From 19bb0a14d7e2ac73c1721fb473640c1cca2c7720 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Wang?= Date: Mon, 27 Jan 2025 16:29:05 +0000 Subject: [PATCH] Bug 1943316 [wpt PR 50238] - Trusted Types: Improve testing of samples in violation reports., a=testonly Automatic update from web-platform-tests Trusted Types: Improve testing of samples in violation reports. (#50238) * Trusted Types: Improve testing of samples in violation reports. https://github.com/w3c/trusted-types/issues/576 https://github.com/w3c/trusted-types/issues/494 -- wpt-commits: ef244b70ed0105ed535584bc05d7bb1ec193b1d1 wpt-pr: 50238 --- ...icyFactory-createPolicy-cspTests-none.html | 8 +- ...pePolicyFactory-createPolicy-cspTests.html | 12 ++- .../trusted-types/support/csp-violations.js | 11 +++ ...d-types-eval-reporting-no-unsafe-eval.html | 13 ++- ...sted-types-eval-reporting-report-only.html | 4 +- .../trusted-types-eval-reporting.html | 4 +- .../trusted-types-reporting.html | 79 ++++++++++--------- .../trusted-types-source-file-path.html | 14 +++- .../trusted-types-svg-script-set-href.html | 12 ++- .../trusted-types-svg-script.html | 16 +++- 10 files changed, 114 insertions(+), 59 deletions(-) diff --git a/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html b/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html index 7e67f2bbb70f8..a75b50f8f002e 100644 --- a/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html +++ b/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests-none.html @@ -8,16 +8,20 @@ diff --git a/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests.html b/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests.html index 0a43d2171ccda..f84634a1408d2 100644 --- a/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests.html +++ b/testing/web-platform/tests/trusted-types/TrustedTypePolicyFactory-createPolicy-cspTests.html @@ -24,20 +24,24 @@ // Non-allowed names test promise_test(async t => { + const policyName = 'SomeOtherName'; let violation = await trusted_type_violation_for(TypeError, _ => - window.trustedTypes.createPolicy('SomeOtherName', { createHTML: s => s } ) + window.trustedTypes.createPolicy(policyName, { createHTML: s => s } ) ); assert_true(violation.originalPolicy.includes("trusted-types SomeName JustOneMoreName AnotherName")); + assert_equals(violation.sample, clipSampleIfNeeded(policyName)); }, "Non-allowed name policy creation throws."); // Duplicate names test promise_test(async t => { - let policy = window.trustedTypes.createPolicy('AnotherName', { createHTML: s => s } ); - assert_equals(policy.name, 'AnotherName'); + const policyName = 'AnotherName'; + let policy = window.trustedTypes.createPolicy(policyName, { createHTML: s => s } ); + assert_equals(policy.name, policyName); let violation = await trusted_type_violation_for(TypeError, _ => - window.trustedTypes.createPolicy('AnotherName', { createHTML: s => s } ) + window.trustedTypes.createPolicy(policyName, { createHTML: s => s } ) ); assert_true(violation.originalPolicy.includes("trusted-types SomeName JustOneMoreName AnotherName")); + assert_equals(violation.sample, clipSampleIfNeeded(policyName)); }, "Duplicate name policy creation throws."); diff --git a/testing/web-platform/tests/trusted-types/support/csp-violations.js b/testing/web-platform/tests/trusted-types/support/csp-violations.js index f77dc56271915..61b763911f7b5 100644 --- a/testing/web-platform/tests/trusted-types/support/csp-violations.js +++ b/testing/web-platform/tests/trusted-types/support/csp-violations.js @@ -68,3 +68,14 @@ async function trusted_type_violation_without_exception_for(fn) { assert_equals(exception, null, "no exception thrown"); return violations[0]; } + +function clipSampleIfNeeded(sample) { + const clippedSampleLength = 40; + + // Clipping is a bit ambiguous when the sample contains surrogate pairs, so + // avoid that in our tests for now. + // https://github.com/w3c/trusted-types/issues/577 + assert_equals(sample.match(/[\uD800-\uDBFF][\uDC00-\uDFFF]/), null); + + return sample.substring(0, clippedSampleLength); +} diff --git a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-no-unsafe-eval.html b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-no-unsafe-eval.html index 2a917507735b1..5e2087a1c6b82 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-no-unsafe-eval.