Meziantou.Framework

content-security-policy

edit

WPT coverage of the tests of content-security-policy at the revision 5602b0f210e3. The tests link to their results in the browsers on wpt.fyi. The tentative tests (experimental features) and the reftests are listed separately from the stable tests.

GroupPassingTestsDisabledPass rate
Stable862893097%
Tentative815053%
Reftests880100%
All878916096%

Failure reasons

The tests that do not pass (failing or disabled), by kind of reason. A test with several reasons counts once per kind.

  • BUG: 1
  • TEST BUG: 9
  • NOT IMPLEMENTED: 20
  • TEST RUNNER: 1
  • OUT OF SCOPE: 7

Stable tests

TestResultSubtestsKindDescription
base-uri/base-uri-allow-leading-zero-port.sub.htmlPass1 / 1
base-uri/base-uri-allow.sub.htmlPass1 / 1
base-uri/base-uri-deny-url-encoded-host.sub.htmlPass2 / 2
base-uri/base-uri-deny.sub.htmlPass2 / 2
base-uri/base-uri_iframe_sandbox.sub.htmlPass2 / 2
base-uri/report-uri-does-not-respect-base-uri.sub.htmlPass3 / 3
blob/blob-urls-do-not-match-self.sub.htmlPass1 / 1
blob/blob-urls-match-blob.sub.htmlPass1 / 1
blob/frame-src-blob-matches-blob.sub.htmlPass1 / 1
blob/frame-src-self-does-not-match-blob.sub.htmlPass1 / 1
blob/self-doesnt-match-blob.sub.htmlPass1 / 1
blob/star-doesnt-match-blob.sub.htmlPass1 / 1
child-src/child-src-about-blank-allowed-by-default.sub.htmlPass1 / 1
child-src/child-src-about-blank-allowed-by-scheme.sub.htmlPass1 / 1
child-src/child-src-allowed.sub.htmlPass2 / 2
child-src/child-src-blocked.sub.htmlPass1 / 1
child-src/child-src-conflicting-frame-src.sub.htmlPass1 / 1
child-src/child-src-cross-origin-load.sub.htmlPass4 / 4
child-src/child-src-redirect-blocked.sub.htmlPass1 / 1
child-src/child-src-worker-allowed.sub.htmlPass1 / 1
child-src/child-src-worker-blocked.sub.htmlPass2 / 2
connect-src/connect-src-beacon-allowed.sub.htmlPass1 / 1
connect-src/connect-src-beacon-blocked.sub.htmlPass1 / 1
connect-src/connect-src-beacon-redirect-to-blocked.sub.htmlPass1 / 1
connect-src/connect-src-eventsource-allowed.sub.htmlPass1 / 1
connect-src/connect-src-eventsource-blocked.sub.htmlPass1 / 1
connect-src/connect-src-eventsource-redirect-to-blocked.sub.htmlPass1 / 1
connect-src/connect-src-fetch-keepalive-allowed.sub.htmlPass2 / 2
connect-src/connect-src-fetch-keepalive-blocked.sub.htmlPass2 / 2
connect-src/connect-src-fetch-keepalive-redirect-to-blocked.sub.htmlPass2 / 2
connect-src/connect-src-json-import-allowed.sub.htmlPass1 / 1
connect-src/connect-src-json-import-blocked.sub.htmlPass1 / 1
connect-src/connect-src-syncxmlhttprequest-allowed.sub.htmlPass1 / 1
connect-src/connect-src-syncxmlhttprequest-blocked.sub.htmlPass1 / 1
connect-src/connect-src-syncxmlhttprequest-redirect-to-blocked.sub.htmlPass1 / 1
connect-src/connect-src-text-import-allowed.sub.htmlPass1 / 1
connect-src/connect-src-text-import-blocked.sub.htmlPass1 / 1
connect-src/connect-src-websocket-allowed.sub.htmlPass1 / 1
connect-src/connect-src-websocket-blocked.sub.htmlPass1 / 1
connect-src/connect-src-websocket-self.sub.htmlPass1 / 1
connect-src/connect-src-webtransport-allowed.sub.https.htmlFail0 / 3NOT IMPLEMENTEDWebTransport
connect-src/connect-src-webtransport-blocked.sub.https.htmlFail0 / 2NOT IMPLEMENTEDWebTransport
connect-src/connect-src-webtransport-hashes.sub.https.htmlFail0 / 3NOT IMPLEMENTEDWebTransport
connect-src/connect-src-xmlhttprequest-allowed.sub.htmlPass1 / 1
connect-src/connect-src-xmlhttprequest-blocked.sub.htmlPass1 / 1
connect-src/connect-src-xmlhttprequest-redirect-to-blocked.sub.htmlPass1 / 1
connect-src/shared-worker-connect-src-allowed.sub.htmlPass1 / 1
connect-src/shared-worker-connect-src-blocked.sub.htmlPass1 / 1
connect-src/worker-connect-src-allowed.sub.htmlPass1 / 1
connect-src/worker-connect-src-blocked.sub.htmlPass1 / 1
connect-src/worker-from-guid.sub.htmlPass1 / 1
default-src/default-src-inline-allowed.sub.htmlPass1 / 1
default-src/default-src-inline-blocked.sub.htmlPass1 / 1
default-src/default-src-sri_hash.sub.htmlPass12 / 12
default-src/default-src-strict_dynamic_and_unsafe_inline.htmlPass1 / 1
embedded-enforcement/allow_csp_from-header.htmlPass12 / 12
embedded-enforcement/blocked-iframe-are-cross-origin.htmlPass2 / 2
embedded-enforcement/change-csp-attribute-and-history-navigation.htmlPass2 / 2
embedded-enforcement/idlharness.window.jsPass15 / 15
embedded-enforcement/iframe-csp-attribute.htmlPass4 / 4
embedded-enforcement/required-csp-header-cascade.htmlPass9 / 9
embedded-enforcement/required_csp-header-crlf.htmlPass18 / 18
embedded-enforcement/required_csp-header.htmlPass75 / 75
embedded-enforcement/subsumption_algorithm-general.htmlPass16 / 16
embedded-enforcement/subsumption_algorithm-hashes.htmlPass13 / 13
embedded-enforcement/subsumption_algorithm-host_sources-hosts.htmlPass5 / 5
embedded-enforcement/subsumption_algorithm-host_sources-paths.htmlPass9 / 9
embedded-enforcement/subsumption_algorithm-host_sources-ports.htmlPass15 / 15
embedded-enforcement/subsumption_algorithm-host_sources-protocols.htmlPass11 / 11
embedded-enforcement/subsumption_algorithm-nonces.htmlPass8 / 8
embedded-enforcement/subsumption_algorithm-none.htmlPass18 / 18
embedded-enforcement/subsumption_algorithm-self.htmlPass7 / 7
embedded-enforcement/subsumption_algorithm-source_list-wildcards.htmlPass24 / 24
embedded-enforcement/subsumption_algorithm-strict_dynamic.htmlPass11 / 11
embedded-enforcement/subsumption_algorithm-unsafe_eval.htmlPass7 / 7
embedded-enforcement/subsumption_algorithm-unsafe_hashes.htmlPass7 / 7
embedded-enforcement/subsumption_algorithm-unsafe_inline.htmlPass16 / 16
font-src/font-match-allowed.sub.htmlPass1 / 1
font-src/font-mismatch-blocked.sub.htmlPass1 / 1
font-src/font-none-blocked.sub.htmlPass1 / 1
font-src/font-self-allowed.htmlPass1 / 1
font-src/font-stylesheet-font-blocked.sub.htmlPass1 / 1
font-src/shared-stylesheet-font-cache-bypass-strict-first.htmlPass1 / 1
font-src/shared-stylesheet-font-cache-bypass.htmlPass1 / 1
form-action/form-action-self-allowed-target-blank.htmlPass1 / 1
form-action/form-action-src-allowed-target-blank.sub.htmlPass1 / 1
form-action/form-action-src-allowed-target-frame.sub.htmlPass1 / 1
form-action/form-action-src-allowed.sub.htmlPass1 / 1
form-action/form-action-src-blocked.sub.htmlPass1 / 1
form-action/form-action-src-default-ignored.sub.htmlPass1 / 1
form-action/form-action-src-get-allowed.sub.htmlPass1 / 1
form-action/form-action-src-get-blocked.sub.htmlPass1 / 1
form-action/form-action-src-javascript-blocked.sub.htmlPass1 / 1
form-action/form-action-src-javascript-prevented.htmlPass1 / 1
form-action/form-action-src-redirect-allowed-target-blank.sub.htmlPass1 / 1
form-action/form-action-src-redirect-allowed-target-frame.sub.htmlPass1 / 1
form-action/form-action-src-redirect-blocked.sub.htmlPass1 / 1
