements should load because they have proper hashes | PASS |
| /content-security-policy/unsafe-eval/eval-blocked-and-sends-report.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS: eval() blocked.","violated-directive=script-src"] | PASS |
| /content-security-policy/style-src/style-src-injected-inline-style-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Injected inline style should load with 'unsafe-inline' | PASS |
| /content-security-policy/navigate-to/href-location-cross-origin-allowed.sub.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Test that the child iframe navigation is allowed | NOTRUN |
| /content-security-policy/navigation/javascript-url-navigation-inherits-csp.html (1/1, 100.00%, 0.11% of total) | OK |
| javascript-url-navigation-inherits-csp | FAIL |
| /content-security-policy/script-src/hash-always-converted-to-utf-8/utf-8-lone-surrogate.html (1/1, 100.00%, 0.11% of total) | OK |
| Should convert the script contents to UTF-8 before hashing | PASS |
| /content-security-policy/unsafe-eval/eval-scripts-setTimeout-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS 1 of 2","PASS 2 of 2"] | PASS |
| /content-security-policy/navigate-to/link-click-redirected-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that the child iframe navigation is not allowed | FAIL |
| Violation report status OK. | FAIL |
| /content-security-policy/meta/meta-img-src.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS","TEST COMPLETE"] | PASS |
| /content-security-policy/worker-src/service-list.https.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Same-origin service worker allowed by host-source expression. | PASS |
| /content-security-policy/worker-src/service-worker-src-default-fallback.https.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Same-origin service worker allowed by default-src 'self'. | PASS |
| /content-security-policy/navigate-to/link-click-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the child iframe navigation is allowed | PASS |
| /content-security-policy/img-src/img-src-wildcard-allowed.html (2/2, 100.00%, 0.22% of total) | OK |
| img-src with wildcard should match all | PASS |
| img-src with wildcard should not match blob | PASS |
| /content-security-policy/reporting/report-blocked-data-uri.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/reporting/report-blocked-uri.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/style-src/style-src-imported-style-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Imported style that violates policy should not load | PASS |
| /content-security-policy/reporting/report-uri-scheme-relative.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/style-src/style-src-none-blocked.html (2/2, 100.00%, 0.22% of total) | OK |
| Should fire a securitypolicyviolation event | PASS |
| Should not stylesheet when style-src is 'none' | PASS |
| /content-security-policy/base-uri/report-uri-does-not-respect-base-uri.sub.html (3/3, 100.00%, 0.33% of total) | OK |
| Event is fired | PASS |
| Test that image does not load | PASS |
| Violation report status OK. | PASS |
| /content-security-policy/style-src-attr-elem/style-src-elem-allowed-attr-blocked.html (2/2, 100.00%, 0.22% of total) | TIMEOUT |
| Should fire a security policy violation for the attribute | NOTRUN |
| The attribute style should not be applied and the inline style should be applied | PASS |
| /content-security-policy/style-src/style-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS"] | PASS |
| /content-security-policy/navigate-to/parent-navigates-child-blocked.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that the parent can't navigate the child because the relevant policy belongs to the navigation initiator (in this case the parent, which has the policy `navigate-to support/wait_for_navigation.html;`) | FAIL |
| Violation report status OK. | FAIL |
| /content-security-policy/child-src/child-src-allowed.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Expecting alerts: ["PASS"] | PASS |
| Expecting logs: ["PASS IFrame #1 generated a load event."] | PASS |
| /content-security-policy/reporting/report-and-enforce.html (3/3, 100.00%, 0.33% of total) | OK |
| The image should be blocked | PASS |
| The stylesheet should load | PASS |
| Violation report status OK. | PASS |
| /content-security-policy/generic/generic-0_2_2.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Prevents access to external scripts. | PASS |
| Should fire violation events for every failed violation | PASS |
| /content-security-policy/securitypolicyviolation/inside-service-worker.https.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| undefined | TIMEOUT |
| /content-security-policy/script-src/script-src-1_10_1.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that no report violation event was raised | PASS |
| Verify that data: as script src runs with this policy | PASS |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-host_sources-hosts.html (5/5, 100.00%, 0.55% of total) | OK |
| A wildcard host should match a more specific host. | PASS |
| Host must match. | PASS |
| Hosts without wildcards must match. | PASS |
| More specific subdomain should not match. | PASS |
| Specified host should not match a wildcard host. | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-same-in-cross-self-block.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a value 'same' should block render in same-origin nested frames. | NOTRUN |
| /content-security-policy/generic/generic-0_2.html (1/1, 100.00%, 0.11% of total) | OK |
| Should fire violation events for every failed violation | PASS |
| /content-security-policy/style-src-attr-elem/style-src-attr-allowed-src-blocked.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| undefined | TIMEOUT |
| /content-security-policy/script-src/hash-always-converted-to-utf-8/iso-8859-7.html (1/1, 100.00%, 0.11% of total) | OK |
| Should convert the script contents to UTF-8 before hashing | FAIL |
| /content-security-policy/script-src/script-src-1_4_1.html (3/3, 100.00%, 0.33% of total) | OK |
| Test that securitypolicyviolation event is fired | PASS |
| window.setInterval() | PASS |
| window.setTimeout() | PASS |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-general.html (8/8, 100.00%, 0.88% of total) | OK |
| If there is no required csp, iframe should load. | PASS |
| Iframe should load even if the ports are different but are default for the protocols. | PASS |
| Iframe with a different CSP should be blocked. | PASS |
| Iframe with a matching and more restrictive ports should load. | PASS |
| Iframe with empty returned CSP should be blocked. | PASS |
| Iframe with less restricting CSP should be blocked. | PASS |
| Iframe with matching CSP should load. | PASS |
| Iframe with more restricting CSP should load. | PASS |
| /content-security-policy/media-src/media-src-7_1_2.sub.html (3/3, 100.00%, 0.33% of total) | OK |
| Disallowed async video source element | PASS |
| Disallowed async video src | PASS |
| Test that securitypolicyviolation events are fired | PASS |
| /content-security-policy/style-src/inline-style-attribute-on-html.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS"] | PASS |
| /content-security-policy/script-src/scripthash-unicode-normalization.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Only matching content runs even with NFC normalization. | PASS |
| Should fire securitypolicyviolation | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-same-in-same-self-allow.html (1/1, 100.00%, 0.11% of total) | OK |
| A 'frame-ancestors' CSP directive with a value 'same' should block render in same-origin nested frames. | PASS |
| /content-security-policy/script-src/hash-always-converted-to-utf-8/utf-8.html (3/3, 100.00%, 0.33% of total) | OK |
| Should convert the script contents to UTF-8 before hashing - greek small letter mu | PASS |
| Should convert the script contents to UTF-8 before hashing - latin capital letter g with breve | PASS |
| Should convert the script contents to UTF-8 before hashing - latin micro sign | PASS |
| /content-security-policy/navigate-to/link-click-cross-origin-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that the child iframe navigation is not allowed | FAIL |
| Violation report status OK. | FAIL |
| /content-security-policy/plugin-types/plugintypes-nourl-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/frame-src/frame-src-about-blank-allowed-by-scheme.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS"] | PASS |
| /content-security-policy/style-src/style-src-imported-style-blocked.html (2/2, 100.00%, 0.22% of total) | OK |
| @import stylesheet should not load because it does not match style-src | PASS |
| Should fire a securitypolicyviolation event | PASS |
| /content-security-policy/script-src/script-src-wildcards-disallowed.html (3/3, 100.00%, 0.33% of total) | OK |
| blob: URIs should not match * | PASS |
| data: URIs should not match * | PASS |
| filesystem URIs should not match * | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-self-block.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a value 'self' should block rendering. | NOTRUN |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-cross-self-block.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a value 'same' should block render in same-origin nested frames. | NOTRUN |
| /content-security-policy/worker-src/shared-list.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Same-origin dedicated worker allowed by 'self'. | PASS |
| blob: dedicated worker allowed by 'blob:'. | PASS |
| /content-security-policy/generic/only-valid-whitespaces-are-allowed.html (24/24, 100.00%, 2.63% of total) | OK |
| Should load image without any CSP - HTTP header | PASS |
| Should load image without any CSP - meta tag | PASS |
| Should not load image with 'none' CSP - HTTP header | PASS |
| Should not load image with 'none' CSP - meta tag | PASS |
| U+0009 TAB should be properly parsed between directive name and value - HTTP header | PASS |
| U+0009 TAB should be properly parsed between directive name and value - meta tag | PASS |
| U+0009 TAB should be properly parsed inside directive value - HTTP header | PASS |
| U+0009 TAB should be properly parsed inside directive value - meta tag | PASS |
| U+000A LF should be properly parsed between directive name and value - meta tag | PASS |
| U+000A LF should be properly parsed inside directive value - meta tag | PASS |
| U+000C FF should be properly parsed between directive name and value - HTTP header | PASS |
| U+000C FF should be properly parsed between directive name and value - meta tag | PASS |
| U+000C FF should be properly parsed inside directive value - HTTP header | PASS |
| U+000C FF should be properly parsed inside directive value - meta tag | PASS |
| U+000D CR should be properly parsed between directive name and value - meta tag | PASS |
| U+000D CR should be properly parsed inside directive value - meta tag | PASS |
| U+0020 SPACE should be properly parsed between directive name and value - HTTP header | PASS |
| U+0020 SPACE should be properly parsed between directive name and value - meta tag | PASS |
| U+0020 SPACE should be properly parsed inside directive value - HTTP header | PASS |
| U+0020 SPACE should be properly parsed inside directive value - meta tag | PASS |
| U+00A0 NBSP should not be parsed between directive name and value - HTTP header | PASS |
| U+00A0 NBSP should not be parsed between directive name and value - meta tag | PASS |
| U+00A0 NBSP should not be parsed inside directive value - HTTP header | PASS |
| U+00A0 NBSP should not be parsed inside directive value - meta tag | PASS |
| /content-security-policy/securitypolicyviolation/inside-dedicated-worker.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| undefined | TIMEOUT |
| /content-security-policy/unsafe-eval/eval-scripts-setTimeout-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS","violated-directive=script-src"] | PASS |