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-no-unsafe-eval.html @@ -34,31 +34,36 @@ window.script_run_beacon = 'never_overwritten'; promise_test(async t => { + const input = 'script_run_beacon="should not run"'; let violation = await trusted_type_violation_for(EvalError, _ => - eval('script_run_beacon="should not run"') + eval(input) ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.sample, `eval|${clipSampleIfNeeded(input)}`); assert_equals(script_run_beacon, 'never_overwritten'); }, "Trusted Type violation report: evaluating a string violates both script-src and trusted-types."); promise_test(async t => { + const input = 'script_run_beacon="i ran"'; let violation = await trusted_type_violation_for(EvalError, _ => - eval(scriptyPolicy.createScript('script_run_beacon="i ran"')) + eval(scriptyPolicy.createScript(input)) ); assert_equals(violation.effectiveDirective, "script-src"); + assert_equals(violation.sample, clipSampleIfNeeded(input)); assert_not_equals(script_run_beacon, 'i ran'); // Code did not run. assert_equals(script_run_beacon, 'never_overwritten'); }, "Trusted Type violation report: evaluating a Trusted Script violates script-src."); promise_test(async t => { + const input = 'script_run_beacon="should not run"'; trustedTypes.createPolicy('default', { createScript: s => s, }, true); let violation = await trusted_type_violation_for(EvalError, _ => - eval('script_run_beacon="should not run"') // script-src will block. + eval(input) // script-src will block. ); assert_equals(violation.effectiveDirective, "script-src"); - assert_true(violation.sample.includes("should not run")); + assert_equals(violation.sample, clipSampleIfNeeded(input)); assert_not_equals(script_run_beacon, 'should not run'); // Code did not run. assert_equals(script_run_beacon, 'never_overwritten'); }, "Trusted Type violation report: script-src restrictions apply after the default policy runs."); diff --git a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-report-only.html b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-report-only.html index b0cc65c088431..226db176bd8d0 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-report-only.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting-report-only.html @@ -34,10 +34,12 @@ window.script_run_beacon = 'vanilla'; promise_test(async t => { + const input = 'script_run_beacon="report-only-does-not-stop"'; let violation = await trusted_type_violation_without_exception_for(_ => - eval('script_run_beacon="report-only-does-not-stop"') + eval(input) ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.sample, `eval|${clipSampleIfNeeded(input)}`); assert_equals(script_run_beacon, 'report-only-does-not-stop'); }, "Trusted Type violation report: evaluating a string."); diff --git a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting.html b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting.html index 0fa7ed2be80f3..2fc889549ec28 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-eval-reporting.html @@ -31,11 +31,13 @@ const scriptyPolicy = trustedTypes.createPolicy('allowEval', a_policy); promise_test(async t => { + const input = 'beacon="should not run"'; let beacon = 'never_overwritten'; let violation = await trusted_type_violation_for(EvalError, _ => - eval('beacon="should not run"') + eval(input) ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.sample, `eval|${clipSampleIfNeeded(input)}`); assert_equals(beacon, 'never_overwritten'); }, "Trusted Type violation report: evaluating a string."); diff --git a/testing/web-platform/tests/trusted-types/trusted-types-reporting.html b/testing/web-platform/tests/trusted-types/trusted-types-reporting.html index f1d0b14ee0497..2ea5855e05463 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-reporting.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-reporting.html @@ -33,11 +33,6 @@ const url = "" + document.location; - // TODO(vogelheim): The current set of tests allows for more variance in the - // sample reports than the current spec draft does. Once the spec has - // been finalized, we should clamp this down to check byte-for-byte - // against the values mandated by the spec. - // A sample policy we use to test trustedTypes.createPolicy behaviour. const id = x => x; const a_policy = { @@ -47,26 +42,30 @@ }; promise_test(async t => { + const policyName = "three"; let {violations, exception} = await trusted_type_violations_and_exception_for(_ => trustedTypes.createPolicy("three", a_policy) ); assert_equals(violations.length, 2); assert_true(violations[0].originalPolicy.includes("trusted-types one")); + assert_equals(violations[0].sample, clipSampleIfNeeded(policyName)); + assert_equals(violations[0].blockedURI, "trusted-types-policy"); assert_true(violations[1].originalPolicy.includes("trusted-types two")); - assert_true(violations[1].sample.includes("three")); + assert_equals(violations[1].sample, clipSampleIfNeeded(policyName)); assert_equals(violations[1].blockedURI, "trusted-types-policy"); assert_true(exception instanceof TypeError); }, "Trusted Type violation report: creating a forbidden policy."); promise_test(async t => { + const policyName = "two"; let {violations, exception} = await