frame-ancestors/frame-ancestors-from-serviceworker.https.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-cross-in-cross-none-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-cross-in-cross-self-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-cross-in-cross-star-allow.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-cross-in-cross-url-allow.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-cross-in-cross-url-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-cross-in-same-none-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-cross-in-same-self-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-cross-in-same-star-allow.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-cross-in-same-url-allow.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-cross-in-same-url-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-cross-in-sandboxed-cross-url-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-same-in-cross-none-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-same-in-cross-self-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-same-in-cross-star-allow.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-same-in-cross-url-allow.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-same-in-cross-url-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-same-in-same-none-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-same-in-same-self-allow.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-same-in-same-star-allow.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-same-in-same-url-allow.htmlPass1 / 1
frame-ancestors/frame-ancestors-nested-same-in-same-url-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-none-block.htmlPass2 / 2
frame-ancestors/frame-ancestors-overrides-xfo.htmlPass2 / 2
frame-ancestors/frame-ancestors-path-ignored.window.jsPass1 / 1
frame-ancestors/frame-ancestors-sandbox-same-origin-self.htmlPass1 / 1
frame-ancestors/frame-ancestors-self-allow.htmlPass1 / 1
frame-ancestors/frame-ancestors-self-block.htmlPass1 / 1
frame-ancestors/frame-ancestors-star-allow-crossorigin.htmlPass1 / 1
frame-ancestors/frame-ancestors-star-allow-sameorigin.htmlPass1 / 1
frame-ancestors/frame-ancestors-url-allow.sub.htmlPass1 / 1
frame-ancestors/frame-ancestors-url-block.htmlPass1 / 1
frame-ancestors/report-blocked-frame.sub.htmlPass1 / 1
frame-ancestors/report-only-frame.sub.htmlPass1 / 1
frame-src/frame-src-about-blank-allowed-by-default.sub.htmlPass1 / 1
frame-src/frame-src-about-blank-allowed-by-scheme.sub.htmlPass1 / 1
frame-src/frame-src-allowed.sub.htmlPass2 / 2
frame-src/frame-src-blocked-path-matching.sub.htmlPass3 / 3
frame-src/frame-src-blocked.sub.htmlPass1 / 1
frame-src/frame-src-cross-origin-load.sub.htmlPass3 / 3
frame-src/frame-src-cross-origin-same-document-navigation.window.jsPass1 / 1
frame-src/frame-src-redirect.htmlTimeout0 / 1TEST BUGthe test expects the violation of the redirect to have the origin of the redirect target as blocked URI, but the blocked URI of a request is the URL of the request, not its current URL (https://w3c.github.io/webappsec-csp/#create-violation-for-request); fails in Firefox
frame-src/frame-src-same-document-meta.sub.htmlPass1 / 1
frame-src/frame-src-same-document.sub.htmlPass1 / 1
frame-src/frame-src-sandboxed-allowed.htmlPass1 / 1
frame-src/frame-src-self-unique-origin.htmlPass1 / 1
gen/top.http-rp/script-src-self/script-tag.http.htmlPass12 / 12
gen/top.http-rp/script-src-self/script-tag.https.htmlPass12 / 12
gen/top.http-rp/script-src-self/sharedworker-classic.http.htmlPass4 / 4
gen/top.http-rp/script-src-self/sharedworker-classic.https.htmlPass4 / 4
gen/top.http-rp/script-src-self/sharedworker-import-data.http.htmlPass12 / 12
gen/top.http-rp/script-src-self/sharedworker-import-data.https.htmlPass12 / 12
gen/top.http-rp/script-src-self/sharedworker-import.http.htmlPass12 / 12
gen/top.http-rp/script-src-self/sharedworker-import.https.htmlPass12 / 12
gen/top.http-rp/script-src-self/sharedworker-module.http.htmlPass4 / 4
gen/top.http-rp/script-src-self/sharedworker-module.https.htmlPass4 / 4
gen/top.http-rp/script-src-self/worker-classic.http.htmlPass4 / 4
gen/top.http-rp/script-src-self/worker-classic.https.htmlPass4 / 4
gen/top.http-rp/script-src-self/worker-import-data.http.htmlPass12 / 12
gen/top.http-rp/script-src-self/worker-import-data.https.htmlPass12 / 12
gen/top.http-rp/script-src-self/worker-import.http.htmlPass12 / 12
gen/top.http-rp/script-src-self/worker-import.https.htmlPass12 / 12
gen/top.http-rp/script-src-self/worker-module.http.htmlPass4 / 4
gen/top.http-rp/script-src-self/worker-module.https.htmlPass4 / 4
gen/top.http-rp/script-src-self/worklet-animation-import-data.https.htmlPass12 / 12
gen/top.http-rp/script-src-self/worklet-animation.https.htmlPass12 / 12
gen/top.http-rp/script-src-self/worklet-audio-import-data.https.htmlPass12 / 12
gen/top.http-rp/script-src-self/worklet-audio.https.htmlPass12 / 12
gen/top.http-rp/script-src-self/worklet-layout-import-data.https.htmlPass12 / 12
gen/top.http-rp/script-src-self/worklet-layout.https.htmlPass12 / 12
gen/top.http-rp/script-src-self/worklet-paint-import-data.https.htmlPass12 / 12
gen/top.http-rp/script-src-self/worklet-paint.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/script-tag.http.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/script-tag.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/sharedworker-classic.http.htmlPass4 / 4
gen/top.http-rp/script-src-wildcard/sharedworker-classic.https.htmlPass4 / 4
gen/top.http-rp/script-src-wildcard/sharedworker-import-data.http.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/sharedworker-import-data.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/sharedworker-import.http.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/sharedworker-import.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/sharedworker-module.http.htmlPass4 / 4
gen/top.http-rp/script-src-wildcard/sharedworker-module.https.htmlPass4 / 4
gen/top.http-rp/script-src-wildcard/worker-classic.http.htmlPass4 / 4
gen/top.http-rp/script-src-wildcard/worker-classic.https.htmlPass4 / 4
gen/top.http-rp/script-src-wildcard/worker-import-data.http.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/worker-import-data.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/worker-import.http.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/worker-import.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/worker-module.http.htmlPass4 / 4
gen/top.http-rp/script-src-wildcard/worker-module.https.htmlPass4 / 4
gen/top.http-rp/script-src-wildcard/worklet-animation-import-data.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/worklet-animation.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/worklet-audio-import-data.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/worklet-audio.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/worklet-layout-import-data.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/worklet-layout.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/worklet-paint-import-data.https.htmlPass12 / 12
gen/top.http-rp/script-src-wildcard/worklet-paint.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/script-tag.http.htmlPass12 / 12
gen/top.http-rp/worker-src-none/script-tag.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/sharedworker-classic.http.htmlPass4 / 4
gen/top.http-rp/worker-src-none/sharedworker-classic.https.htmlPass4 / 4
gen/top.http-rp/worker-src-none/sharedworker-import-data.http.htmlPass12 / 12
