[WPT] Do not allow hash method mismatch in consuming preloads

Bug: whatwg/html#7973 Change-Id: I1bbe327080a83bcd74f46f64668cf73490ef6d7c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3681845 Reviewed-by: Domenic Denicola <[email protected]> Commit-Queue: Hiroshige Hayashizaki <[email protected]> Cr-Commit-Position: refs/heads/main@{#1011137} NOKEYCHECK=True GitOrigin-RevId: cebfd2b4ce9c3d7c230a09011f9b4f254bc55bea
mjfroman · Jun 6, 2022 · 75fd08e · 75fd08e
1 parent 0edec37
commit 75fd08e
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 5 deletions.
diff --git a/blink/web_tests/external/wpt/preload/subresource-integrity.html b/blink/web_tests/external/wpt/preload/subresource-integrity.html
@@ -331,18 +331,28 @@
         {integrity: sha256}
       )
 
-      // This is an acceptable failure
       SRIPreloadTest(
         true,
         true,
-        `[Tentative] Same-origin ${destination} with matching digest does not reuse preload with matching but stronger digest.`,
+        `Same-origin ${destination} with matching digest does not reuse preload with matching but stronger digest.`,
         2,
         destination,
         same_origin_prefix + destination + ext + `?${token()}`,
         {integrity: sha384},
         {integrity: sha256},
       )
 
+      SRIPreloadTest(
+        true,
+        false,
+        `Same-origin ${destination} with wrong digest does not reuse preload with correct and stronger digest.`,
+        2,
+        destination,
+        same_origin_prefix + destination + ext + `?${token()}`,
+        {integrity: sha384},
+        {integrity: "sha256-deadbeefQ15RYHFvsYdWumweeFAw0hJDTFt9seErghA="}
+      )
+
       SRIPreloadTest(
         true,
         true,

diff --git a/blink/web_tests/platform/generic/external/wpt/preload/subresource-integrity-expected.txt b/blink/web_tests/platform/generic/external/wpt/preload/subresource-integrity-expected.txt
@@ -1,5 +1,5 @@
 This is a testharness.js-based test.
-Found 75 tests; 69 PASS, 6 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 77 tests; 71 PASS, 6 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Same-origin script with correct sha256 hash.
 PASS Same-origin script with correct sha384 hash.
 PASS Same-origin script with correct sha512 hash.
@@ -25,7 +25,8 @@ PASS Same-origin script with non-matching digest does not re-use preload with ma
 PASS Same-origin script with matching digest does not re-use preload with non-matching digest.
 PASS Same-origin script with non-matching digest does not re-use preload with non-matching digest.
 PASS Same-origin script with matching digest does not reuse preload without digest.
-PASS [Tentative] Same-origin script with matching digest does not reuse preload with matching but stronger digest.
+PASS Same-origin script with matching digest does not reuse preload with matching but stronger digest.
+PASS Same-origin script with wrong digest does not reuse preload with correct and stronger digest.
 PASS Same-origin script with matching digest does not reuse preload with matching but weaker digest.
 PASS Same-origin script with non-matching digest reuses preload with no digest but fails.
 PASS Same-origin style with correct sha256 hash.
@@ -53,7 +54,8 @@ PASS Same-origin style with non-matching digest does not re-use preload with mat
 PASS Same-origin style with matching digest does not re-use preload with non-matching digest.
 PASS Same-origin style with non-matching digest does not re-use preload with non-matching digest.
 PASS Same-origin style with matching digest does not reuse preload without digest.
-PASS [Tentative] Same-origin style with matching digest does not reuse preload with matching but stronger digest.
+PASS Same-origin style with matching digest does not reuse preload with matching but stronger digest.
+PASS Same-origin style with wrong digest does not reuse preload with correct and stronger digest.
 PASS Same-origin style with matching digest does not reuse preload with matching but weaker digest.
 PASS Same-origin style with non-matching digest reuses preload with no digest but fails.
 PASS Same-origin image with correct sha256 hash.