trusted_type_violations_and_exception_for(_ => - trustedTypes.createPolicy("two", a_policy) + trustedTypes.createPolicy(policyName, a_policy) ); assert_equals(violations.length, 1); assert_true(violations[0].originalPolicy.includes("trusted-types one")); - assert_true(violations[0].sample.includes("two")); + assert_equals(violations[0].sample, clipSampleIfNeeded(policyName)); assert_equals(violations[0].blockedURI, "trusted-types-policy"); assert_true(exception instanceof TypeError); }, "Trusted Type violation report: creating a report-only-forbidden policy."); @@ -75,15 +74,14 @@ let policy_one = null; promise_test(async t => { - let {violations, exception} = + const policyName = "one"; + let violation = await trusted_type_violation_without_exception_for(_ => - policy_one = trustedTypes.createPolicy("one", a_policy) + policy_one = trustedTypes.createPolicy(policyName, a_policy) ); - assert_equals(violations.length, 1); - assert_true(violations[0].originalPolicy.includes("trusted-types two")); - assert_true(violations[0].sample.includes("one")); - assert_equals(violations[0].blockedURI, "trusted-types-policy"); - assert_equals(exception, null); + assert_true(violation.originalPolicy.includes("trusted-types two")); + assert_equals(violation.sample, clipSampleIfNeeded(policyName)); + assert_equals(violation.blockedURI, "trusted-types-policy"); }, "Trusted Type violation report: creating a forbidden-but-not-reported policy."); promise_test(async t => { @@ -121,75 +119,83 @@ }, "Trusted Type violation report: assign trusted HTML to html; no report"); promise_test(async t => { + const input = "abc"; let violation = await trusted_type_violation_for(TypeError, _ => - document.getElementById("div").innerHTML = "abc" + document.getElementById("div").innerHTML = input ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); assert_equals(violation.blockedURI, "trusted-types-sink"); - assert_true(violation.sample.includes("Element innerHTML|abc")); + assert_equals(violation.sample, `Element innerHTML|${clipSampleIfNeeded(input)}`); }, "Trusted Type violation report: sample for innerHTML assignment"); promise_test(async t => { + const input = "1+2;"; let violation = await trusted_type_violation_for(TypeError, _ => - document.getElementById("script").text = "abc" + document.getElementById("script").text = input ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); assert_equals(violation.blockedURI, "trusted-types-sink"); - assert_true(violation.sample.includes("HTMLScriptElement text|abc")); + assert_equals(violation.sample, `HTMLScriptElement text|${clipSampleIfNeeded(input)}`); }, "Trusted Type violation report: sample for text assignment"); promise_test(async t => { + const input = "about:blank"; let violation = await trusted_type_violation_for(TypeError, _ => - document.getElementById("script").src = "" + document.getElementById("script").src = input ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); assert_equals(violation.blockedURI, "trusted-types-sink"); - assert_true(violation.sample.includes("HTMLScriptElement src")); + assert_equals(violation.sample, `HTMLScriptElement src|${clipSampleIfNeeded(input)}`); }, "Trusted Type violation report: sample for script.src assignment"); promise_test(async t => { + const input = "2+2;"; let violation = await trusted_type_violation_for(TypeError, _ => document.getElementById("script").innerText = "2+2;" ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); assert_equals(violation.blockedURI, "trusted-types-sink"); - assert_true(violation.sample.includes("Element innerText|2+2")); + assert_equals(violation.sample, `HTMLScriptElement innerText|${clipSampleIfNeeded(input)}`); }, "Trusted Type violation report: sample for script innerText assignment"); promise_test(async t => { + const input = "about:blank"; let violation = await trusted_type_violation_for(TypeError, _ => - document.getElementById("svgscript").href.baseVal = "" + document.getElementById("svgscript").href.baseVal = input ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); assert_equals(violation.blockedURI, "trusted-types-sink"); - assert_true(violation.sample.includes("SVGScriptElement href")); + assert_equals(violation.sample, `SVGScriptElement href|${clipSampleIfNeeded(input)}`); }, "Trusted Type violation report: sample for SVGScriptElement href assignment"); promise_test(async t => { + const input = "about:blank"; let violation = await trusted_type_violation_for(TypeError, _ => - document.getElementById("svgscript").setAttribute('href', "test") + document.getElementById("svgscript").setAttribute('href', input) ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); assert_equals(violation.blockedURI, "trusted-types-sink"); - assert_true(violation.sample.includes("SVGScriptElement