gen/top.http-rp/worker-src-none/sharedworker-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/sharedworker-import.http.htmlPass12 / 12
gen/top.http-rp/worker-src-none/sharedworker-import.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/sharedworker-module.http.htmlPass4 / 4
gen/top.http-rp/worker-src-none/sharedworker-module.https.htmlPass4 / 4
gen/top.http-rp/worker-src-none/worker-classic.http.htmlPass4 / 4
gen/top.http-rp/worker-src-none/worker-classic.https.htmlPass4 / 4
gen/top.http-rp/worker-src-none/worker-import-data.http.htmlPass12 / 12
gen/top.http-rp/worker-src-none/worker-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/worker-import.http.htmlPass12 / 12
gen/top.http-rp/worker-src-none/worker-import.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/worker-module.http.htmlPass4 / 4
gen/top.http-rp/worker-src-none/worker-module.https.htmlPass4 / 4
gen/top.http-rp/worker-src-none/worklet-animation-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/worklet-animation.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/worklet-audio-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/worklet-audio.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/worklet-layout-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/worklet-layout.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/worklet-paint-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-none/worklet-paint.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/script-tag.http.htmlPass12 / 12
gen/top.http-rp/worker-src-self/script-tag.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/sharedworker-classic.http.htmlPass4 / 4
gen/top.http-rp/worker-src-self/sharedworker-classic.https.htmlPass4 / 4
gen/top.http-rp/worker-src-self/sharedworker-import-data.http.htmlPass12 / 12
gen/top.http-rp/worker-src-self/sharedworker-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/sharedworker-import.http.htmlPass12 / 12
gen/top.http-rp/worker-src-self/sharedworker-import.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/sharedworker-module.http.htmlPass4 / 4
gen/top.http-rp/worker-src-self/sharedworker-module.https.htmlPass4 / 4
gen/top.http-rp/worker-src-self/worker-classic.http.htmlPass4 / 4
gen/top.http-rp/worker-src-self/worker-classic.https.htmlPass4 / 4
gen/top.http-rp/worker-src-self/worker-import-data.http.htmlPass12 / 12
gen/top.http-rp/worker-src-self/worker-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/worker-import.http.htmlPass12 / 12
gen/top.http-rp/worker-src-self/worker-import.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/worker-module.http.htmlPass4 / 4
gen/top.http-rp/worker-src-self/worker-module.https.htmlPass4 / 4
gen/top.http-rp/worker-src-self/worklet-animation-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/worklet-animation.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/worklet-audio-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/worklet-audio.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/worklet-layout-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/worklet-layout.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/worklet-paint-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-self/worklet-paint.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/script-tag.http.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/script-tag.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/sharedworker-classic.http.htmlPass4 / 4
gen/top.http-rp/worker-src-wildcard/sharedworker-classic.https.htmlPass4 / 4
gen/top.http-rp/worker-src-wildcard/sharedworker-import-data.http.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/sharedworker-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/sharedworker-import.http.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/sharedworker-import.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/sharedworker-module.http.htmlPass4 / 4
gen/top.http-rp/worker-src-wildcard/sharedworker-module.https.htmlPass4 / 4
gen/top.http-rp/worker-src-wildcard/worker-classic.http.htmlPass4 / 4
gen/top.http-rp/worker-src-wildcard/worker-classic.https.htmlPass4 / 4
gen/top.http-rp/worker-src-wildcard/worker-import-data.http.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/worker-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/worker-import.http.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/worker-import.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/worker-module.http.htmlPass4 / 4
gen/top.http-rp/worker-src-wildcard/worker-module.https.htmlPass4 / 4
gen/top.http-rp/worker-src-wildcard/worklet-animation-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/worklet-animation.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/worklet-audio-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/worklet-audio.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/worklet-layout-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/worklet-layout.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/worklet-paint-import-data.https.htmlPass12 / 12
gen/top.http-rp/worker-src-wildcard/worklet-paint.https.htmlPass12 / 12
gen/top.meta/script-src-self/script-tag.http.htmlPass12 / 12
gen/top.meta/script-src-self/script-tag.https.htmlPass12 / 12
gen/top.meta/script-src-self/sharedworker-classic.http.htmlPass4 / 4
gen/top.meta/script-src-self/sharedworker-classic.https.htmlPass4 / 4
gen/top.meta/script-src-self/sharedworker-import-data.http.htmlPass12 / 12
gen/top.meta/script-src-self/sharedworker-import-data.https.htmlPass12 / 12
gen/top.meta/script-src-self/sharedworker-import.http.htmlPass12 / 12
gen/top.meta/script-src-self/sharedworker-import.https.htmlPass12 / 12
gen/top.meta/script-src-self/sharedworker-module.http.htmlPass4 / 4
gen/top.meta/script-src-self/sharedworker-module.https.htmlPass4 / 4
gen/top.meta/script-src-self/worker-classic.http.htmlPass4 / 4
gen/top.meta/script-src-self/worker-classic.https.htmlPass4 / 4
gen/top.meta/script-src-self/worker-import-data.http.htmlPass12 / 12
gen/top.meta/script-src-self/worker-import-data.https.htmlPass12 / 12
gen/top.meta/script-src-self/worker-import.http.htmlPass12 / 12
gen/top.meta/script-src-self/worker-import.https.htmlPass12 / 12
gen/top.meta/script-src-self/worker-module.http.htmlPass4 / 4
gen/top.meta/script-src-self/worker-module.https.htmlPass4 / 4
gen/top.meta/script-src-self/worklet-animation-import-data.https.htmlPass12 / 12
gen/top.meta/script-src-self/worklet-animation.https.htmlPass12 / 12
gen/top.meta/script-src-self/worklet-audio-import-data.https.htmlPass12 / 12
gen/top.meta/script-src-self/worklet-audio.https.htmlPass12 / 12
gen/top.meta/script-src-self/worklet-layout-import-data.https.htmlPass12 / 12
gen/top.meta/script-src-self/worklet-layout.https.htmlPass12 / 12
gen/top.meta/script-src-self/worklet-paint-import-data.https.htmlPass12 / 12
gen/top.meta/script-src-self/worklet-paint.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/script-tag.http.htmlPass12 / 12
gen/top.meta/script-src-wildcard/script-tag.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/sharedworker-classic.http.htmlPass4 / 4