| /content-security-policy/worker-src/dedicated-self.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Same-origin dedicated worker allowed by 'self'. | PASS |
| /content-security-policy/generic/policy-inherited-correctly-by-plznavigate.html (2/2, 100.00%, 0.22% of total) | OK |
| Violation report status OK. | PASS |
| iframe still inherits correct CSP | PASS |
| /content-security-policy/sandbox/sandbox-allow-scripts.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["Message"] | PASS |
| /content-security-policy/base-uri/base-uri-deny.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Check that baseURI fires a securitypolicyviolation event when it does not match the csp directive | PASS |
| Check that the baseURI is not set when it does not match the csp directive | PASS |
| /content-security-policy/sandbox/sandbox-empty-subframe.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS2"] | PASS |
| /content-security-policy/script-src/script-src-overrides-default-src.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS 1 of 2","PASS 2 of 2"] | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-same-url-block.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a URL value should block or allow rendering in nested frames as appropriate. | NOTRUN |
| /content-security-policy/script-src/script-src-1_4_2.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that securitypolicyviolation event is fired | PASS |
| Unsafe eval ran in Function() constructor. | PASS |
| /content-security-policy/connect-src/connect-src-beacon-redirect-to-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=connect-src"] | PASS |
| /content-security-policy/object-src/object-src-url-redirect-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Should block the object and fire a spv | PASS |
| /content-security-policy/worker-src/shared-none.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Same-origin shared worker blocked by 'none'. | PASS |
| blob: shared worker blocked by 'none'. | PASS |
| /content-security-policy/style-src/style-src-multiple-policies-multiple-hashing-algorithms.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that style loads if allowed by proper hash values | PASS |
| Violation report status OK. | PASS |
| /content-security-policy/unsafe-hashes/style_attribute_allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the inline style attribute is loaded | FAIL |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-none.html (18/18, 100.00%, 1.98% of total) | OK |
| Both required and returned csp are `none` for only one directive. | PASS |
| Both required and returned csp are `none`. | PASS |
| Both required and returned csp are effectively 'none'. | PASS |
| Both required and returned csp are empty. | PASS |
| Empty required csp subsumes a policy with `none`. | PASS |
| Empty required csp subsumes any list of policies. | PASS |
| Empty required csp subsumes empty list of returned policies. | PASS |
| Required csp with `none` does not subsume `none` of another directive. | PASS |
| Required csp with `none` does not subsume `none` of different directives. | PASS |
| Required csp with `none` does not subsume a host source expression. | PASS |
| Required csp with `none` subsumes effective list of `none` despite other keywords. | PASS |
| Required csp with `none` subsumes effective list of `none`. | PASS |
| Required csp with effective `none` does not subsume `none` of another directive. | PASS |
| Required csp with effective `none` does not subsume a host source expression. | PASS |
| Required policy that allows `none` does not subsume empty list of policies. | PASS |
| Returned csp with `none` is subsumed by any required csp. | PASS |
| Returned csp with effective `none` is subsumed by any required csp. | PASS |
| Source list with exprssions other than `none` make `none` ineffective. | PASS |
| /content-security-policy/unsafe-eval/function-constructor-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS EvalError","violated-directive=script-src"] | PASS |
| /content-security-policy/generic/duplicate-directive.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS (1/1)"] | PASS |
| /content-security-policy/navigate-to/link-click-cross-origin-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the child iframe navigation is allowed | PASS |
| /content-security-policy/generic/policy-does-not-affect-child.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS"] | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-cross-url-block.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a URL value should block or allow rendering in nested frames as appropriate. | NOTRUN |
| /content-security-policy/style-src/style-src-inline-style-nonce-blocked.html (2/2, 100.00%, 0.22% of total) | OK |
| Should fire a securitypolicyviolation event | PASS |
| Should not load inline style element with invalid nonce | PASS |
| /content-security-policy/blob/blob-urls-do-not-match-self.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=script-src-elem"] | PASS |
| /content-security-policy/font-src/font-self-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Test font loads if it matches font-src. | PASS |
| /content-security-policy/script-src/worker-script-src.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS"] | PASS |
| /content-security-policy/style-src/style-src-inline-style-nonce-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Style with correct nonce should load | PASS |
| /content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Event is fired | PASS |
| Test that image does not load | PASS |
| /content-security-policy/media-src/media-src-redir-bug.sub.html (5/5, 100.00%, 0.55% of total) | TIMEOUT |
| In-policy async video source element | NOTRUN |
| In-policy async video source element w/redir | NOTRUN |
| In-policy async video src | NOTRUN |
| Should not fire policy violation events | NOTRUN |
| in-policy async video src w/redir | NOTRUN |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-unsafe_eval.html (7/7, 100.00%, 0.77% of total) | OK |
| 'unsafe-eval' is properly subsumed. | PASS |
| Effective policy is properly found where 'unsafe-eval' is not part of it. | PASS |
| Effective policy is properly found where 'unsafe-eval' is not subsumed. | PASS |
| Effective policy is properly found. | PASS |
| No other keyword has the same effect as 'unsafe-eval'. | PASS |
| Other expressions have to be subsumed. | PASS |
| Required csp must allow 'unsafe-eval'. | PASS |
| /content-security-policy/child-src/child-src-conflicting-frame-src.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS IFrame #1 generated a load event.", "violated-directive=frame-src"] | PASS |
| /content-security-policy/script-src/scripthash-default-src.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| script-hash allowed from default-src | PASS |
| /content-security-policy/navigate-to/form-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the child iframe navigation is allowed | PASS |
| /content-security-policy/connect-src/connect-src-beacon-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["Pass", "violated-directive=connect-src"] | PASS |
| /content-security-policy/worker-src/dedicated-list.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Same-origin dedicated worker allowed by host-source expression. | PASS |
| blob: dedicated worker allowed by 'blob:'. | PASS |
| /content-security-policy/navigate-to/child-navigates-parent-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the child can navigate the parent because the relevant policy belongs to the navigation initiator (in this case the child, which has the policy `navigate-to 'self'`) | PASS |
| /content-security-policy/script-src-attr-elem/script-src-attr-blocked-src-allowed.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Should fire a security policy violation event | NOTRUN |
| /content-security-policy/media-src/media-src-7_2_2.sub.html (3/3, 100.00%, 0.33% of total) | OK |
| Disallaowed audio src | PASS |
| Disallowed audio source element | PASS |
| Test that securitypolicyviolation events are fired | PASS |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-hashes.html (13/13, 100.00%, 1.43% of total) | OK |
| 'sha256-abc123' is not subsumed by 'sha256-abc456'. | PASS |
| 'sha256-abc123' is properly subsumed with other sources. | PASS |
| 'sha256-abc123' is properly subsumed. | PASS |
| Effective policy is properly found where 'sha256-abc123' is not part of it. | PASS |
| Effective policy is properly found where 'sha256-abc123' is not subsumed. | PASS |
| Effective policy is properly found. | PASS |
| Effective policy now does not allow 'sha256-abc123'. | PASS |
| Hashes do not have to be present in returned csp but must not allow all inline behavior. | PASS |
| Hashes do not have to be present in returned csp. | PASS |
| Other expressions have to be subsumed but 'unsafe-inline' gets ignored. | PASS |
| Other expressions have to be subsumed. | PASS |
| Required csp must allow 'sha256-abc123'. | PASS |
| Returned should not include hashes not present in required csp. | PASS |
| /content-security-policy/unsafe-eval/eval-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS EvalError","PASS EvalError", "violated-directive=script-src"] | PASS |
| /content-security-policy/script-src/eval-allowed-in-report-only-mode-and-sends-report.html (2/2, 100.00%, 0.22% of total) | OK |
| Eval is allowed because the CSP is report-only | PASS |
| Violation report status OK. | PASS |
| /content-security-policy/generic/generic-0_2_3.html (2/2, 100.00%, 0.22% of total) | OK |
| Prevents access to external scripts. | PASS |
| Should fire violation events for every failed violation | PASS |
| /content-security-policy/style-src-attr-elem/style-src-elem-blocked-attr-allowed.html (2/2, 100.00%, 0.22% of total) | TIMEOUT |
| Should fire a security policy violation for the inline block | NOTRUN |
| The inline style should not be applied and the attribute style should be applied | FAIL |
| /content-security-policy/img-src/img-src-host-partial-wildcard-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| img src matches correctly partial wildcard host csp directive | PASS |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-unsafe_inline.html (16/16, 100.00%, 1.76% of total) | OK |
| 'strict-dynamic' is ineffective for `style-src`. | PASS |
| 'unsafe-inline' does not matter if returned csp is effectively `none`. | PASS |
| 'unsafe-inline' is ineffective when nonces are present. | PASS |
| 'unsafe-inline' is only ineffective if the effective returned csp has hashes in `script-src`. | PASS |
| 'unsafe-inline' is only ineffective if the effective returned csp has hashes in `style-src`. | PASS |
| 'unsafe-inline' is only ineffective if the effective returned csp has nonces in `style-src`. | PASS |
| 'unsafe-inline' is properly subsumed in `script-src`. | PASS |
| 'unsafe-inline' is properly subsumed in `style-src`. | PASS |
| Effective returned csp allows 'unsafe-inline' | PASS |
| Effective returned csp does not allow 'sha512-321cba' hash. | PASS |
| Required csp allows `strict-dynamic`, but retuned csp does. | PASS |
| Required csp does not allow `unsafe-inline`, but retuned csp does. | PASS |
| Returned csp does not have to allow 'unsafe-inline' in `style-src` to be subsumed. | PASS |
| Returned csp only loads 'unsafe-inline' scripts with 'nonce-abc'. | PASS |
| Returned csp whitelists a hash. | PASS |
| Returned csp whitelists a nonce. | PASS |
| /content-security-policy/securitypolicyviolation/blockeduri-eval.html (1/1, 100.00%, 0.11% of total) | OK |
| Eval violations have a blockedURI of 'eval' | FAIL |
| /content-security-policy/securitypolicyviolation/inside-shared-worker.html (3/3, 100.00%, 0.33% of total) | TIMEOUT |
| No SecurityPolicyViolation event fired for successful load. | PASS |
| SecurityPolicyViolation event fired on global with the correct blockedURI. | TIMEOUT |
| SecurityPolicyViolation event fired on global. | PASS |
| /content-security-policy/connect-src/connect-src-websocket-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["blocked","violated-directive=connect-src"] | PASS |
