Add WPT tests for <meta name="referrer">

Add tests to check behaviour when <meta name="referrer"> tags are removed. Bug: 1392851 Change-Id: I646c7551b4b0767a943a4e1777325f6b99b63e70 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4048890 Commit-Queue: Domenic Denicola <[email protected]> Reviewed-by: Domenic Denicola <[email protected]> Cr-Commit-Position: refs/heads/main@{#1081246}
Tobias710219 · Dec 9, 2022 · 4685601 · 4685601
1 parent 161ce86
commit 4685601
Show file tree

Hide file tree

Showing 4 changed files with 126 additions and 0 deletions.
diff --git a/referrer-policy/generic/first-meta-changed-after-second-added.http.html b/referrer-policy/generic/first-meta-changed-after-second-added.http.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<head>
+  <script src="/resources/testharness.js"></script>
+  <script src="/resources/testharnessreport.js"></script>
+
+  <meta name="referrer" content="no-referrer" id="referrermeta">
+</head>
+<body>
+  <script>
+    async function fetchAndGetReferrer() {
+      let response = await fetch('/common/security-features/subresource/xhr.py');
+      let data = await response.json();
+      return data.headers.referer;
+    }
+
+    promise_test(async t => {
+      assert_equals(await fetchAndGetReferrer(), undefined,
+                    'referrer should not be set');
+
+      // Add second meta _before_ first meta.
+      const first_meta = document.getElementById('referrermeta');
+      const second_meta = document.createElement('meta');
+      second_meta.name = 'referrer';
+      second_meta.content = 'strict-origin';
+      document.head.appendChild(second_meta);
+      assert_equals(await fetchAndGetReferrer(), window.location.origin + '/',
+                    'referrer should be origin only');
+
+      // Update content attribute of first meta.
+      first_meta.content = 'unsafe-url';
+      assert_equals(await fetchAndGetReferrer(), window.location.href,
+                    'referrer should be full url');
+      }, 'document referrer policy is the value of the most recently modified <meta name="referrer"');
+
+  </script>
+</body>
diff --git a/referrer-policy/generic/meta-referrer-removed-1.http.html b/referrer-policy/generic/meta-referrer-removed-1.http.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<head>
+  <script src="/resources/testharness.js"></script>
+  <script src="/resources/testharnessreport.js"></script>
+
+  <meta name="referrer" content="no-referrer" id="referrermeta">
+</head>
+<body>
+  <script>
+    async function fetchAndGetReferrer() {
+      let response = await fetch('/common/security-features/subresource/xhr.py');
+      let data = await response.json();
+      return data.headers.referer;
+    }
+
+    promise_test(async t => {
+      assert_equals(await fetchAndGetReferrer(), undefined,
+                    'referrer should not be set');
+
+      document.getElementById('referrermeta').remove();
+      assert_equals(await fetchAndGetReferrer(), undefined,
+                    'referrer should not be set');
+    }, 'removing <meta name="referrer"> should not change referrer policy');
+  </script>
+</body>
diff --git a/referrer-policy/generic/meta-referrer-removed-2.http.html b/referrer-policy/generic/meta-referrer-removed-2.http.html
@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<head>
+  <script src="/resources/testharness.js"></script>
+  <script src="/resources/testharnessreport.js"></script>
+
+  <meta name="referrer" content="no-referrer" id="referrermeta">
+</head>
+<body>
+  <script>
+    async function fetchAndGetReferrer() {
+      let response = await fetch('/common/security-features/subresource/xhr.py');
+      let data = await response.json();
+      return data.headers.referer;
+    }
+
+    promise_test(async t => {
+      assert_equals(await fetchAndGetReferrer(), undefined,
+                    'referrer should not be set');
+
+      // Add second meta tag.
+      const second_meta = document.createElement('meta');
+      second_meta.name = 'referrer';
+      second_meta.content = 'strict-origin';
+      document.head.appendChild(second_meta);
+      // Second meta should override the first.
+      assert_equals(await fetchAndGetReferrer(), location.origin + '/',
+                    'referrer should be origin only');
+
+      second_meta.remove();
+      assert_equals(await fetchAndGetReferrer(), window.location.origin + '/',
+                    'referrer should be origin only');
+    }, 'referrer policy does not change when second <meta name="referrer"> is removed');
+  </script>
+</body>
diff --git a/referrer-policy/generic/second-meta-referrer-added-before-first.http.html b/referrer-policy/generic/second-meta-referrer-added-before-first.http.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<head>
+  <script src="/resources/testharness.js"></script>
+  <script src="/resources/testharnessreport.js"></script>
+
+  <meta name="referrer" content="no-referrer" id="referrermeta">
+</head>
+<body>
+  <script>
+    async function fetchAndGetReferrer() {
+      let response = await fetch('/common/security-features/subresource/xhr.py');
+      let data = await response.json();
+      return data.headers.referer;
+    }
+
+    promise_test(async t => {
+      assert_equals(await fetchAndGetReferrer(), undefined,
+                    'referrer should not be set');
+
+      // Add second meta _before_ first meta.
+      const first_meta = document.getElementById('referrermeta');
+      const second_meta = document.createElement('meta');
+      second_meta.name = 'referrer';
+      second_meta.content = 'strict-origin';
+      document.head.insertBefore(second_meta, first_meta);
+      assert_equals(await fetchAndGetReferrer(), window.location.origin + '/',
+                    'referrer should the origin only');
+    }, 'document referrer policy is the value of the most recently added <meta name="referrer">');
+
+  </script>
+</body>