gen/top.meta/script-src-wildcard/sharedworker-classic.https.htmlPass4 / 4
gen/top.meta/script-src-wildcard/sharedworker-import-data.http.htmlPass12 / 12
gen/top.meta/script-src-wildcard/sharedworker-import-data.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/sharedworker-import.http.htmlPass12 / 12
gen/top.meta/script-src-wildcard/sharedworker-import.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/sharedworker-module.http.htmlPass4 / 4
gen/top.meta/script-src-wildcard/sharedworker-module.https.htmlPass4 / 4
gen/top.meta/script-src-wildcard/worker-classic.http.htmlPass4 / 4
gen/top.meta/script-src-wildcard/worker-classic.https.htmlPass4 / 4
gen/top.meta/script-src-wildcard/worker-import-data.http.htmlPass12 / 12
gen/top.meta/script-src-wildcard/worker-import-data.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/worker-import.http.htmlPass12 / 12
gen/top.meta/script-src-wildcard/worker-import.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/worker-module.http.htmlPass4 / 4
gen/top.meta/script-src-wildcard/worker-module.https.htmlPass4 / 4
gen/top.meta/script-src-wildcard/worklet-animation-import-data.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/worklet-animation.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/worklet-audio-import-data.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/worklet-audio.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/worklet-layout-import-data.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/worklet-layout.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/worklet-paint-import-data.https.htmlPass12 / 12
gen/top.meta/script-src-wildcard/worklet-paint.https.htmlPass12 / 12
gen/top.meta/worker-src-none/script-tag.http.htmlPass12 / 12
gen/top.meta/worker-src-none/script-tag.https.htmlPass12 / 12
gen/top.meta/worker-src-none/sharedworker-classic.http.htmlPass4 / 4
gen/top.meta/worker-src-none/sharedworker-classic.https.htmlPass4 / 4
gen/top.meta/worker-src-none/sharedworker-import-data.http.htmlPass12 / 12
gen/top.meta/worker-src-none/sharedworker-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-none/sharedworker-import.http.htmlPass12 / 12
gen/top.meta/worker-src-none/sharedworker-import.https.htmlPass12 / 12
gen/top.meta/worker-src-none/sharedworker-module.http.htmlPass4 / 4
gen/top.meta/worker-src-none/sharedworker-module.https.htmlPass4 / 4
gen/top.meta/worker-src-none/worker-classic.http.htmlPass4 / 4
gen/top.meta/worker-src-none/worker-classic.https.htmlPass4 / 4
gen/top.meta/worker-src-none/worker-import-data.http.htmlPass12 / 12
gen/top.meta/worker-src-none/worker-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-none/worker-import.http.htmlPass12 / 12
gen/top.meta/worker-src-none/worker-import.https.htmlPass12 / 12
gen/top.meta/worker-src-none/worker-module.http.htmlPass4 / 4
gen/top.meta/worker-src-none/worker-module.https.htmlPass4 / 4
gen/top.meta/worker-src-none/worklet-animation-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-none/worklet-animation.https.htmlPass12 / 12
gen/top.meta/worker-src-none/worklet-audio-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-none/worklet-audio.https.htmlPass12 / 12
gen/top.meta/worker-src-none/worklet-layout-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-none/worklet-layout.https.htmlPass12 / 12
gen/top.meta/worker-src-none/worklet-paint-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-none/worklet-paint.https.htmlPass12 / 12
gen/top.meta/worker-src-self/script-tag.http.htmlPass12 / 12
gen/top.meta/worker-src-self/script-tag.https.htmlPass12 / 12
gen/top.meta/worker-src-self/sharedworker-classic.http.htmlPass4 / 4
gen/top.meta/worker-src-self/sharedworker-classic.https.htmlPass4 / 4
gen/top.meta/worker-src-self/sharedworker-import-data.http.htmlPass12 / 12
gen/top.meta/worker-src-self/sharedworker-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-self/sharedworker-import.http.htmlPass12 / 12
gen/top.meta/worker-src-self/sharedworker-import.https.htmlPass12 / 12
gen/top.meta/worker-src-self/sharedworker-module.http.htmlPass4 / 4
gen/top.meta/worker-src-self/sharedworker-module.https.htmlPass4 / 4
gen/top.meta/worker-src-self/worker-classic.http.htmlPass4 / 4
gen/top.meta/worker-src-self/worker-classic.https.htmlPass4 / 4
gen/top.meta/worker-src-self/worker-import-data.http.htmlPass12 / 12
gen/top.meta/worker-src-self/worker-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-self/worker-import.http.htmlPass12 / 12
gen/top.meta/worker-src-self/worker-import.https.htmlPass12 / 12
gen/top.meta/worker-src-self/worker-module.http.htmlPass4 / 4
gen/top.meta/worker-src-self/worker-module.https.htmlPass4 / 4
gen/top.meta/worker-src-self/worklet-animation-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-self/worklet-animation.https.htmlPass12 / 12
gen/top.meta/worker-src-self/worklet-audio-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-self/worklet-audio.https.htmlPass12 / 12
gen/top.meta/worker-src-self/worklet-layout-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-self/worklet-layout.https.htmlPass12 / 12
gen/top.meta/worker-src-self/worklet-paint-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-self/worklet-paint.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/script-tag.http.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/script-tag.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/sharedworker-classic.http.htmlPass4 / 4
gen/top.meta/worker-src-wildcard/sharedworker-classic.https.htmlPass4 / 4
gen/top.meta/worker-src-wildcard/sharedworker-import-data.http.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/sharedworker-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/sharedworker-import.http.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/sharedworker-import.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/sharedworker-module.http.htmlPass4 / 4
gen/top.meta/worker-src-wildcard/sharedworker-module.https.htmlPass4 / 4
gen/top.meta/worker-src-wildcard/worker-classic.http.htmlPass4 / 4
gen/top.meta/worker-src-wildcard/worker-classic.https.htmlPass4 / 4
gen/top.meta/worker-src-wildcard/worker-import-data.http.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/worker-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/worker-import.http.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/worker-import.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/worker-module.http.htmlPass4 / 4
gen/top.meta/worker-src-wildcard/worker-module.https.htmlPass4 / 4
gen/top.meta/worker-src-wildcard/worklet-animation-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/worklet-animation.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/worklet-audio-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/worklet-audio.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/worklet-layout-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/worklet-layout.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/worklet-paint-import-data.https.htmlPass12 / 12
gen/top.meta/worker-src-wildcard/worklet-paint.https.htmlPass12 / 12
generic/304-response-should-update-csp.sub.htmlPass4 / 4