| /content-security-policy/navigate-to/meta-refresh-redirected-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that the child iframe navigation is not allowed | FAIL |
| Violation report status OK. | FAIL |
| /content-security-policy/style-src/style-src-inline-style-nonce-blocked-error-event.html (2/2, 100.00%, 0.22% of total) | OK |
| Should fire a securitypolicyviolation event | PASS |
| Test that paragraph remains unmodified and error events received. | PASS |
| /content-security-policy/child-src/child-src-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS IFrame #1 generated a load event.", "violated-directive=frame-src"] | PASS |
| /content-security-policy/img-src/img-src-full-host-wildcard-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| img src does not match full host and wildcard csp directive | PASS |
| /content-security-policy/generic/filesystem-urls-do-not-match-self.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=script-src-elem"] | PASS |
| /content-security-policy/meta/meta-modified.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS", "PASS","TEST COMPLETE"] | PASS |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-self.html (7/7, 100.00%, 0.77% of total) | OK |
| 'self' keywords should match. | PASS |
| Required 'self' should match to a origin's url. | PASS |
| Required 'self' should subsume a more secure version of origin's url. | PASS |
| Returned 'self' should match to an origin's url. | PASS |
| Returned 'self' should not be subsumed by a more secure version of origin's url. | PASS |
| Returned CSP does not have to specify 'self'. | PASS |
| Returned CSP must not allow 'self' if required CSP does not. | PASS |
| /content-security-policy/script-src/script-src-1_3.html (2/2, 100.00%, 0.22% of total) | OK |
| Inline script in a script tag should run with an unsafe-inline directive | PASS |
| Should not fire policy violation events | PASS |
| /content-security-policy/script-src/scripthash-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS (1/4)","PASS (2/4)","PASS (3/4)","PASS (4/4)"] | PASS |
| /content-security-policy/securitypolicyviolation/constructor-required-fields.html (14/14, 100.00%, 1.54% of total) | OK |
| SecurityPolicyViolationEvent constructor does not require blockedURI | PASS |
| SecurityPolicyViolationEvent constructor does not require columnNumber | PASS |
| SecurityPolicyViolationEvent constructor does not require lineNumber | PASS |
| SecurityPolicyViolationEvent constructor does not require referrer | PASS |
| SecurityPolicyViolationEvent constructor does not require sample | PASS |
| SecurityPolicyViolationEvent constructor does not require sourceFile | PASS |
| SecurityPolicyViolationEvent constructor requires disposition | PASS |
| SecurityPolicyViolationEvent constructor requires documentURI | PASS |
| SecurityPolicyViolationEvent constructor requires effectiveDirective | PASS |
| SecurityPolicyViolationEvent constructor requires originalPolicy | PASS |
| SecurityPolicyViolationEvent constructor requires statusCode | PASS |
| SecurityPolicyViolationEvent constructor requires violatedDirective | PASS |
| SecurityPolicyViolationEvent constructor should throw with no parameters | PASS |
| SecurityPolicyViolationEvent constructor works with an init dict | PASS |
| /content-security-policy/connect-src/connect-src-xmlhttprequest-redirect-to-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS XMLHttpRequest.send() did not follow the disallowed redirect.","TEST COMPLETE","violated-directive=connect-src"] | PASS |
| /content-security-policy/navigate-to/spv-only-sent-to-initiator.sub.html (2/2, 100.00%, 0.22% of total) | TIMEOUT |
| Test that no spv event is raised | NOTRUN |
| Violation report status OK. | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-self-allow.html (1/1, 100.00%, 0.11% of total) | OK |
| A 'frame-ancestors' CSP directive with a value 'self' should allow rendering. | PASS |
| /content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Non-redirected cross-origin URLs are not stripped. | PASS |
| /content-security-policy/worker-src/dedicated-child.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Same-origin dedicated worker allowed by host-source expression. | PASS |
| blob: dedicated worker allowed by 'blob:'. | PASS |
| /content-security-policy/img-src/icon-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that image does not load | PASS |
| Test that spv event is fired | PASS |
| /content-security-policy/script-src/script-src-1_1.html (3/3, 100.00%, 0.33% of total) | OK |
| Inline event handler | PASS |
| Inline script block | PASS |
| Should fire policy violation events | PASS |
| /content-security-policy/script-src/scriptnonce-redirect.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS"] | PASS |
| /content-security-policy/generic/generic-0_9.sub.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Test that script does not fire violation event | PASS |
| /content-security-policy/style-src/style-src-stylesheet-nonce-blocked.html (2/2, 100.00%, 0.22% of total) | OK |
| Should fire a securitypolicyviolation event | PASS |
| Should not load stylesheet without correct nonce | PASS |
| /content-security-policy/generic/generic-0_8.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that script does not fire violation event | PASS |
| /content-security-policy/navigate-to/form-action/form-action-allows-navigate-to-allows.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that form-action overrides navigate-to when present. | PASS |
| /content-security-policy/form-action/form-action-src-allowed-target-blank.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| form submission targetting _blank allowed after a redirect | PASS |
| /content-security-policy/default-src/default-src-inline-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=script-src-elem","violated-directive=script-src-elem"] | PASS |
| /content-security-policy/style-src/inline-style-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS"] | PASS |
| /content-security-policy/unsafe-eval/function-constructor-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS"] | PASS |
| /content-security-policy/reporting/report-same-origin-with-cookies.html (3/3, 100.00%, 0.33% of total) | OK |
| Image should not load | PASS |
| Test report cookies. | FAIL |
| Violation report status OK. | PASS |
| /content-security-policy/worker-src/shared-child.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Same-origin dedicated worker allowed by 'self'. | PASS |
| blob: dedicated worker allowed by 'blob:'. | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-star-allow-sameorigin.html (1/1, 100.00%, 0.11% of total) | OK |
| A 'frame-ancestors' CSP directive with '*' should allow rendering. | PASS |
| /content-security-policy/media-src/media-src-7_2.html (3/3, 100.00%, 0.33% of total) | TIMEOUT |
| In-policy audio source element | NOTRUN |
| In-policy audio src | NOTRUN |
| Should not fire policy violation events | NOTRUN |
| /content-security-policy/unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-window_location.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Test that the javascript: src is not allowed to run | NOTRUN |
| /content-security-policy/media-src/media-src-7_3.sub.html (2/2, 100.00%, 0.22% of total) | TIMEOUT |
| In-policy track element | NOTRUN |
| Should not fire policy violation events | NOTRUN |
| /content-security-policy/connect-src/shared-worker-connect-src-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["xhr allowed","TEST COMPLETE"] | PASS |
| /content-security-policy/plugin-types/plugintypes-empty.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Should not load the object because plugin-types allows no plugins | PASS |
| /content-security-policy/navigate-to/href-location-redirected-allowed.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Test that the child iframe navigation is allowed | NOTRUN |
| /content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-2.https.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Event is fired | PASS |
| Test that image does not load | PASS |
| /content-security-policy/plugin-types/plugintypes-nourl-blocked.html (1/1, 100.00%, 0.11% of total) | OK |
| Should not load the object because it does not match plugin-types | PASS |
| /content-security-policy/inheritance/iframe-all-local-schemes.sub.html (6/6, 100.00%, 0.66% of total) | OK |
| <iframe sandbox src='blob:...'>'s inherits policy. (opaque origin sandbox) | PASS |
| <iframe src='blob:...'>'s inherits policy. | PASS |
| <iframe src='data:...'>'s inherits policy. | PASS |
| <iframe src='javascript:...'>'s inherits policy. | PASS |
| <iframe srcdoc>'s inherits policy. | PASS |
| <iframe>'s about:blank inherits policy. | PASS |
| /content-security-policy/object-src/object-src-no-url-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-overrides-xfo.html (2/2, 100.00%, 0.22% of total) | OK |
| A 'frame-ancestors' CSP directive overrides an 'x-frame-options' header which would allow the page. | PASS |
| A 'frame-ancestors' CSP directive overrides an 'x-frame-options' header which would block the page. | PASS |
| /content-security-policy/script-src/scriptnonce-ignore-unsafeinline.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS (1/2)","PASS (2/2)", "violated-directive=script-src-elem"] | PASS |
| /content-security-policy/script-src/script-src-1_2_1.html (2/2, 100.00%, 0.22% of total) | OK |
| DOM manipulation inline tests | PASS |
| Test that securitypolicyviolation event is fired | PASS |
| /content-security-policy/inheritance/iframe-srcdoc-inheritance.html (2/2, 100.00%, 0.22% of total) | OK |
| First image should be blocked | PASS |
| Second image should be blocked | PASS |
| /content-security-policy/script-src/srcdoc-doesnt-bypass-script-src.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=script-src-elem"] | PASS |
| /content-security-policy/unsafe-eval/eval-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS (1 of 2)","PASS (2 of 2)"] | PASS |
| /content-security-policy/script-src/hash-always-converted-to-utf-8/iso-8859-9.html (1/1, 100.00%, 0.11% of total) | OK |
| Should convert the script contents to UTF-8 before hashing | FAIL |
| /content-security-policy/frame-src/frame-src-about-blank-allowed-by-default.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS"] | PASS |
| /content-security-policy/script-src-attr-elem/script-src-elem-blocked-attr-allowed.html (2/2, 100.00%, 0.22% of total) | TIMEOUT |
| Should execute the inline script attribute | PASS |
| Should fire a security policy violation for the attribute | NOTRUN |
| /content-security-policy/connect-src/shared-worker-connect-src-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["xhr blocked","TEST COMPLETE"] | PASS |
| /content-security-policy/connect-src/worker-from-guid.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=connect-src","xhr blocked","TEST COMPLETE"] | FAIL |
| /content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Check that frames load without throwing any violation events | PASS |
| /content-security-policy/font-src/font-match-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test font loads if it matches font-src. | PASS |
| /content-security-policy/reporting/report-blocked-uri-cross-origin.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/script-src/worker-eval-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["eval blocked"] | PASS |
| /content-security-policy/style-src/stylenonce-allowed.sub.html (3/3, 100.00%, 0.33% of total) | OK |
| Should fire securitypolicyviolation | PASS |
| stylenonce-allowed | PASS |
| stylenonce-allowed 1 | PASS |
| /content-security-policy/form-action/form-action-src-get-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS","TEST COMPLETE"] | PASS |
| /content-security-policy/navigate-to/link-click-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that the child iframe navigation is not allowed | FAIL |
| Violation report status OK. | FAIL |
