| <!DOCTYPE html> |
| <meta charset=utf-8> |
| <title>CORS - redirect</title> |
| <meta name=author title="Odin Hørthe Omdal" href="mailto:odiho@opera.com"> |
| |
| <script src=/resources/testharness.js></script> |
| <script src=/resources/testharnessreport.js></script> |
| <script src=support.js?pipe=sub></script> |
| |
| <h1>CORS redirect handling</h1> |
| |
| <div id=log></div> |
| |
| <script> |
| |
| // Test count for cache busting and easy identifying of request in traffic analyzer |
| var num_test = 0, |
| |
| origin = location.protocol + "//" + location.host, |
| remote_origin = origin.replace('://', '://' + SUBDOMAIN + '.'), |
| |
| local = dirname(location.href) + 'resources/cors-makeheader.py', |
| remote = local.replace('://', '://' + SUBDOMAIN + '.'), |
| remote2 = local.replace('://', '://' + SUBDOMAIN2 + '.'); |
| |
| |
| /* First page Redirect to Expect what */ |
| |
| // local -> remote |
| |
| redir_test([ 'local', '*' ], [ 'remote', '*' ], origin ); |
| redir_test([ 'local', '*' ], [ 'remote', origin ], origin ); |
| redir_test([ 'local', '*' ], [ 'remote', 'null' ], 'disallow'); |
| redir_test([ 'local', '*' ], [ 'remote', 'none' ], 'disallow'); |
| |
| redir_test([ 'local', origin ], [ 'remote', '*' ], origin ); |
| redir_test([ 'local', origin ], [ 'remote', origin ], origin ); |
| redir_test([ 'local', origin ], [ 'remote', 'null' ], 'disallow'); |
| redir_test([ 'local', origin ], [ 'remote', 'none' ], 'disallow'); |
| |
| redir_test([ 'local', 'null' ], [ 'remote', '*' ], origin ); |
| redir_test([ 'local', 'none' ], [ 'remote', '*' ], origin ); |
| |
| |
| // remote -> local |
| |
| redir_test([ 'remote', '*' ], [ 'local', '*' ], 'null' ); |
| redir_test([ 'remote', '*' ], [ 'local', origin ], 'disallow'); |
| redir_test([ 'remote', '*' ], [ 'local', 'null' ], 'null' ); |
| redir_test([ 'remote', '*' ], [ 'local', 'none' ], 'disallow'); |
| |
| redir_test([ 'remote', origin ], [ 'local', '*' ], 'null' ); |
| redir_test([ 'remote', origin ], [ 'local', origin ], 'disallow'); |
| redir_test([ 'remote', origin ], [ 'local', 'null' ], 'null' ); |
| redir_test([ 'remote', origin ], [ 'local', 'none' ], 'disallow'); |
| |
| redir_test([ 'remote', 'null' ], [ 'local', '*' ], 'disallow'); |
| redir_test([ 'remote', 'none' ], [ 'local', '*' ], 'disallow'); |
| |
| |
| // remote -> remote |
| |
| redir_test([ 'remote', '*' ], [ 'remote', '*' ], origin ); |
| redir_test([ 'remote', '*' ], [ 'remote', origin ], origin ); |
| redir_test([ 'remote', '*' ], [ 'remote', 'null' ], 'disallow'); |
| redir_test([ 'remote', '*' ], [ 'remote', 'none' ], 'disallow'); |
| |
| redir_test([ 'remote', origin ], [ 'remote', '*' ], origin ); |
| redir_test([ 'remote', origin ], [ 'remote', origin ], origin ); |
| redir_test([ 'remote', origin ], [ 'remote', 'null' ], 'disallow'); |
| redir_test([ 'remote', origin ], [ 'remote', 'none' ], 'disallow'); |
| |
| redir_test([ 'remote', 'null' ], [ 'remote', '*' ], 'disallow'); |
| redir_test([ 'remote', 'none' ], [ 'remote', '*' ], 'disallow'); |
| |
| |
| // remote -> remote2 |
| |
| redir_test([ 'remote', '*' ], [ 'remote2', '*' ], 'null' ); |