generic/case-insensitive-scheme.sub.htmlPass6 / 6
generic/cspro-not-enforced-in-worker.htmlPass2 / 2
generic/directive-name-case-insensitive.sub.htmlPass3 / 3
generic/duplicate-directive.sub.htmlPass1 / 1
generic/eval-typecheck-callout-order.htmlPass2 / 2
generic/filesystem-urls-do-not-match-self.sub.htmlTimeout0 / 2OUT OF SCOPEfilesystem: URLs (webkitRequestFileSystem(), non-standard)
generic/filesystem-urls-match-filesystem.sub.htmlFail0 / 1OUT OF SCOPEfilesystem: URLs (webkitRequestFileSystem(), non-standard)
generic/generic-0_1-img-src.htmlPass2 / 2
generic/generic-0_1-script-src.htmlPass3 / 3
generic/generic-0_10.sub.htmlPass1 / 1
generic/generic-0_10_1.sub.htmlPass2 / 2
generic/generic-0_2.htmlPass2 / 2
generic/generic-0_2_2.sub.htmlPass2 / 2
generic/generic-0_2_3.htmlPass2 / 2
generic/generic-0_8.sub.htmlPass2 / 2
generic/generic-0_8_1.sub.htmlPass1 / 1
generic/generic-0_9.sub.htmlPass2 / 2
generic/image-document-applies-csp.htmlPass1 / 1
generic/invalid-characters-in-policy.htmlPass12 / 12
generic/no-default-src.sub.htmlPass2 / 2
generic/only-valid-whitespaces-are-allowed.htmlPass28 / 28
generic/policy-does-not-affect-child.sub.htmlPass1 / 1
generic/policy-inherited-correctly-by-plznavigate.htmlPass2 / 2
generic/source-list-wildcard-host-and-port.https.sub.htmlPass4 / 4
generic/src-trailing-dot.sub.any.jsFail0 / 3TEST RUNNERthe runner does not serve the hosts with a trailing dot (web-platform.test.): the fetch is a network error
generic/wildcard-host-part-002.sub.window.jsPass5 / 5
generic/wildcard-host-part.sub.window.jsPass5 / 5
img-src/icon-allowed.sub.htmlPass1 / 1
img-src/icon-blocked.sub.htmlPass2 / 2
img-src/img-src-4_1.sub.htmlPass3 / 3
img-src/img-src-full-host-wildcard-blocked.sub.htmlPass1 / 1
img-src/img-src-host-partial-wildcard-allowed.sub.htmlPass1 / 1
img-src/img-src-none-blocks-css-background-image.htmlPass1 / 1
img-src/img-src-none-blocks-data-uri.htmlPass1 / 1
img-src/img-src-none-blocks.htmlPass1 / 1
img-src/img-src-port-wildcard-allowed.sub.htmlPass1 / 1
img-src/img-src-self-unique-origin.htmlPass1 / 1
img-src/img-src-targeting.htmlPass2 / 2
img-src/img-src-wildcard-allowed.htmlPass2 / 2
img-src/report-blocked-data-uri.sub.htmlPass1 / 1
inheritance/about-blank-from-javascript-url-inherits-csp-from-initiator.sub.htmlPass1 / 1
inheritance/auxiliary-blank-document.htmlPass3 / 3
inheritance/blob-inherits-from-meta-http-equiv-with-invalid-characters.htmlPass1 / 1
inheritance/blob-url-in-child-frame-self-navigate-inherits.sub.htmlPass1 / 1
inheritance/blob-url-in-main-window-self-navigate-inherits.sub.htmlPass1 / 1
inheritance/blob-url-inherits-from-initiator.sub.htmlPass2 / 2
inheritance/document-write-iframe.htmlPass3 / 3
inheritance/frame-src-javascript-url.htmlPass1 / 1
inheritance/history-iframe.sub.htmlPass8 / 8
inheritance/history.sub.htmlPass6 / 6
inheritance/iframe-all-local-schemes-inherit-self.sub.htmlPass6 / 6
inheritance/iframe-all-local-schemes.sub.htmlPass10 / 10
inheritance/iframe-srcdoc-history-inheritance.htmlPass1 / 1
inheritance/iframe-srcdoc-inheritance.htmlPass2 / 2
inheritance/inheritance-from-initiator.sub.htmlFail16 / 19TEST BUGthe blob variant expects a blob: document to inherit the policies of the creator of the blob URL, but a document of a local scheme inherits the policy container of the initiator of the navigation (https://html.spec.whatwg.org/multipage/browsers.html#determining-navigation-params-policy-container); fails in Chromium and Firefox
inheritance/inherited-csp-list-modifications-are-local.htmlPass3 / 3
inheritance/javascript-url-open-in-main-window.htmlPass1 / 1
inheritance/javascript-url-srcdoc-cross-origin-iframe-inheritance.htmlPass1 / 1
inheritance/location-reload.htmlPass3 / 3
inheritance/sandboxed-blob-scheme.htmlPass1 / 1
inheritance/sandboxed-data-scheme.htmlPass1 / 1
inheritance/unsandboxed-blob-scheme.htmlPass1 / 1
inheritance/unsandboxed-data-scheme.htmlPass1 / 1
inheritance/window-open-local-after-network-scheme.sub.htmlPass2 / 2
inheritance/window.htmlPass4 / 4
inside-worker/dedicatedworker-connect-src.htmlPass21 / 21
inside-worker/dedicatedworker-report-only.htmlPass7 / 7
inside-worker/dedicatedworker-script-src.htmlPass12 / 12
inside-worker/dedicatedworker-worker-src.htmlPass1 / 1
inside-worker/serviceworker-connect-src.https.sub.htmlPass17 / 17
inside-worker/serviceworker-report-only.https.sub.htmlPass6 / 6
inside-worker/serviceworker-script-src.https.sub.htmlPass14 / 14
inside-worker/sharedworker-connect-src.sub.htmlPass21 / 21
inside-worker/sharedworker-report-only.sub.htmlPass7 / 7
inside-worker/sharedworker-script-src.sub.htmlPass12 / 12
media-src/media-src-7_1.htmlPass3 / 3
media-src/media-src-7_1_2.sub.htmlTimeout2 / 3BUGthe test sets the src of a source element from a script that follows the video element in the markup: as specified, the synchronous section of the resource selection algorithm runs in a microtask, i.e. before that script (the candidate has no src, and changing it afterwards has no effect), so only one of the two expected violations of media-src is reported; the browsers run the section after the script
media-src/media-src-7_2.htmlPass3 / 3
media-src/media-src-7_2_2.sub.htmlPass3 / 3
media-src/media-src-7_3.sub.htmlPass2 / 2
media-src/media-src-7_3_2.sub.htmlPass2 / 2
media-src/media-src-blocked-blob-url.htmlPass2 / 2
media-src/media-src-blocked-data-url.htmlPass2 / 2
media-src/media-src-blocked.sub.htmlPass4 / 4
media-src/media-src-redir-bug.sub.htmlPass5 / 5
meta/combine-header-and-meta-policies.sub.htmlPass2 / 2
meta/meta-img-src.htmlPass1 / 1
meta/meta-modified.htmlPass1 / 1
meta/meta-outside-head.sub.htmlPass1 / 1
meta/sandbox-iframe.htmlPass1 / 1
navigation/javascript-url-navigation-evaluated-to-string-inherits-csp.htmlPass1 / 1
navigation/javascript-url-navigation-to-other-win-evaluated-to-string-inherits-csp.htmlPass1 / 1
navigation/javascript-url-navigation-to-popup-evaluated-to-string-inherits-csp.htmlPass1 / 1
navigation/javascript-url-navigation-to-self-evaluated-to-string-inherits-csp.htmlPass1 / 1
navigation/to-javascript-parent-initiated-check-csp-order.htmlPass7 / 7
navigation/to-javascript-parent-initiated-child-csp.htmlTimeout3 / 9TEST BUGthe test expects the policies of the target of a javascript: URL navigation to block it, but the navigation is checked with the policy container of its source (https://w3c.github.io/webappsec-csp/#should-block-navigation-request, https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigate); Chromium and Firefox also check the policies of the target
navigation/to-javascript-parent-initiated-parent-csp.htmlPass7 / 7
navigation/to-javascript-url-frame-src.htmlPass1 / 1
navigation/to-javascript-url-script-src.htmlPass4 / 4
nonce-hiding/dangling-html-or-body.htmlPass2 / 2
nonce-hiding/nonce-hiding-move-document.htmlPass1 / 1
nonce-hiding/nonces-css-selector.htmlPass9 / 9
nonce-hiding/nonces.htmlPass44 / 44
nonce-hiding/script-nonces-hidden-meta.sub.htmlPass11 / 11
nonce-hiding/script-nonces-hidden.htmlPass12 / 12
nonce-hiding/svgscript-nonces-hidden-meta.sub.htmlPass9 / 9
nonce-hiding/svgscript-nonces-hidden.htmlPass9 / 9