| /content-security-policy/frame-src/frame-src-cross-origin-load.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Expecting alerts: ["PASS","PASS"] | PASS |
| Expecting logs: ["PASS IFrame #1 generated a load event.","PASS IFrame #2 generated a load event.","PASS IFrame #3 generated a load event.","violated-directive=frame-src"] | PASS |
| /content-security-policy/sandbox/window-reuse-sandboxed.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Window object should not be reused | NOTRUN |
| /content-security-policy/navigate-to/form-redirected-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that the child iframe navigation is not allowed | FAIL |
| Violation report status OK. | FAIL |
| /content-security-policy/frame-src/frame-src-self-unique-origin.html (1/1, 100.00%, 0.11% of total) | OK |
| Iframe's url must not match with 'self'. It must be blocked. | PASS |
| /content-security-policy/connect-src/connect-src-eventsource-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["allowed"] | PASS |
| /content-security-policy/inheritance/inherited-csp-list-modifications-are-local.html (3/3, 100.00%, 0.33% of total) | OK |
| Test that embedded iframe document image does not load | PASS |
| Test that parent document image loads | PASS |
| Test that spv event is fired | PASS |
| /content-security-policy/img-src/img-src-4_1.sub.html (3/3, 100.00%, 0.33% of total) | OK |
| img-src for relative path should load | PASS |
| img-src from approved domains should load | PASS |
| img-src from unapproved domains should not load | PASS |
| /content-security-policy/inheritance/blob-url-in-main-window-self-navigate-inherits.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/securitypolicyviolation/idlharness.window.html (41/41, 100.00%, 4.50% of total) | OK |
| SecurityPolicyViolationEvent interface object length | PASS |
| SecurityPolicyViolationEvent interface object name | PASS |
| SecurityPolicyViolationEvent interface: attribute blockedURI | PASS |
| SecurityPolicyViolationEvent interface: attribute blockedURL | FAIL |
| SecurityPolicyViolationEvent interface: attribute colno | FAIL |
| SecurityPolicyViolationEvent interface: attribute columnNumber | PASS |
| SecurityPolicyViolationEvent interface: attribute disposition | PASS |
| SecurityPolicyViolationEvent interface: attribute documentURI | PASS |
| SecurityPolicyViolationEvent interface: attribute documentURL | FAIL |
| SecurityPolicyViolationEvent interface: attribute effectiveDirective | PASS |
| SecurityPolicyViolationEvent interface: attribute lineNumber | PASS |
| SecurityPolicyViolationEvent interface: attribute lineno | FAIL |
| SecurityPolicyViolationEvent interface: attribute originalPolicy | PASS |
| SecurityPolicyViolationEvent interface: attribute referrer | PASS |
| SecurityPolicyViolationEvent interface: attribute sample | PASS |
| SecurityPolicyViolationEvent interface: attribute sourceFile | PASS |
| SecurityPolicyViolationEvent interface: attribute statusCode | PASS |
| SecurityPolicyViolationEvent interface: attribute violatedDirective | PASS |
| SecurityPolicyViolationEvent interface: existence and properties of interface object | PASS |
| SecurityPolicyViolationEvent interface: existence and properties of interface prototype object | PASS |
| SecurityPolicyViolationEvent interface: existence and properties of interface prototype object's "constructor" property | PASS |
| SecurityPolicyViolationEvent interface: existence and properties of interface prototype object's @@unscopables property | PASS |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "blockedURI" with the proper type | PASS |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "blockedURL" with the proper type | FAIL |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "colno" with the proper type | FAIL |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "columnNumber" with the proper type | PASS |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "disposition" with the proper type | PASS |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "documentURI" with the proper type | PASS |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "documentURL" with the proper type | FAIL |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "effectiveDirective" with the proper type | PASS |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "lineNumber" with the proper type | PASS |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "lineno" with the proper type | FAIL |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "originalPolicy" with the proper type | PASS |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "referrer" with the proper type | PASS |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "sample" with the proper type | PASS |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "sourceFile" with the proper type | PASS |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "statusCode" with the proper type | PASS |
| SecurityPolicyViolationEvent interface: new SecurityPolicyViolationEvent("securitypolicyviolation") must inherit property "violatedDirective" with the proper type | PASS |
| SecurityPolicyViolationEvent must be primary interface of new SecurityPolicyViolationEvent("securitypolicyviolation") | PASS |
| Stringification of new SecurityPolicyViolationEvent("securitypolicyviolation") | PASS |
| idl_test setup | PASS |
| /content-security-policy/securitypolicyviolation/style-sample-no-opt-in.html (2/2, 100.00%, 0.22% of total) | OK |
| Inline style attributes should not have a sample. | PASS |
| Inline style blocks should not have a sample. | PASS |
| /content-security-policy/reporting/report-strips-fragment.html (1/1, 100.00%, 0.11% of total) | OK |
| Reported document URI does not contain fragments. | PASS |
| /content-security-policy/media-src/media-src-7_3_2.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Disallowed track element onerror handler fires. | PASS |
| Test that securitypolicyviolation events are fired | PASS |
| /content-security-policy/form-action/form-action-self-allowed-target-blank.html (1/1, 100.00%, 0.11% of total) | OK |
| The form submission should not be blocked by the iframe's CSP. | PASS |
| /content-security-policy/style-src/inline-style-attribute-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=style-src-attr","PASS"] | PASS |
| /content-security-policy/script-src/injected-inline-script-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=script-src-elem",] | PASS |
| /content-security-policy/generic/generic-0_10.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that script does not fire violation event | PASS |
| /content-security-policy/script-src/script-src-strict_dynamic_discard_whitelist.html (1/1, 100.00%, 0.11% of total) | OK |
| Whitelisted script without a correct nonce is not allowed with `strict-dynamic`. | PASS |
| /content-security-policy/connect-src/connect-src-beacon-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["Pass"] | PASS |
| /content-security-policy/script-src/hash-always-converted-to-utf-8/iso-8859-1.html (1/1, 100.00%, 0.11% of total) | OK |
| Should convert the script contents to UTF-8 before hashing | FAIL |
| /content-security-policy/navigation/to-javascript-parent-initiated-parent-csp.html (1/1, 100.00%, 0.11% of total) | OK |
| Should not have executed the javascript url | PASS |
| /content-security-policy/plugin-types/plugintypes-notype-data.html (1/1, 100.00%, 0.11% of total) | OK |
| Should not load the object because it does not have a declared type | PASS |
| /content-security-policy/unsafe-hashes/style_attribute_denied_wrong_hash.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the inline style attribute is blocked | PASS |
| /content-security-policy/img-src/icon-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that image loads | PASS |
| /content-security-policy/style-src/style-src-inline-style-attribute-blocked.html (2/2, 100.00%, 0.22% of total) | OK |
| Inline style attribute should not be applied without 'unsafe-inline' | PASS |
| Should fire a securitypolicyviolation event | PASS |
| /content-security-policy/style-src/style-src-injected-inline-style-blocked.html (2/2, 100.00%, 0.22% of total) | OK |
| Injected style attributes should not be applied | PASS |
| Should fire a securitypolicyviolation event | PASS |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-host_sources-protocols.html (11/11, 100.00%, 1.21% of total) | OK |
| All scheme sources are subsumed by their stronger variants. | PASS |
| All scheme sources must be subsumed. | PASS |
| If scheme source is present in returned csp, it must be specified in required csp too. | PASS |
| Matching `https` protocols. | PASS |
| The reverse allows iframe be to be loaded. | PASS |
| `http:` does not subsume other protocols. | PASS |
| `http:` should subsume all host source expressions with `https:`. | PASS |
| `http:` should subsume all host source expressions with this protocol. | PASS |
| `http:` subsumes other `http:` source expression. | PASS |
| `http:` subsumes other `https:` source expression and expressions with `http:`. | PASS |
| `https` is more restrictive than `http`. | PASS |
| /content-security-policy/frame-src/frame-src-redirect.html (1/1, 100.00%, 0.11% of total) | OK |
| Redirected iframe src should evaluate both enforced and report-only policies on both original request and when following redirect | PASS |
| /content-security-policy/style-src/style-src-inline-style-attribute-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Inline style attribute should apply with 'unsafe-inline' | PASS |
| /content-security-policy/generic/no-default-src.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Allows scripts from the same host. | PASS |
| Violation report status OK. | PASS |
| /content-security-policy/prefetch-src/prefetch-header-allowed.html (3/3, 100.00%, 0.33% of total) | OK |
| Browser supports performance APIs. | PASS |
| Browser supports prefetch. | PASS |
| Prefetch via `Link` header succeeds when allowed by prefetch-src | PASS |
| /content-security-policy/unsafe-eval/eval-blocked-in-about-blank-iframe.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=script-src","PASS"] | FAIL |
| /content-security-policy/script-src/script-src-1_4.html (3/3, 100.00%, 0.33% of total) | OK |
| Test that securitypolicyviolation event is fired | PASS |
| eval() should not run without 'unsafe-eval' script-src directive. | PASS |
| eval() should throw without 'unsafe-eval' keyword source in script-src directive. | PASS |
| /content-security-policy/form-action/form-action-src-redirect-allowed-target-frame.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| form submission targetting a frame allowed after a redirect | PASS |
| /content-security-policy/navigate-to/href-location-cross-origin-blocked.sub.html (2/2, 100.00%, 0.22% of total) | TIMEOUT |
| Test that the child iframe navigation is not allowed | NOTRUN |
| Violation report status OK. | FAIL |
| /content-security-policy/blob/blob-urls-match-blob.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS (1/1)"] | PASS |
| /content-security-policy/object-src/object-src-url-embed-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-star-allow-crossorigin.html (1/1, 100.00%, 0.11% of total) | OK |
| A 'frame-ancestors' CSP directive with '*' should allow rendering. | FAIL |
| /content-security-policy/generic/generic-0_1-img-src.html (2/2, 100.00%, 0.22% of total) | OK |
| Should fire violation events for every failed violation | PASS |
| Verify cascading of default-src to img-src policy | PASS |
| /content-security-policy/navigate-to/form-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that the child iframe navigation is not allowed | FAIL |
| Violation report status OK. | FAIL |
| /content-security-policy/style-src/stylehash-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS (1/4): The '#p1' element's text is green, which means the style was correctly applied.","PASS (2/4): The '#p2' element's text is green, which means the style was correctly applied.","PASS (3/4): The '#p3' element's text is green, which means the style was correctly applied.","PASS (4/4): The '#p4' element's text is green, which means the style was correctly applied."] | PASS |