href")); + assert_equals(violation.sample, `SVGScriptElement href|${clipSampleIfNeeded(input)}`); }, "Trusted Type violation report: sample for SVGScriptElement href assignment by setAttribute"); promise_test(async t => { + const input = "2+3"; let violation = await trusted_type_violation_for(TypeError, _ => - document.getElementById("svgscript").insertBefore(document.createTextNode("Hello"), null) + document.getElementById("svgscript").insertBefore(document.createTextNode(input), null) ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); assert_equals(violation.blockedURI, "trusted-types-sink"); - assert_true(violation.sample.includes("SVGScriptElement text")); + assert_equals(violation.sample, `SVGScriptElement text|${clipSampleIfNeeded(input)}`); }, "Trusted Type violation report: sample for SVGScriptElement text assignment"); promise_test(async t => { + const input = "2+2"; let violation = await trusted_type_violation_for(EvalError, _ => - eval("2+2") + eval(input) ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); assert_equals(violation.blockedURI, "trusted-types-sink"); - assert_true(violation.sample.includes("eval|2+2")); + assert_equals(violation.sample, `eval|${clipSampleIfNeeded(input)}`); }, "Trusted Type violation report: sample for eval"); promise_test(async t => { @@ -201,8 +207,7 @@ ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); assert_equals(violation.blockedURI, "trusted-types-sink"); - assert_true(violation.sample.includes("HTMLScriptElement innerText|abbb")); - assert_less_than(violation.sample.length, 150); + assert_equals(violation.sample, `HTMLScriptElement innerText|${clipSampleIfNeeded(value)}`); }, "Trusted Type violation report: large values should be handled sanely."); // Test reporting for Custom Elements (where supported). The report should @@ -213,22 +218,24 @@ customElements.define("custom-script", CustomScript, { extends: "script" }); promise_test(async t => { + const input = "about:blank"; let violation = await trusted_type_violation_for(TypeError, _ => - document.getElementById("customscript").src = "abc" + document.getElementById("customscript").src = input ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); assert_equals(violation.blockedURI, "trusted-types-sink"); - assert_true(violation.sample.includes("HTMLScriptElement src|abc")); + assert_equals(violation.sample, `HTMLScriptElement src|${clipSampleIfNeeded(input)}`); }, "Trusted Type violation report: sample for custom element assignment"); } promise_test(async t => { + const input = "about:blank"; let violation = await trusted_type_violation_for(TypeError, _ => - new Worker("blabla") + new Worker(input) ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); assert_equals(violation.blockedURI, "trusted-types-sink"); - assert_true(violation.sample.includes("Worker constructor|")); + assert_equals(violation.sample, `Worker constructor|${clipSampleIfNeeded(input)}`); }, "Trusted Type violation report: Worker constructor"); diff --git a/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.html b/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.html index 871c267d581db..edb1d5d68e933 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.html @@ -33,32 +33,38 @@ } promise_test(async t => { + const input = "'test'"; let violation = await trusted_type_violation_for(TypeError, _ => - document.getElementById("to-be-modified").innerHTML = "'test'" + document.getElementById("to-be-modified").innerHTML = input ); - assert_equals(violation.sourceFile, location.href) + assert_equals(violation.sourceFile, location.href); + assert_equals(violation.sample, `Element innerHTML|${clipSampleIfNeeded(input)}`); }, "same-document script") promise_test(async t => { + const input = "'test'"; let script_origin = get_host_info().HTTP_ORIGIN; let script_src = script_origin + "/trusted-types/support/set-inner-html.js"; let script = await futureScript(script_src); let violation = await trusted_type_violation_for(TypeError, _ => - setInnerHtml(toBeModified, "'test'") + setInnerHtml(toBeModified, input) ); assert_equals(violation.sourceFile, script_src); + assert_equals(violation.sample, `Element innerHTML|${clipSampleIfNeeded(input)}`); }, "same-origin script") promise_test(async t => { + const input = "'test'"; let script_origin = get_host_info().HTTP_REMOTE_ORIGIN; let script_src = script_origin + "/trusted-types/support/set-inner-html.js"; let script = await futureScript(script_src); let violation = await trusted_type_violation_for(TypeError, _ => - setInnerHtml(toBeModified, "'test'") + setInnerHtml(toBeModified, input) ); assert_equals(violation.sourceFile, script_src); + assert_equals(violation.sample, `Element innerHTML|${clipSampleIfNeeded(input)}`); }, "cross-origin script") // TODO(arthursonzogni): Check what happens with redirects. Do we report the diff --git a/testing/web-platform/tests/trusted-types/trusted-types-svg-script-set-href.html b/testing/web-platform/tests/trusted-types/trusted-types-svg-script-set-href.html index 2dd7e163894f3..f339ba119a1b6 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-svg-script-set-href.