object-src/object-src-no-url-allowed.htmlPass1 / 1
object-src/object-src-no-url-blocked.htmlTimeout0 / 1OUT OF SCOPEplugins: an object or embed element without URL whose type is a plugin type falls back without loading anything, so object-src reports no violation
object-src/object-src-no-url-embed-blocked.htmlTimeout0 / 1OUT OF SCOPEplugins: an object or embed element without URL whose type is a plugin type falls back without loading anything, so object-src reports no violation
object-src/object-src-no-url-empty-source-list-blocked.htmlTimeout0 / 1OUT OF SCOPEplugins: an object or embed element without URL whose type is a plugin type falls back without loading anything, so object-src reports no violation
object-src/object-src-no-url-empty-source-list-embed-blocked.htmlTimeout0 / 1OUT OF SCOPEplugins: an object or embed element without URL whose type is a plugin type falls back without loading anything, so object-src reports no violation
object-src/object-src-pdf-byte-range-allowed.htmlPass1 / 1
object-src/object-src-url-allowed-img-src-none.htmlPass1 / 1
object-src/object-src-url-allowed.htmlPass1 / 1
object-src/object-src-url-blocked.htmlPass1 / 1
object-src/object-src-url-embed-allowed-img-src-none.htmlPass1 / 1
object-src/object-src-url-embed-allowed.htmlPass1 / 1
object-src/object-src-url-embed-blocked.htmlPass1 / 1
object-src/object-src-url-redirect-allowed.htmlPass1 / 1
object-src/object-src-url-redirect-blocked.sub.htmlPass1 / 1
parsing/invalid-bytes.htmlPass18 / 18
parsing/invalid-directive.htmlPass1 / 1
parsing/keyword-source-with-trailing-characters.htmlPass6 / 6
plugin-types/plugin-types-does-not-block-pdf-embed.htmlPass1 / 1
plugin-types/plugin-types-ignored.htmlPass1 / 1
report-hash/default-src.https.window.jsPass8 / 8
report-hash/multiple-policies.https.sub.htmlPass8 / 8
report-hash/reportonly-default-src.https.window.jsPass8 / 8
report-hash/reportonly-script-src-elem.https.window.jsPass8 / 8
report-hash/reportonly-script-src-none.https.window.jsPass8 / 8
report-hash/reportonly-script-src.https.window.jsPass8 / 8
report-hash/script-src-elem.https.window.jsPass8 / 8
report-hash/script-src-sha512.https.window.jsPass8 / 8
report-hash/script-src.https.window.jsPass8 / 8
reporting-api/dedicated-worker-correct-url-in-report.htmlPass4 / 4
reporting-api/report-to-directive-allowed-in-meta.https.sub.htmlPass4 / 4
reporting-api/reporting-api-doesnt-send-reports-without-violation.https.sub.htmlPass2 / 2
reporting-api/reporting-api-report-only-sends-reports-on-violation.https.sub.htmlPass3 / 3
reporting-api/reporting-api-report-to-only-sends-reports-to-first-endpoint.https.sub.htmlPass3 / 3
reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub.htmlPass3 / 3
reporting-api/reporting-api-report-to-overrides-report-uri-2.https.sub.htmlPass3 / 3
reporting-api/reporting-api-sends-reports-on-violation-2.https.sub.htmlPass4 / 4
reporting-api/reporting-api-sends-reports-on-violation-for-css-background-image.https.sub.htmlPass1 / 1
reporting-api/reporting-api-sends-reports-on-violation-for-dedicated-worker-import.https.sub.htmlPass2 / 2
reporting-api/reporting-api-sends-reports-on-violation-for-shared-worker-import.https.sub.htmlPass2 / 2
reporting-api/reporting-api-sends-reports-on-violation-for-worklet-import.https.sub.htmlPass2 / 2
reporting-api/reporting-api-sends-reports-on-violation.https.sub.htmlPass4 / 4
reporting-api/reporting-api-works-on-frame-ancestors.https.sub.htmlPass2 / 2
reporting-api/reporting-api-works-on-frame-src.https.sub.htmlPass2 / 2
reporting/link-preload-from-header-report-only-nonce.sub.htmlPass1 / 1
reporting/link-preload-report-only-nonce.sub.htmlPass1 / 1
reporting/multiple-report-policies.htmlPass2 / 2
reporting/post-redirect-stacktrace.https.htmlTimeout2 / 4TEST BUGthe test waits for the csp-violation reports of a policy without report-to (Chromium): CSP generates them only for the report-to directive (https://w3c.github.io/webappsec-csp/#report-violation, step 3.5), as in Firefox
reporting/report-and-enforce.htmlPass3 / 3
reporting/report-blocked-data-uri.htmlPass1 / 1
reporting/report-blocked-uri-cross-origin.sub.htmlPass1 / 1
reporting/report-blocked-uri.htmlPass1 / 1
reporting/report-clips-sample.https.htmlPass7 / 7
reporting/report-cross-origin-no-cookies.sub.htmlPass3 / 3
reporting/report-frame-ancestors-no-parent-cookies.sub.htmlPass2 / 2
reporting/report-frame-ancestors-with-x-frame-options.sub.htmlPass1 / 1
reporting/report-frame-ancestors.sub.htmlPass1 / 1
reporting/report-multiple-violations-01.htmlPass2 / 2
reporting/report-multiple-violations-02.htmlFail1 / 2TEST BUGthe test expects the identical violations of the string timers to be reported once (as Chromium does), CSP reports each violation (https://w3c.github.io/webappsec-csp/#report-violation)
reporting/report-only-cross-origin-frame.sub.htmlPass4 / 4
reporting/report-only-in-meta.sub.htmlPass3 / 3
reporting/report-only-unsafe-eval.htmlPass3 / 3
reporting/report-original-url-on-mixed-content-frame.https.sub.htmlFail0 / 1OUT OF SCOPEthe violations of the obsolete block-all-mixed-content directive (https://w3c.github.io/webappsec-mixed-content/) are not reported; fails in Firefox and Safari
reporting/report-original-url.sub.htmlPass5 / 5
reporting/report-preload-and-consume.https.htmlPass1 / 1
reporting/report-same-origin-with-cookies.htmlPass3 / 3
reporting/report-strips-fragment.htmlPass1 / 1
reporting/report-strips-username-password.htmlPass1 / 1
reporting/report-uri-effective-directive.htmlPass1 / 1
reporting/report-uri-from-child-frame.htmlPass1 / 1
reporting/report-uri-from-inline-javascript.htmlPass1 / 1
reporting/report-uri-from-javascript.htmlPass1 / 1
reporting/report-uri-multiple-reversed.htmlPass1 / 1
reporting/report-uri-multiple.htmlPass1 / 1
reporting/report-uri-scheme-relative.htmlPass1 / 1
resource-hints/prefetch-allowed-by-any-directive.sub.htmlPass3 / 3
resource-hints/prefetch-allowed-by-default.htmlPass1 / 1
resource-hints/prefetch-allowed-no-default.htmlPass1 / 1
resource-hints/prefetch-allowed-with-conflicting-permissive-policies.htmlPass1 / 1
resource-hints/prefetch-blocked-by-default-multiple-policies.htmlPass1 / 1
resource-hints/prefetch-blocked-by-default.htmlPass1 / 1
resource-hints/prefetch-generate-directives.htmlPass26 / 26
resource-hints/prefetch-ignores-prefetch-src.sub.htmlPass1 / 1
resource-hints/prefetch-no-csp.htmlPass1 / 1
sandbox/autoplay-disabled-by-csp.htmlError1 / 2TEST BUGthe test reads the document of an iframe that its Content-Security-Policy: sandbox header gives an opaque origin: a SecurityError is thrown and the harness reports an error, as in Chromium, Gecko and WebKit
sandbox/iframe-inside-csp.sub.htmlPass1 / 1
sandbox/iframe-self-after-redirect.sub.htmlPass1 / 1
sandbox/iframe-self-all-directives.sub.htmlPass1 / 1
sandbox/iframe-self-allows-same-origin.htmlPass1 / 1
sandbox/iframe-self-blocks-cross-origin.sub.htmlPass1 / 1
sandbox/iframe-self-via-header.htmlPass1 / 1
sandbox/meta-element.sub.htmlPass3 / 3
sandbox/sandbox-allow-scripts-subframe.sub.htmlPass1 / 1
sandbox/sandbox-allow-scripts.sub.htmlPass1 / 1
sandbox/sandbox-empty-subframe.sub.htmlPass1 / 1