| /content-security-policy/generic/generic-0_10_1.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Prevents access to external scripts. | PASS |
| Should fire violation events for every failed violation | PASS |
| /content-security-policy/script-src/script-src-1_10.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that securitypolicyviolation event is fired | FAIL |
| Verify that data: as script src doesn't run with this policy | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-cross-url-allow.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a URL value should block or allow rendering in nested frames as appropriate. | NOTRUN |
| /content-security-policy/navigate-to/meta-refresh-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that the child iframe navigation is not allowed | FAIL |
| Violation report status OK. | FAIL |
| /content-security-policy/sandbox/iframe-inside-csp.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS (1/2): Script can execute","PASS (2/2): Eval works"] | PASS |
| /content-security-policy/worker-src/shared-fallback.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Same-origin dedicated worker allowed by 'self'. | PASS |
| blob: dedicated worker allowed by 'blob:'. | PASS |
| /content-security-policy/font-src/font-none-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test font does not load if it does not match font-src. | PASS |
| /content-security-policy/reporting/multiple-report-policies.html (2/2, 100.00%, 0.22% of total) | OK |
| 1-Violation report status OK | PASS |
| 2-Violation report status OK | PASS |
| /content-security-policy/securitypolicyviolation/securitypolicyviolation-block-image.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Non-redirected same-origin URLs are not stripped. | PASS |
| /content-security-policy/style-src/inline-style-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS"] | PASS |
| /content-security-policy/frame-src/frame-src-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS IFrame #1 generated a load event.","violated-directive=frame-src"] | PASS |
| /content-security-policy/blob/star-doesnt-match-blob.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=worker-src","TEST COMPLETE"] | PASS |
| /content-security-policy/script-src-attr-elem/script-src-elem-allowed-attr-blocked.html (2/2, 100.00%, 0.22% of total) | TIMEOUT |
| Should execute the inline script block | PASS |
| Should fire a security policy violation for the attribute | NOTRUN |
| /content-security-policy/script-src/script-src-1_2.html (3/3, 100.00%, 0.33% of total) | OK |
| Inline event handler | PASS |
| Inline script block | PASS |
| Should fire policy violation events | PASS |
| /content-security-policy/svg/svg-policy-resource-doc-includes.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["TEST COMPLETE"] | PASS |
| /content-security-policy/script-src/hash-always-converted-to-utf-8/iso-8859-3.html (1/1, 100.00%, 0.11% of total) | OK |
| Should convert the script contents to UTF-8 before hashing | FAIL |
| /content-security-policy/plugin-types/plugintypes-mismatched-url.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Should not load the object because its declared type does not match its actual type | NOTRUN |
| /content-security-policy/embedded-enforcement/iframe-csp-attribute.html (4/4, 100.00%, 0.44% of total) | OK |
| <iframe> has a 'csp' attibute which is an empty string if undefined. | PASS |
| <iframe>'s 'csp content attribute reflects the IDL attribute. | PASS |
| <iframe>'s IDL attribute reflects the DOM attribute. | PASS |
| <iframe>'s csp attribute is always a string. | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-same-self-block.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a value 'same' should block render in same-origin nested frames. | NOTRUN |
| /content-security-policy/navigate-to/form-action/form-action-allows-navigate-to-blocks.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that form-action overrides navigate-to when present. | PASS |
| /content-security-policy/svg/object-in-svg-foreignobject.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Should throw a securitypolicyviolation | PASS |
| /content-security-policy/reporting/report-uri-multiple-reversed.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/inside-worker/dedicated-inheritance.html (36/36, 100.00%, 3.95% of total) | OK |
| Cross-origin 'fetch()' in blob: | PASS |
| Cross-origin 'fetch()' in filesystem: | PASS |
| Cross-origin 'fetch()' in http: | PASS |
| Cross-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,connect-src%20%27none%27) | PASS |
| Cross-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,connect-src%20*) | PASS |
| Cross-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27none%27) | PASS |
| Cross-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,default-src%20*) | PASS |
| Cross-origin XHR in blob: | PASS |
| Cross-origin XHR in filesystem: | PASS |
| Cross-origin XHR in http: | PASS |
| Cross-origin XHR in http:?pipe=sub|header(Content-Security-Policy,connect-src%20%27none%27) | PASS |
| Cross-origin XHR in http:?pipe=sub|header(Content-Security-Policy,connect-src%20*) | PASS |
| Cross-origin XHR in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27none%27) | PASS |
| Cross-origin XHR in http:?pipe=sub|header(Content-Security-Policy,default-src%20*) | PASS |
| Filesystem and blob. | PASS |
| Same-origin 'fetch()' in blob: | PASS |
| Same-origin 'fetch()' in filesystem: | PASS |
| Same-origin 'fetch()' in http: | PASS |
| Same-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,connect-src%20%27none%27) | PASS |
| Same-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,connect-src%20*) | PASS |
| Same-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27none%27) | PASS |
| Same-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,default-src%20*) | PASS |
| Same-origin => cross-origin 'fetch()' in blob: | PASS |
| Same-origin => cross-origin 'fetch()' in filesystem: | PASS |
| Same-origin => cross-origin 'fetch()' in http: | PASS |
| Same-origin => cross-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,connect-src%20%27none%27) | PASS |
| Same-origin => cross-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,connect-src%20*) | PASS |
| Same-origin => cross-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27none%27) | PASS |
| Same-origin => cross-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,default-src%20*) | PASS |
| Same-origin XHR in blob: | PASS |
| Same-origin XHR in filesystem: | PASS |
| Same-origin XHR in http: | PASS |
| Same-origin XHR in http:?pipe=sub|header(Content-Security-Policy,connect-src%20%27none%27) | PASS |
| Same-origin XHR in http:?pipe=sub|header(Content-Security-Policy,connect-src%20*) | PASS |
| Same-origin XHR in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27none%27) | PASS |
| Same-origin XHR in http:?pipe=sub|header(Content-Security-Policy,default-src%20*) | PASS |
| /content-security-policy/generic/generic-0_8_1.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Should fire violation events for every failed violation | PASS |
| /content-security-policy/worker-src/service-self.https.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Same-origin service worker allowed by 'self'. | PASS |
| /content-security-policy/object-src/object-src-no-url-blocked.html (1/1, 100.00%, 0.11% of total) | OK |
| Should block the object and fire a spv | PASS |
| /content-security-policy/inside-worker/dedicated-script.html (22/22, 100.00%, 2.41% of total) | OK |
| Cross-origin `importScripts()` blocked in blob: | PASS |
| Cross-origin `importScripts()` blocked in filesystem: | PASS |
| Cross-origin `importScripts()` blocked in http: | PASS |
| Cross-origin `importScripts()` blocked in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27none%27) | PASS |
| Cross-origin `importScripts()` blocked in http:?pipe=sub|header(Content-Security-Policy,default-src%20*) | PASS |
| Cross-origin `importScripts()` blocked in http:?pipe=sub|header(Content-Security-Policy,script-src%20%27none%27) | PASS |
| Cross-origin `importScripts()` blocked in http:?pipe=sub|header(Content-Security-Policy,script-src%20*) | PASS |
| Filesystem and blob. | PASS |
| `eval()` blocked in blob: | PASS |
| `eval()` blocked in filesystem: | PASS |
| `eval()` blocked in http: | PASS |
| `eval()` blocked in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27none%27) | PASS |
| `eval()` blocked in http:?pipe=sub|header(Content-Security-Policy,default-src%20*) | PASS |
| `eval()` blocked in http:?pipe=sub|header(Content-Security-Policy,script-src%20%27none%27) | PASS |
| `eval()` blocked in http:?pipe=sub|header(Content-Security-Policy,script-src%20*) | PASS |
| `setTimeout([string])` blocked in blob: | PASS |
| `setTimeout([string])` blocked in filesystem: | PASS |
| `setTimeout([string])` blocked in http: | PASS |
| `setTimeout([string])` blocked in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27none%27) | PASS |
| `setTimeout([string])` blocked in http:?pipe=sub|header(Content-Security-Policy,default-src%20*) | PASS |
| `setTimeout([string])` blocked in http:?pipe=sub|header(Content-Security-Policy,script-src%20%27none%27) | PASS |
| `setTimeout([string])` blocked in http:?pipe=sub|header(Content-Security-Policy,script-src%20*) | PASS |
| /content-security-policy/blob/self-doesnt-match-blob.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=worker-src","TEST COMPLETE"] | PASS |
| /content-security-policy/script-src/worker-set-timeout-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["setTimeout blocked"] | FAIL |
| /content-security-policy/style-src/style-src-inline-style-blocked.html (2/2, 100.00%, 0.22% of total) | OK |
| Inline style element should not load without 'unsafe-inline' | PASS |
| Should fire a securitypolicyviolation event | PASS |
| /content-security-policy/plugin-types/plugintypes-notype-url.html (1/1, 100.00%, 0.11% of total) | OK |
| Should not load the object because it does not have a declared type | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-same-in-cross-none-block.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a value 'none' should block rendering in nested frames. | NOTRUN |
| /content-security-policy/connect-src/worker-connect-src-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["xhr allowed"] | PASS |
| /content-security-policy/embedded-enforcement/required_csp-header.html (70/70, 100.00%, 7.68% of total) | TIMEOUT |
| Test Required-CSP value on `csp` change: Sec-Required-CSP is not sent if `csp` attribute is not set on <iframe>. | PASS |
| Test Required-CSP value on `csp` change: Send Sec-Required-CSP Header on change of `src` attribute on iframe. | PASS |
| Test Required-CSP value on `csp` change: Send Sec-Required-CSP when `csp` attribute of <iframe> is not empty. | PASS |
| Test Required-CSP value on `csp` change: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - comma separated | PASS |
| Test Required-CSP value on `csp` change: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - gibberish csp | PASS |
| Test Required-CSP value on `csp` change: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - html encoded string | PASS |
| Test Required-CSP value on `csp` change: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - missing semicolon | PASS |
| Test Required-CSP value on `csp` change: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - misspeled 'none' | PASS |
| Test Required-CSP value on `csp` change: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - query values in path | PASS |
| Test Required-CSP value on `csp` change: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - report-to present | PASS |
| Test Required-CSP value on `csp` change: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - report-uri present | PASS |