| redir_test([ 'remote', '*' ], [ 'remote2', origin ], 'disallow'); |
| redir_test([ 'remote', '*' ], [ 'remote2', 'null' ], 'null' ); |
| redir_test([ 'remote', '*' ], [ 'remote2', 'none' ], 'disallow'); |
| |
| redir_test([ 'remote', origin ], [ 'remote2', '*' ], 'null' ); |
| redir_test([ 'remote', origin ], [ 'remote2', origin ], 'disallow'); |
| redir_test([ 'remote', origin ], [ 'remote2', 'null' ], 'null'); |
| redir_test([ 'remote', origin ], [ 'remote2', 'none' ], 'disallow'); |
| |
| redir_test([ 'remote', 'null' ], [ 'remote2', '*' ], 'disallow'); |
| redir_test([ 'remote', 'none' ], [ 'remote2', '*' ], 'disallow'); |
| |
| |
| // Bonus weird edge checks |
| |
| redir_test([ 'remote', '*' ], [ 'remote', remote_origin ], 'disallow'); |
| redir_test([ 'remote', '*' ], [ 'remote2', remote_origin ], 'disallow'); |
| redir_test([ 'remote', remote_origin ], [ 'remote', "*" ], 'disallow'); |
| |
| |
| |
| /* |
| * The helpers |
| */ |
| |
| function redir_test(first, second, expect_origin) { |
| var first_url, second_url, |
| urls = { "remote": remote, "local": local, "remote2": remote2 }; |
| |
| first_url = urls[first[0]] + "?origin=" + first[1]; |
| second_url = urls[second[0]] + "?origin=" + second[1]; |
| |
| if (expect_origin=="disallow") { |
| shouldFail(first[0]+" ("+first[1]+") to " |
| + second[0]+" ("+second[1]+"), expect to fail", [ first_url, second_url ]); |
| } |
| else { |
| shouldPass(first[0]+" ("+first[1]+") to " |
| + second[0]+" ("+second[1]+"), expect origin="+expect_origin, expect_origin, [ first_url, second_url ]); |
| } |
| |
| } |
| |
| function shouldPass(desc, expected_origin, urls) { |
| var test_id = num_test, |
| t = async_test(desc); |
| |
| num_test++; |
| |
| t.step(function() { |
| var final_url, |
| client = new XMLHttpRequest(); |
| |
| client.open('GET', buildURL(urls, test_id)); |
| |
| client.onreadystatechange = t.step_func(function() { |
| if (client.readyState != client.DONE) |
| return; |
| assert_true(!!client.response, "Got response"); |
| r = JSON.parse(client.response) |
| assert_equals(r['origin'], expected_origin, 'Origin Header') |
| assert_equals(r['get_value'], 'last', 'get_value') |
| t.done(); |
| }); |
| client.send(null) |
| }); |
| } |
| |
| function shouldFail(desc, urls) { |
| var test_id = num_test, |
| t = async_test(desc); |
| |
| num_test++; |
| |
| t.step(function() { |
| var client = new XMLHttpRequest(); |
| |
| client.open('GET', buildURL(urls, test_id)); |
| |
| client.onreadystatechange = t.step_func(function() { |
| if (client.readyState != client.DONE) |
| return; |
| assert_false(!!client.response, "Got response"); |
| }); |
| client.onerror = t.step_func(function(e) { |
| t.done(); |
| }); |
| |
| client.send(null) |
| }); |
| } |
| |
| |
| function buildURL(urls, id) { |
| var tmp_url; |
| |
| if (typeof(urls) == "string") { |
| return urls + "&" + id + "_0"; |
| } |
| |
| for (var i = urls.length; i--; ) { |
| if (!tmp_url) |
| { |
| tmp_url = urls[i] + "&get_value=last&" + id + "_" + i; |
| continue; |
| } |
| tmp_url = urls[i] |
| + "&location=" |
| + encodeURIComponent(tmp_url) |
| + "&" + id + "_" + i; |
| } |
| |
| return tmp_url; |
| } |
| |
| </script> |