sandbox/sandbox-empty.sub.htmlFail0 / 1TEST BUGthe Content-Security-Policy: sandbox header of support/sandboxed-post-message-to-parent.headers is not applied by wptserve, which only reads sandboxed-post-message-to-parent.html.headers: the frame is not sandboxed and its message is logged
sandbox/sandbox-last-directive-csp.htmlPass1 / 1
sandbox/service-worker-sandbox.https.htmlPass8 / 8
sandbox/shared-worker-sandbox.htmlPass1 / 1
sandbox/window-reuse-sandboxed.htmlPass1 / 1
sandbox/window-reuse-unsandboxed.htmlPass1 / 1
script-src-attr-elem/script-src-attr-allowed-src-blocked.htmlPass1 / 1
script-src-attr-elem/script-src-attr-blocked-src-allowed.htmlPass1 / 1
script-src-attr-elem/script-src-elem-allowed-attr-blocked.htmlPass2 / 2
script-src-attr-elem/script-src-elem-allowed-src-blocked.htmlPass1 / 1
script-src-attr-elem/script-src-elem-blocked-attr-allowed.htmlPass2 / 2
script-src-attr-elem/script-src-elem-blocked-src-allowed.htmlPass1 / 1
script-src-attr-elem/strict-dynamic-elem-allowed-src-blocked.htmlPass1 / 1
script-src-attr-elem/strict-dynamic-elem-blocked-src-allowed.sub.htmlPass1 / 1
script-src/audioworklet-eval-blocked.https.htmlPass1 / 1
script-src/audioworklet-trusted-types-eval-blocked.https.htmlPass1 / 1
script-src/eval-allowed-in-report-only-mode-and-sends-report.htmlPass2 / 2
script-src/eval-allowed-in-report-only-mode.htmlPass1 / 1
script-src/hash-always-converted-to-utf-8/iso-8859-1.htmlPass1 / 1
script-src/hash-always-converted-to-utf-8/iso-8859-3.htmlPass1 / 1
script-src/hash-always-converted-to-utf-8/iso-8859-7.htmlPass1 / 1
script-src/hash-always-converted-to-utf-8/iso-8859-9.htmlPass1 / 1
script-src/hash-always-converted-to-utf-8/utf-8-lone-surrogate.htmlPass1 / 1
script-src/hash-always-converted-to-utf-8/utf-8.htmlPass3 / 3
script-src/injected-inline-script-allowed.sub.htmlPass1 / 1
script-src/injected-inline-script-blocked.sub.htmlPass1 / 1
script-src/javascript-window-open-blocked.htmlPass1 / 1
script-src/non-nonceable-elements.htmlPass10 / 10
script-src/nonce-enforce-blocked.htmlPass1 / 1
script-src/nonce-with-trailing-characters-blocked.htmlPass1 / 1
script-src/script-src-1_1.htmlPass3 / 3
script-src/script-src-1_10.htmlPass2 / 2
script-src/script-src-1_10_1.htmlPass2 / 2
script-src/script-src-1_2.htmlPass3 / 3
script-src/script-src-1_2_1.htmlPass2 / 2
script-src/script-src-1_3.htmlPass2 / 2
script-src/script-src-1_4.htmlPass3 / 3
script-src/script-src-1_4_1.htmlPass3 / 3
script-src/script-src-1_4_2.htmlPass2 / 2
script-src/script-src-event-handler-on-inline-script.htmlPass4 / 4
script-src/script-src-multiple-policies-multiple-hashing-algorithms.htmlPass1 / 1
script-src/script-src-multiple-policies-one-using-hashing-algorithms.htmlPass1 / 1
script-src/script-src-overrides-default-src.sub.htmlPass1 / 1
script-src/script-src-report-only-policy-works-with-external-hash-policy.htmlPass2 / 2
script-src/script-src-report-only-policy-works-with-hash-policy.htmlPass2 / 2
script-src/script-src-sri_hash.sub.htmlPass12 / 12
script-src/script-src-strict_dynamic_and_unsafe_eval_eval.htmlPass1 / 1
script-src/script-src-strict_dynamic_and_unsafe_eval_new_function.htmlPass1 / 1
script-src/script-src-strict_dynamic_discard_source_expressions.htmlPass1 / 1
script-src/script-src-strict_dynamic_double_policy_different_nonce.htmlPass2 / 2
script-src/script-src-strict_dynamic_double_policy_honor_source_expressions.sub.htmlPass2 / 2
script-src/script-src-strict_dynamic_double_policy_report_only.htmlPass1 / 1
script-src/script-src-strict_dynamic_eval.htmlPass1 / 1
script-src/script-src-strict_dynamic_hashes.htmlPass3 / 3
script-src/script-src-strict_dynamic_in_img-src.htmlPass1 / 1
script-src/script-src-strict_dynamic_javascript_uri.htmlPass1 / 1
script-src/script-src-strict_dynamic_meta_tag.htmlPass4 / 4
script-src/script-src-strict_dynamic_modulepreload_parser_inserted_module.htmlPass3 / 3
script-src/script-src-strict_dynamic_new_function.htmlPass1 / 1
script-src/script-src-strict_dynamic_non_parser_inserted.htmlPass4 / 4
script-src/script-src-strict_dynamic_non_parser_inserted_incorrect_nonce.htmlPass1 / 1
script-src/script-src-strict_dynamic_non_parser_inserted_module.htmlPass2 / 2
script-src/script-src-strict_dynamic_parser_inserted.htmlPass10 / 10
script-src/script-src-strict_dynamic_parser_inserted_correct_nonce.htmlPass8 / 8
script-src/script-src-strict_dynamic_parser_inserted_error_event.htmlPass2 / 2
script-src/script-src-strict_dynamic_parser_inserted_module.htmlPass3 / 3
script-src/script-src-strict_dynamic_parser_inserted_module_empty_hash.htmlPass1 / 1
script-src/script-src-strict_dynamic_worker-importScripts.https.htmlPass1 / 1
script-src/script-src-strict_dynamic_worker.https.htmlPass3 / 3
script-src/script-src-trusted_types_eval_DedicatedWorker.htmlPass9 / 9
script-src/script-src-trusted_types_eval_multiple_policies_allowed.window.jsPass4 / 4
script-src/script-src-trusted_types_eval_multiple_policies_blocked.window.jsPass4 / 4
script-src/script-src-trusted_types_eval_multiple_policies_report_only.window.jsPass2 / 2
script-src/script-src-trusted_types_eval_report_only_policies.window.jsPass4 / 4
script-src/script-src-trusted_types_eval_report_only_policies_without_default_policy.window.jsPass4 / 4
script-src/script-src-trusted_types_eval_with_report_only_require_trusted_types_eval.htmlPass5 / 5
script-src/script-src-trusted_types_eval_with_require_trusted_types_eval.htmlPass5 / 5
script-src/script-src-trusted_types_eval_without_default_policy.window.jsPass6 / 6
script-src/script-src-trusted_types_eval_without_require_trusted_types_eval.htmlPass5 / 5
script-src/script-src-wildcards-disallowed.htmlPass3 / 3
script-src/scripthash-allowed.sub.htmlPass1 / 1
script-src/scripthash-base64url-converts-to-base64.sub.htmlPass1 / 1
script-src/scripthash-basic-blocked-error-event.htmlPass1 / 1
script-src/scripthash-basic-blocked.sub.htmlPass1 / 1
script-src/scripthash-case-insensitive.sub.htmlPass1 / 1
script-src/scripthash-changed-1.htmlPass1 / 1
script-src/scripthash-changed-2.htmlPass1 / 1
script-src/scripthash-default-src.sub.htmlPass1 / 1
script-src/scripthash-ignore-unsafeinline.sub.htmlPass1 / 1
script-src/scripthash-unicode-normalization.sub.htmlPass2 / 2
script-src/scriptnonce-allowed.sub.htmlPass1 / 1
script-src/scriptnonce-and-scripthash.sub.htmlPass1 / 1
script-src/scriptnonce-basic-blocked.sub.htmlFail0 / 1TEST BUGthe test expects a nonce surrounded by whitespace (nonce=" noncynonce ") to match 'nonce-noncynonce', as Chromium and WebKit strip the whitespace; the specification compares the values (https://w3c.github.io/webappsec-csp/#match-element-to-source-list), as Firefox
script-src/scriptnonce-changed-1.htmlPass1 / 1
script-src/scriptnonce-changed-2.htmlPass1 / 1
script-src/scriptnonce-ignore-unsafeinline.sub.htmlPass1 / 1
script-src/scriptnonce-redirect.sub.htmlPass1 / 1
script-src/scriptnonce-specified-source.sub.htmlPass3 / 3
script-src/srcdoc-doesnt-bypass-script-src.sub.htmlPass1 / 1
script-src/worker-data-set-timeout.sub.htmlPass1 / 1
script-src/worker-eval-blocked.sub.htmlPass1 / 1
script-src/worker-function-function-blocked.sub.htmlPass1 / 1