| Test Required-CSP value on `csp` change: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - unknown policy name | PASS |
| Test Required-CSP value on `csp` change: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - unknown policy name in multiple directives | PASS |
| Test Required-CSP value on `csp` change: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - url encoded string | PASS |
| Test cross origin redirect of cross origin iframe: Sec-Required-CSP is not sent if `csp` attribute is not set on <iframe>. | PASS |
| Test cross origin redirect of cross origin iframe: Send Sec-Required-CSP Header on change of `src` attribute on iframe. | PASS |
| Test cross origin redirect of cross origin iframe: Send Sec-Required-CSP when `csp` attribute of <iframe> is not empty. | PASS |
| Test cross origin redirect of cross origin iframe: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - comma separated | PASS |
| Test cross origin redirect of cross origin iframe: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - gibberish csp | PASS |
| Test cross origin redirect of cross origin iframe: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - html encoded string | PASS |
| Test cross origin redirect of cross origin iframe: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - missing semicolon | PASS |
| Test cross origin redirect of cross origin iframe: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - misspeled 'none' | PASS |
| Test cross origin redirect of cross origin iframe: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - query values in path | PASS |
| Test cross origin redirect of cross origin iframe: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - report-to present | PASS |
| Test cross origin redirect of cross origin iframe: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - report-uri present | PASS |
| Test cross origin redirect of cross origin iframe: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - unknown policy name | PASS |
| Test cross origin redirect of cross origin iframe: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - unknown policy name in multiple directives | PASS |
| Test cross origin redirect of cross origin iframe: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - url encoded string | PASS |
| Test cross origin redirect: Sec-Required-CSP is not sent if `csp` attribute is not set on <iframe>. | PASS |
| Test cross origin redirect: Send Sec-Required-CSP Header on change of `src` attribute on iframe. | TIMEOUT |
| Test cross origin redirect: Send Sec-Required-CSP when `csp` attribute of <iframe> is not empty. | PASS |
| Test cross origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - comma separated | TIMEOUT |
| Test cross origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - gibberish csp | TIMEOUT |
| Test cross origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - html encoded string | TIMEOUT |
| Test cross origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - missing semicolon | TIMEOUT |
| Test cross origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - misspeled 'none' | TIMEOUT |
| Test cross origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - query values in path | TIMEOUT |
| Test cross origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - report-to present | TIMEOUT |
| Test cross origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - report-uri present | TIMEOUT |
| Test cross origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - unknown policy name | TIMEOUT |
| Test cross origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - unknown policy name in multiple directives | TIMEOUT |
| Test cross origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - url encoded string | TIMEOUT |
| Test same origin redirect: Sec-Required-CSP is not sent if `csp` attribute is not set on <iframe>. | PASS |
| Test same origin redirect: Send Sec-Required-CSP Header on change of `src` attribute on iframe. | TIMEOUT |
| Test same origin redirect: Send Sec-Required-CSP when `csp` attribute of <iframe> is not empty. | TIMEOUT |
| Test same origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - comma separated | TIMEOUT |
| Test same origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - gibberish csp | TIMEOUT |
| Test same origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - html encoded string | TIMEOUT |
| Test same origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - missing semicolon | TIMEOUT |
| Test same origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - misspeled 'none' | TIMEOUT |
| Test same origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - query values in path | TIMEOUT |
| Test same origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - report-to present | TIMEOUT |
| Test same origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - report-uri present | TIMEOUT |
| Test same origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - unknown policy name | TIMEOUT |
| Test same origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - unknown policy name in multiple directives | TIMEOUT |
| Test same origin redirect: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - url encoded string | TIMEOUT |
| Test same origin: Sec-Required-CSP is not sent if `csp` attribute is not set on <iframe>. | PASS |
| Test same origin: Send Sec-Required-CSP Header on change of `src` attribute on iframe. | PASS |
| Test same origin: Send Sec-Required-CSP when `csp` attribute of <iframe> is not empty. | PASS |
| Test same origin: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - comma separated | PASS |
| Test same origin: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - gibberish csp | PASS |
| Test same origin: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - html encoded string | PASS |
| Test same origin: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - missing semicolon | PASS |
| Test same origin: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - misspeled 'none' | PASS |
| Test same origin: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - query values in path | PASS |
| Test same origin: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - report-to present | PASS |
| Test same origin: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - report-uri present | PASS |
| Test same origin: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - unknown policy name | PASS |
| Test same origin: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - unknown policy name in multiple directives | PASS |
| Test same origin: Wrong value of `csp` should not trigger sending Sec-Required-CSP Header - url encoded string | PASS |
| /content-security-policy/worker-src/service-child.https.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Same-origin service worker allowed by host-source expression. | PASS |
| /content-security-policy/worker-src/shared-self.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Same-origin dedicated worker allowed by 'self'. | PASS |
| /content-security-policy/reporting-api/reporting-api-report-only-sends-reports-on-violation.https.sub.html (3/3, 100.00%, 0.33% of total) | OK |
| Event is fired | PASS |
| Test that image does not load | PASS |
| Violation report status OK. | PASS |
| /content-security-policy/connect-src/connect-src-eventsource-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["blocked","violated-directive=connect-src"] | PASS |
| /content-security-policy/navigate-to/unsafe-allow-redirects/allowed-end-of-chain-because-of-same-origin.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the child iframe navigation is allowed | PASS |
| /content-security-policy/unsafe-eval/eval-scripts-setInterval-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS 1 of 2","PASS 2 of 2"] | PASS |
| /content-security-policy/navigate-to/href-location-redirected-blocked.sub.html (2/2, 100.00%, 0.22% of total) | TIMEOUT |
| Test that the child iframe navigation is not allowed | NOTRUN |
| Violation report status OK. | FAIL |
| /content-security-policy/generic/cspro-not-enforced-in-worker.html (2/2, 100.00%, 0.22% of total) | OK |
| Check that eval is allowed since the inherited policy is report only | PASS |
| Check that inline is allowed since the inherited policy is report only | PASS |
| /content-security-policy/script-src/scripthash-basic-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS (1/1)"] | PASS |
| /content-security-policy/script-src/injected-inline-script-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["Pass 1 of 2","Pass 2 of 2"] | PASS |
| /content-security-policy/securitypolicyviolation/securitypolicyviolation-block-cross-origin-image-from-script.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Non-redirected cross-origin URLs are not stripped. | PASS |
| /content-security-policy/child-src/child-src-cross-origin-load.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Expecting alerts: ["PASS","PASS"] | PASS |
| Expecting logs: ["PASS IFrame #1 generated a load event.","PASS IFrame #2 generated a load event.","PASS IFrame #3 generated a load event.", "violated-directive=frame-src"] | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-none-block.html (1/1, 100.00%, 0.11% of total) | OK |
| A 'frame-ancestors' CSP directive with a value 'none' should block rendering. | FAIL |
| /content-security-policy/style-src/inline-style-attribute-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS"] | FAIL |
| /content-security-policy/style-src/inline-style-allowed-while-cloning-objects.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that violation report event was fired | FAIL |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-strict_dynamic.html (11/11, 100.00%, 1.21% of total) | OK |
| 'strict-dynamic' has to be allowed by required csp if it is present in returned csp. | PASS |
| 'strict-dynamic' is effective only for `script-src`. | PASS |
| 'strict-dynamic' is ineffective for `child-src`. | PASS |
| 'strict-dynamic' is ineffective for `frame-src`. | PASS |
| 'strict-dynamic' is ineffective for `img-src`. | PASS |
| 'strict-dynamic' is ineffective for `style-src`. | PASS |
| 'strict-dynamic' is proper handled for finding effective policy. | PASS |
| 'strict-dynamic' makes 'self' ineffective. | PASS |
| 'strict-dynamic' makes 'unsafe-inline' ineffective. | PASS |
| 'strict-dynamic' makes host source expressions ineffective. | PASS |
| 'strict-dynamic' makes scheme source expressions ineffective. | PASS |
| /content-security-policy/base-uri/base-uri_iframe_sandbox.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| base-uri 'self' blocks foreign-origin sandboxed iframes. | PASS |
| base-uri 'self' works with same-origin sandboxed iframes. | PASS |
| /content-security-policy/script-src/script-src-strict_dynamic_in_img-src.html (1/1, 100.00%, 0.11% of total) | OK |
| `strict-dynamic` does not drop whitelists in `img-src`. | FAIL |
| /content-security-policy/style-src-attr-elem/style-src-elem-allowed-src-blocked.html (1/1, 100.00%, 0.11% of total) | OK |
| Inline style should be applied | FAIL |
| /content-security-policy/form-action/form-action-src-get-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=form-action","TEST COMPLETE"] | PASS |
| /content-security-policy/reporting/report-uri-effective-directive.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/style-src/stylehash-basic-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS: The 'p' element's text is green, which means the style was correctly applied.", "violated-directive=style-src-elem"] | PASS |
| /content-security-policy/navigate-to/link-click-redirected-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the child iframe navigation is allowed | PASS |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-host_sources-ports.html (15/15, 100.00%, 1.65% of total) | OK |
| Returned CSP should be subsumed even if the port is not specified but is a default port for a more secure scheme. | PASS |