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-svg-script-set-href.html @@ -16,11 +16,13 @@ createScriptURL: script_url => script_url }); promise_test(async t => { + const input = "about:blank"; const elem = document.createElementNS(NSURI_SVG, "script"); let violation = await trusted_type_violation_for(TypeError, _ => - elem.href.baseVal = "about:blank" + elem.href.baseVal = input ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.sample, `SVGScriptElement href|${clipSampleIfNeeded(input)}`); document.getElementById("svg").appendChild(elem); }, "Assign string to SVGScriptElement.href.baseVal."); @@ -34,11 +36,13 @@ }, "Assign TrustedScriptURL to SVGScriptElement.href.baseVal."); promise_test(async t => { + const input = "about:blank"; const elem = document.createElementNS(NSURI_SVG, "script"); let violation = await trusted_type_violation_for(TypeError, _ => - elem.setAttribute("href", "about:blank") + elem.setAttribute("href", input) ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.sample, `SVGScriptElement href|${clipSampleIfNeeded(input)}`); document.getElementById("svg").appendChild(elem); }, "Assign string to non-attached SVGScriptElement.href via setAttribute."); @@ -52,12 +56,14 @@ }, "Assign TrustedScriptURL to non-attached SVGScriptElement.href via setAttribute."); promise_test(async t => { + const input = "about:blank"; const elem = document.createElementNS(NSURI_SVG, "script"); document.getElementById("svg").appendChild(elem); let violation = await trusted_type_violation_for(TypeError, _ => - elem.setAttribute("href", "about:blank") + elem.setAttribute("href", input) ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.sample, `SVGScriptElement href|${clipSampleIfNeeded(input)}`); }, "Assign string to attached SVGScriptElement.href via setAttribute."); promise_test(t => { diff --git a/testing/web-platform/tests/trusted-types/trusted-types-svg-script.html b/testing/web-platform/tests/trusted-types/trusted-types-svg-script.html index ac8d714f56a09..4fc3b710eb620 100644 --- a/testing/web-platform/tests/trusted-types/trusted-types-svg-script.html +++ b/testing/web-platform/tests/trusted-types/trusted-types-svg-script.html @@ -15,36 +15,44 @@ createScript: x => x, createHTML: x => x, createScriptURL: x => x }); promise_test(async t => { + const input = "'modified via innerHTML';" let violation = await trusted_type_violation_for(TypeError, _ => - document.getElementById("script").innerHTML = "'modified via innerHTML';" + document.getElementById("script").innerHTML = input ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.sample, `SVGScriptElement innerHTML|${clipSampleIfNeeded(input)}`); }, "Assign String to SVGScriptElement.innerHTML."); promise_test(async t => { + const input = "'modified via innerHTML';" let violation = await trusted_type_violation_for(TypeError, _ => - document.getElementById("script").innerHTML = policy.createHTML("'modified via innerHTML';") + document.getElementById("script").innerHTML = policy.createHTML(input) ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.sample, `SVGScriptElement innerHTML|${clipSampleIfNeeded(input)}`); }, "Assign TrustedHTML to SVGScriptElement.innerHTML."); promise_test(async t => { + const input = "'modified via innerHTML';" const elem = document.createElementNS( "http://www.w3.org/2000/svg", "script"); let violation = await trusted_type_violation_for(TypeError, _ => - elem.innerHTML = policy.createHTML("'modified via innerHTML';") + elem.innerHTML = policy.createHTML(input) ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.sample, `SVGScriptElement innerHTML|${clipSampleIfNeeded(input)}`); document.getElementById("svg").appendChild(elem); }, "Assign TrustedHTML to SVGScriptElement.innerHTML and execute it."); promise_test(async t => { + const input = "modified via DOM"; const elem = document.createElementNS( "http://www.w3.org/2000/svg", "script"); let violation = await trusted_type_violation_for(TypeError, _ => - elem.insertBefore(document.createTextNode("modified via DOM"), null) + elem.insertBefore(document.createTextNode(input), null) ); assert_true(violation.originalPolicy.includes("require-trusted-types-for 'script'")); + assert_equals(violation.sample, `SVGScriptElement text|${clipSampleIfNeeded(input)}`); document.getElementById("svg").appendChild(elem); }, "Modify SVGScriptElement via DOM manipulation.");