| Returned CSP should be subsumed even if the port is not specified but is a default port for a scheme. | PASS |
| Returned CSP should be subsumed if the port is specified but is not default for a more secure scheme. | PASS |
| Returned CSP should be subsumed if the port is specified but the scheme is more secure. | PASS |
| Returned CSP should be subsumed if the port is specified. | PASS |
| Returned CSP should be subsumed if the ports match but schemes are not identical for `ws`. | PASS |
| Returned CSP should be subsumed if the ports match but schemes are not identical. | PASS |
| Specified ports must match. | PASS |
| The same should hold for `ws` case. | PASS |
| Unspecified ports must match if schemes match. | PASS |
| Wildcard port should match a wildcard. | PASS |
| Wildcard port should match any specific port. | PASS |
| Wildcard port should match unspecified port. | PASS |
| Wildcard port should not be subsumed by a default port. | PASS |
| Wildcard port should not be subsumed by a spcified port. | PASS |
| /content-security-policy/style-src/style-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=style-src","PASS"] | FAIL |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-same-in-same-none-block.html (1/1, 100.00%, 0.11% of total) | OK |
| A 'frame-ancestors' CSP directive with a value 'none' should block rendering in nested frames. | FAIL |
| /content-security-policy/object-src/object-src-url-blocked.html (1/1, 100.00%, 0.11% of total) | OK |
| Should block the object and fire a spv | PASS |
| /content-security-policy/default-src/default-src-inline-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS 1 of 2","PASS 2 of 2"] | PASS |
| /content-security-policy/navigate-to/form-action/form-action-blocks-navigate-to-allows.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that form-action overrides navigate-to when present. | PASS |
| /content-security-policy/font-src/font-stylesheet-font-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test font does not load if it does not match font-src. | PASS |
| /content-security-policy/sandbox/sandbox-allow-scripts-subframe.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["Message"] | PASS |
| /content-security-policy/form-action/form-action-src-redirect-allowed-target-blank.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| form submission targetting _blank allowed after a redirect | PASS |
| /content-security-policy/connect-src/connect-src-websocket-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["allowed"] | PASS |
| /content-security-policy/prefetch-src/prefetch-allowed.html (3/3, 100.00%, 0.33% of total) | OK |
| Browser supports performance APIs. | PASS |
| Browser supports prefetch. | PASS |
| Prefetch succeeds when allowed by prefetch-src | FAIL |
| /content-security-policy/script-src/scriptnonce-and-scripthash.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS (1/3)","PASS (2/3)","PASS (3/3)"] | PASS |
| /content-security-policy/style-src-attr-elem/style-src-elem-blocked-src-allowed.html (2/2, 100.00%, 0.22% of total) | TIMEOUT |
| Should fire a security policy violation event | NOTRUN |
| The inline style should not be applied | FAIL |
| /content-security-policy/script-src/scripthash-ignore-unsafeinline.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS (1/1)"] | PASS |
| /content-security-policy/form-action/form-action-src-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS","TEST COMPLETE"] | PASS |
| /content-security-policy/unsafe-hashes/style_attribute_denied_missing_unsafe_hashes.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the inline style attribute is blocked | PASS |
| /content-security-policy/style-src/style-src-injected-stylesheet-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Programatically injected stylesheet should not load | PASS |
| Should fire a securitypolicyviolation event | PASS |
| /content-security-policy/worker-src/dedicated-fallback.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Same-origin dedicated worker allowed by host-source expression. | PASS |
| blob: dedicated worker allowed by 'blob:'. | PASS |
| /content-security-policy/script-src/worker-importscripts-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Expecting logs: ["TEST COMPLETE"] | PASS |
| worker-importscripts-blocked | FAIL |
| /content-security-policy/reporting/report-original-url.sub.html (5/5, 100.00%, 0.55% of total) | OK |
| Block after redirect, cross-origin = original URL in report | PASS |
| Block after redirect, same-origin = original URL in report | PASS |
| Direct block, cross-origin = full URL in report | PASS |
| Direct block, same-origin = full URL in report | PASS |
| Violation report status OK. | PASS |
| /content-security-policy/securitypolicyviolation/style-sample.html (2/2, 100.00%, 0.22% of total) | OK |
| Inline style attributes should have a sample. | PASS |
| Inline style blocks should have a sample. | PASS |
| /content-security-policy/reporting/report-uri-multiple.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/generic/filesystem-urls-match-filesystem.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS (1/1)"] | PASS |
| /content-security-policy/object-src/object-src-url-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/object-src/object-src-url-embed-blocked.html (1/1, 100.00%, 0.11% of total) | OK |
| Should block the object and fire a spv | PASS |
| /content-security-policy/reporting/report-only-in-meta.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Image should load | PASS |
| /content-security-policy/embedded-enforcement/idlharness.window.html (4/4, 100.00%, 0.44% of total) | OK |
| HTMLIFrameElement interface: attribute csp | PASS |
| HTMLIFrameElement interface: document.createElement("iframe") must inherit property "csp" with the proper type | PASS |
| Partial interface HTMLIFrameElement: original interface defined | PASS |
| idl_test setup | PASS |
| /content-security-policy/font-src/font-mismatch-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test font does not load if it does not match font-src. | PASS |
| /content-security-policy/navigate-to/anchor-navigation-always-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that anchor navigation is allowed regardless of the `navigate-to` directive | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-same-in-cross-url-allow.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a URL value should block or allow rendering in nested frames as appropriate. | NOTRUN |
| /content-security-policy/plugin-types/plugintypes-mismatched-data.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Should not load the object because its declared type does not match its actual type | NOTRUN |
| /content-security-policy/connect-src/worker-connect-src-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["xhr blocked","TEST COMPLETE"] | FAIL |
| /content-security-policy/prefetch-src/prefetch-header-blocked.html (3/3, 100.00%, 0.33% of total) | TIMEOUT |
| Browser supports performance APIs. | PASS |
| Browser supports prefetch. | PASS |
| Prefetch via `Link` header succeeds when allowed by prefetch-src | TIMEOUT |
| /content-security-policy/navigation/to-javascript-url-frame-src.html (1/1, 100.00%, 0.11% of total) | OK |
| <iframe src='javascript:...'> not blocked by 'frame-src' | PASS |
| /content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Check that frames load without throwing any violation events | PASS |
| /content-security-policy/style-src/stylehash-default-src.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| stylehash allowed from default-src | PASS |
| /content-security-policy/style-src/style-src-hash-blocked.html (3/3, 100.00%, 0.33% of total) | OK |
| Should fire a securitypolicyviolation event | PASS |
| Should load the style with a correct hash | PASS |
| Should not load style that does not match hash | PASS |
| /content-security-policy/reporting/report-uri-from-child-frame.html (1/1, 100.00%, 0.11% of total) | OK |
| Check that we received a message from the child frame | PASS |
| /content-security-policy/base-uri/base-uri-allow.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Check that base URIs can be set if they do not violate the page's policy. | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-url-allow.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| A 'frame-ancestors' CSP directive with a URL matching this origin should allow rendering. | PASS |
| /content-security-policy/inside-worker/shared-script.html (6/6, 100.00%, 0.66% of total) | TIMEOUT |
| Cross-origin `importScripts()` blocked in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27self%27 | PASS |
| Cross-origin `importScripts()` blocked in http:?pipe=sub|header(Content-Security-Policy,script-src%20%27self%27 | PASS |
| `eval()` blocked in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27self%27 | PASS |
| `eval()` blocked in http:?pipe=sub|header(Content-Security-Policy,script-src%20%27self%27 | PASS |
| `setTimeout([string])` blocked in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27self%27 | PASS |
| `setTimeout([string])` blocked in http:?pipe=sub|header(Content-Security-Policy,script-src%20%27self%27 | PASS |
| /content-security-policy/form-action/form-action-src-redirect-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=form-action","TEST COMPLETE"] | FAIL |
| /content-security-policy/generic/304-response-should-update-csp.sub.html (4/4, 100.00%, 0.44% of total) | OK |
| Test that the first frame does not use nonce def | PASS |
| Test that the first frame uses nonce abc | PASS |
| Test that the second frame does not use nonce abc | PASS |
| Test that the second frame uses nonce def | PASS |
| /content-security-policy/form-action/form-action-src-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=form-action","TEST COMPLETE"] | PASS |
| /content-security-policy/navigate-to/href-location-allowed.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Test that the child iframe navigation is allowed | NOTRUN |
| /content-security-policy/connect-src/connect-src-websocket-self.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["allowed", "allowed"] | PASS |
| /content-security-policy/worker-src/dedicated-worker-src-default-fallback.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Same-origin dedicated worker allowed by default-src 'self'. | PASS |
| /content-security-policy/navigate-to/parent-navigates-child-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the parent can navigate the child because the relevant policy belongs to the navigation initiator (in this case the parent, which has the policy `navigate-to 'self'`) | PASS |
| /content-security-policy/reporting/report-cross-origin-no-cookies.sub.html (3/3, 100.00%, 0.33% of total) | OK |
| Image should not load | PASS |
| Test report cookies. | PASS |
| Violation report status OK. | PASS |
| /content-security-policy/reporting-api/reporting-api-sends-reports-on-violation.https.sub.html (3/3, 100.00%, 0.33% of total) | OK |
| Event is fired | PASS |
| Test that image does not load | PASS |
| Violation report status OK. | FAIL |
| /content-security-policy/reporting-api/reporting-api-works-on-frame-src.https.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Event is fired | PASS |
| Violation report status OK. | FAIL |
| /content-security-policy/svg/svg-inline.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Should fire violation event | PASS |
| /content-security-policy/inside-worker/shared-inheritance.html (15/15, 100.00%, 1.65% of total) | TIMEOUT |
| Cross-origin 'fetch()' in http: | TIMEOUT |
| Cross-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,connect-src%20%27self%27) | PASS |
| Cross-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27self%27) | PASS |
| Cross-origin XHR in http: | TIMEOUT |
| Cross-origin XHR in http:?pipe=sub|header(Content-Security-Policy,connect-src%20%27self%27) | PASS |
| Cross-origin XHR in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27self%27) | PASS |
| Same-origin 'fetch()' in http: | PASS |
| Same-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,connect-src%20%27self%27) | PASS |
| Same-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27self%27) | PASS |
| Same-origin => cross-origin 'fetch()' in http: | TIMEOUT |
| Same-origin => cross-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,connect-src%20%27self%27) | PASS |
| Same-origin => cross-origin 'fetch()' in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27self%27) | PASS |
| Same-origin XHR in http: | PASS |
| Same-origin XHR in http:?pipe=sub|header(Content-Security-Policy,connect-src%20%27self%27) | PASS |
| Same-origin XHR in http:?pipe=sub|header(Content-Security-Policy,default-src%20%27self%27) | PASS |
| /content-security-policy/navigate-to/unsafe-allow-redirects/blocked-end-of-chain.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the child iframe navigation is blocked | FAIL |
| /content-security-policy/reporting/report-multiple-violations-02.html (2/2, 100.00%, 0.22% of total) | OK |
| Test number of sent reports. | PASS |
| Violation report status OK. | PASS |
| /content-security-policy/generic/generic-0_1-script-src.html (3/3, 100.00%, 0.33% of total) | OK |
| Should fire violation events for every failed violation | PASS |
| Verify cascading of default-src to script-src policy: allow | PASS |
| Verify cascading of default-src to script-src policy: block | PASS |
| /content-security-policy/navigate-to/meta-refresh-redirected-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Test that the child iframe navigation is allowed | PASS |
| /content-security-policy/style-src/style-src-error-event-fires.html (2/2, 100.00%, 0.22% of total) | OK |
| Test error event fires on inline style | PASS |
| Test error event fires on stylesheet link | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-same-in-same-star-allow.html (1/1, 100.00%, 0.11% of total) | OK |
| A 'frame-ancestors' CSP directive with a value '*' should render in nested frames. | PASS |
| /content-security-policy/navigate-to/href-location-blocked.sub.html (2/2, 100.00%, 0.22% of total) | TIMEOUT |
| Test that the child iframe navigation is not allowed | NOTRUN |
| Violation report status OK. | FAIL |
| /content-security-policy/connect-src/connect-src-eventsource-redirect-to-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS EventSource() did not follow the disallowed redirect.","TEST COMPLETE", "violated-directive=connect-src"] | PASS |
| /content-security-policy/object-src/object-src-url-redirect-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/form-action/form-action-src-javascript-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=form-action","TEST COMPLETE"] | PASS |
| /content-security-policy/style-src/style-src-injected-stylesheet-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Programatically injected stylesheet should load | PASS |
| /content-security-policy/inheritance/iframe-all-local-schemes-inherit-self.sub.html (6/6, 100.00%, 0.66% of total) | OK |
| <iframe sandbox src='blob:...'>'s inherits policy. (opaque origin sandbox) | PASS |
| <iframe src='blob:...'>'s inherits policy. | PASS |
| <iframe src='data:...'>'s inherits policy. | PASS |
| <iframe src='javascript:...'>'s inherits policy. | PASS |
| <iframe srcdoc>'s inherits policy. | PASS |
| <iframe>'s about:blank inherits policy. | PASS |
| /content-security-policy/worker-src/service-fallback.https.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Same-origin service worker allowed by host-source expression. | PASS |
| /content-security-policy/style-src/style-src-stylesheet-nonce-allowed.html (1/1, 100.00%, 0.11% of total) | OK |
| Stylesheet link should load with correct nonce | PASS |
| /content-security-policy/worker-src/shared-worker-src-default-fallback.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Same-origin shared worker allowed by default-src 'self'. | PASS |
| /content-security-policy/script-src/scriptnonce-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS (1/2)","PASS (2/2)"] | PASS |
| /content-security-policy/style-src/injected-inline-style-allowed.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS: 2 stylesheets on the page."] | PASS |
| /content-security-policy/script-src/eval-allowed-in-report-only-mode.html (1/1, 100.00%, 0.11% of total) | OK |
| Eval is allowed because the CSP is report-only | PASS |
| /content-security-policy/media-src/media-src-7_1.html (3/3, 100.00%, 0.33% of total) | TIMEOUT |
| In-policy async video source element | NOTRUN |
| In-policy async video src | NOTRUN |
| Should not fire policy violation events | NOTRUN |
| /content-security-policy/style-src/injected-inline-style-blocked.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=style-src-elem","PASS"] | PASS |
| /content-security-policy/media-src/media-src-blocked.sub.html (5/5, 100.00%, 0.55% of total) | TIMEOUT |
| Disallaowed audio src | PASS |
| Disallowed async video source element | PASS |
| Disallowed async video src | PASS |
| Disallowed audio source element | PASS |
| Test that securitypolicyviolation events are fired | TIMEOUT |
| /content-security-policy/navigate-to/child-navigates-parent-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that the child can't navigate the parent because the relevant policy belongs to the navigation initiator (in this case the child which has the policy `navigate-to 'none'`) | FAIL |
| Violation report status OK. | FAIL |
| /content-security-policy/worker-src/service-none.https.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Same-origin service worker blocked by 'none'. | PASS |
| /content-security-policy/svg/svg-from-guid.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["TEST COMPLETE"] | PASS |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-host_sources-paths.html (9/9, 100.00%, 0.99% of total) | OK |
| All specific paths match except the order. | PASS |
| Empty path is not subsumed by specified paths. | PASS |
| Matching paths. | PASS |
| Returned CSP allows only one path. | PASS |
| Returned CSP has a more specific path. | PASS |
| Returned CSP must specify a path. | PASS |
| That should not be true when required csp specifies a specific page. | PASS |
| Unspecified path should be subsumed by `/`. | PASS |
| `/` path should be subsumed by an empty path. | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-sandboxed-cross-url-block.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a URL value should compare against each frame's origin rather than URL, so a nested frame with a sandboxed parent frame should be blocked due to the parent having a unique origin. | NOTRUN |
| /content-security-policy/worker-src/dedicated-none.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Same-origin dedicated worker blocked by host-source expression. | PASS |
| blob: dedicated worker blocked by 'blob:'. | PASS |
| /content-security-policy/embedded-enforcement/subsumption_algorithm-unsafe_hashes.html (7/7, 100.00%, 0.77% of total) | OK |
| 'unsafe-hashes' is properly subsumed. | PASS |
| Effective policy is properly found where 'unsafe-hashes' is not part of it. | PASS |
| Effective policy is properly found where 'unsafe-hashes' is not subsumed. | PASS |
| Effective policy is properly found. | PASS |
| No other keyword has the same effect as 'unsafe-hashes'. | PASS |
| Other expressions have to be subsumed. | PASS |
| Required csp must allow 'unsafe-hashes'. | PASS |
| /content-security-policy/unsafe-hashes/javascript_src_allowed-window_location.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Test that the javascript: src is allowed to run | NOTRUN |
| /content-security-policy/meta/meta-outside-head.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting alerts: ["PASS (1/1)"] | PASS |
| /content-security-policy/prefetch-src/prefetch-blocked.html (3/3, 100.00%, 0.33% of total) | OK |
| Blocked prefetch generates report. | FAIL |
| Browser supports performance APIs. | PASS |
| Browser supports prefetch. | PASS |
| /content-security-policy/navigate-to/meta-refresh-cross-origin-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Test that the child iframe navigation is not allowed | FAIL |
| Violation report status OK. | FAIL |
| /content-security-policy/style-src/stylenonce-blocked.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Should fire securitypolicyviolation | PASS |
| stylenonce-blocked | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-same-in-cross-star-allow.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a value '*' should render in nested frames. | NOTRUN |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-cross-none-block.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a value 'none' should block rendering in nested frames. | NOTRUN |
| /content-security-policy/reporting/report-uri-from-javascript.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |
| /content-security-policy/img-src/report-blocked-data-uri.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["violated-directive=img-src"] | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-url-block.html (1/1, 100.00%, 0.11% of total) | OK |
| A 'frame-ancestors' CSP directive with a URL which doesn't match this origin should be blocked. | FAIL |
| /content-security-policy/navigation/to-javascript-parent-initiated-child-csp.html (1/1, 100.00%, 0.11% of total) | OK |
| Should have executed the javascript url | PASS |
| /content-security-policy/sandbox/window-reuse-unsandboxed.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Window object should be reused | NOTRUN |
| /content-security-policy/unsafe-hashes/javascript_src_denied_wrong_hash-window_location.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| Test that the javascript: src is not allowed to run | NOTRUN |
| /content-security-policy/sandbox/sandbox-empty.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS2"] | PASS |
| /content-security-policy/frame-src/frame-src-allowed.sub.html (2/2, 100.00%, 0.22% of total) | OK |
| Expecting alerts: ["PASS"] | PASS |
| Expecting logs: ["PASS IFrame #1 generated a load event."] | PASS |
| /content-security-policy/img-src/img-src-none-blocks.html (1/1, 100.00%, 0.11% of total) | OK |
| img-src with 'none' source should not match | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-same-none-block.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a value 'none' should block rendering in nested frames. | NOTRUN |
| /content-security-policy/inheritance/window.html (4/4, 100.00%, 0.44% of total) | TIMEOUT |
| `document.write` into `window.open()` inherits policy. | FAIL |
| window.open('blob:...') inherits policy. | TIMEOUT |
| window.open('javascript:...') inherits policy. | TIMEOUT |
| window.open() inherits policy. | FAIL |
| /content-security-policy/embedded-enforcement/required-csp-header-cascade.html (9/9, 100.00%, 0.99% of total) | OK |
| Test same origin: Test invalid policy on first iframe (bad directive) | PASS |
| Test same origin: Test invalid policy on first iframe (report directive) | PASS |
| Test same origin: Test invalid policy on second iframe (bad directive) | PASS |
| Test same origin: Test invalid policy on second iframe (report directive) | PASS |
| Test same origin: Test less restrictive policy on second iframe | PASS |
| Test same origin: Test more restrictive policy on second iframe | PASS |
| Test same origin: Test no policy on first iframe | PASS |
| Test same origin: Test no policy on second iframe | PASS |
| Test same origin: Test same policy for both iframes | PASS |
| /content-security-policy/form-action/form-action-src-default-ignored.sub.html (1/1, 100.00%, 0.11% of total) | OK |
| Expecting logs: ["PASS","TEST COMPLETE"] | PASS |
| /content-security-policy/frame-ancestors/frame-ancestors-nested-cross-in-cross-star-allow.html (1/1, 100.00%, 0.11% of total) | TIMEOUT |
| A 'frame-ancestors' CSP directive with a value '*' should render in nested frames. | NOTRUN |
| /content-security-policy/reporting/report-uri-from-inline-javascript.html (1/1, 100.00%, 0.11% of total) | OK |
| Violation report status OK. | PASS |