script-src/worker-importscripts.sub.htmlPass2 / 2
script-src/worker-script-src.sub.htmlPass1 / 1
script-src/worker-set-timeout.sub.htmlPass2 / 2
securitypolicyviolation/blockeduri-eval.htmlPass1 / 1
securitypolicyviolation/blockeduri-inline.htmlPass1 / 1
securitypolicyviolation/blockeduri-ws-wss-scheme.htmlFail3 / 4NOT IMPLEMENTEDthe redirects of the opening handshake of a WebSocket are not followed, so the redirect to a URL blocked by connect-src reports no violation
securitypolicyviolation/constructor-required-fields.htmlPass14 / 14
securitypolicyviolation/idlharness.window.jsPass34 / 34
securitypolicyviolation/img-src-redirect-upgrade-reporting.https.htmlPass1 / 1
securitypolicyviolation/img-src-redirect.sub.htmlPass1 / 1
securitypolicyviolation/inside-dedicated-worker.htmlPass3 / 3
securitypolicyviolation/inside-nested-dedicated-worker.htmlPass1 / 1
securitypolicyviolation/inside-service-worker.https.htmlPass3 / 3
securitypolicyviolation/inside-shared-worker.htmlPass3 / 3
securitypolicyviolation/no-violation-for-inline-handler-in-document-without-browsing-context.htmlPass5 / 5
securitypolicyviolation/script-sample-no-opt-in.htmlPass4 / 4
securitypolicyviolation/script-sample.htmlPass6 / 6
securitypolicyviolation/securitypolicyviolation-block-cross-origin-image-from-script.sub.htmlPass1 / 1
securitypolicyviolation/securitypolicyviolation-block-cross-origin-image.sub.htmlPass1 / 1
securitypolicyviolation/securitypolicyviolation-block-image-from-script.sub.htmlPass1 / 1
securitypolicyviolation/securitypolicyviolation-block-image.sub.htmlPass1 / 1
securitypolicyviolation/source-file-blob-scheme.htmlPass1 / 1
securitypolicyviolation/source-file-data-scheme.htmlPass1 / 1
securitypolicyviolation/source-file.htmlPass17 / 17
securitypolicyviolation/style-sample-no-opt-in.htmlPass2 / 2
securitypolicyviolation/style-sample.htmlPass2 / 2
securitypolicyviolation/targeting-for-inline-handler-connected-after-set.htmlPass1 / 1
securitypolicyviolation/targeting-for-inline-handler-in-markup-disconnected-after-set.htmlPass1 / 1
securitypolicyviolation/targeting-for-inline-handler-in-markup-then-disconnected.htmlPass2 / 2
securitypolicyviolation/targeting-for-inline-handler-in-markup.htmlPass2 / 2
securitypolicyviolation/targeting-for-inline-handler-in-shadow-dom.htmlPass1 / 1
securitypolicyviolation/targeting-for-inline-handler-on-disconnected-element.htmlPass1 / 1
securitypolicyviolation/targeting-for-inline-handler-on-element-in-disconnected-document-fragment.htmlPass1 / 1
securitypolicyviolation/targeting-for-inline-handler-on-main-frame-element-moved-to-subframe.htmlPass1 / 1
securitypolicyviolation/targeting-for-inline-handler-on-subframe-element.htmlPass9 / 9
securitypolicyviolation/targeting-for-inline-script-without-nonce.htmlPass5 / 5
securitypolicyviolation/targeting-for-inline-style-in-shadow-dom.htmlPass9 / 9
securitypolicyviolation/targeting-for-inline-style.htmlPass5 / 5
securitypolicyviolation/upgrade-insecure-requests-reporting.https.htmlPass3 / 3
securitypolicyviolation/worklet-import-nested-cross-origin-blocked.https.sub.htmlPass1 / 1
securitypolicyviolation/worklet-import-report-only.https.sub.htmlPass1 / 1
style-src-attr-elem/style-src-attr-allowed-src-blocked.htmlPass1 / 1
style-src-attr-elem/style-src-attr-blocked-src-allowed.htmlPass2 / 2
style-src-attr-elem/style-src-elem-allowed-attr-blocked.htmlPass2 / 2
style-src-attr-elem/style-src-elem-allowed-src-blocked-link.htmlPass1 / 1
style-src-attr-elem/style-src-elem-allowed-src-blocked.htmlPass1 / 1
style-src-attr-elem/style-src-elem-blocked-attr-allowed.htmlPass2 / 2
style-src-attr-elem/style-src-elem-blocked-src-allowed.htmlPass2 / 2
style-src/import-style-allowed.sub.htmlPass1 / 1
style-src/import-style-blocked.sub.htmlPass1 / 1
style-src/injected-inline-style-allowed.sub.htmlPass1 / 1
style-src/injected-inline-style-blocked.sub.htmlPass1 / 1
style-src/inline-style-allowed-while-cloning-objects.sub.htmlFail22 / 25TEST BUGsubtests 19 and 20 expect the declarations of a style attribute blocked by style-src to apply (they fail in every browser), and non-HTML namespace expects getAttribute('style') to return the empty string for the blocked attribute of an svg element (only Firefox does)
style-src/inline-style-allowed.sub.htmlPass1 / 1
style-src/inline-style-attribute-allowed.sub.htmlPass1 / 1
style-src/inline-style-attribute-blocked.sub.htmlPass1 / 1
style-src/inline-style-attribute-on-html.sub.htmlPass1 / 1
style-src/inline-style-blocked.sub.htmlPass2 / 2
style-src/style-allowed.sub.htmlPass1 / 1
style-src/style-blocked.htmlPass2 / 2
style-src/style-src-attr-blocked-createhtmldocument-adopt.htmlPass2 / 2
style-src/style-src-attr-blocked-domparser-adopt.htmlPass2 / 2
style-src/style-src-attr-blocked-template-move.htmlPass2 / 2
style-src/style-src-error-event-fires.htmlPass2 / 2
style-src/style-src-hash-allowed.htmlPass1 / 1
style-src/style-src-hash-blocked.htmlPass3 / 3
style-src/style-src-hash-case-insensitive.htmlPass1 / 1
style-src/style-src-hash-default-src-allowed.htmlPass1 / 1
style-src/style-src-imported-style-allowed.sub.htmlPass1 / 1
style-src/style-src-imported-style-blocked.htmlPass2 / 2
style-src/style-src-injected-inline-style-allowed-with-content-hash.htmlPass4 / 4
style-src/style-src-injected-inline-style-allowed.htmlPass1 / 1
style-src/style-src-injected-inline-style-blocked.htmlPass2 / 2
style-src/style-src-injected-stylesheet-allowed.sub.htmlPass1 / 1
style-src/style-src-injected-stylesheet-blocked.sub.htmlPass2 / 2
style-src/style-src-inline-style-allowed.htmlPass1 / 1
style-src/style-src-inline-style-attribute-allowed.htmlPass1 / 1
style-src/style-src-inline-style-attribute-blocked.htmlPass2 / 2
style-src/style-src-inline-style-blocked.htmlPass2 / 2
style-src/style-src-inline-style-nonce-allowed.htmlPass1 / 1
style-src/style-src-inline-style-nonce-blocked-error-event.htmlPass2 / 2
style-src/style-src-inline-style-nonce-blocked.htmlPass2 / 2
style-src/style-src-inline-style-with-csstext.htmlPass1 / 1
style-src/style-src-multiple-policies-multiple-hashing-algorithms.htmlPass2 / 2
style-src/style-src-none-blocked.htmlPass2 / 2
style-src/style-src-star-allowed.htmlPass1 / 1
style-src/style-src-stylesheet-nonce-allowed.htmlPass1 / 1
style-src/style-src-stylesheet-nonce-blocked.htmlPass2 / 2
style-src/stylehash-allowed.sub.htmlPass1 / 1
style-src/stylehash-basic-blocked.sub.htmlPass1 / 1
style-src/stylehash-default-src.sub.htmlPass1 / 1
style-src/stylenonce-allowed.sub.htmlPass3 / 3
style-src/stylenonce-blocked.sub.htmlPass2 / 2
svg/object-in-svg-foreignobject.sub.htmlPass1 / 1
svg/svg-from-guid.htmlPass1 / 1
svg/svg-inline.sub.htmlPass1 / 1
svg/svg-policy-resource-doc-includes.htmlPass1 / 1
svg/svg-policy-with-resource.htmlPass1 / 1
unsafe-eval/eval-allowed.sub.htmlPass1 / 1
unsafe-eval/eval-blocked-and-sends-report.sub.htmlPass1 / 1
unsafe-eval/eval-blocked-in-about-blank-iframe.htmlPass1 / 1
unsafe-eval/eval-blocked.sub.htmlPass1 / 1
unsafe-eval/eval-in-iframe.htmlPass6 / 6
unsafe-eval/eval-scripts-setInterval-allowed.sub.htmlPass1 / 1
unsafe-eval/eval-scripts-setInterval-blocked.sub.htmlPass1 / 1
unsafe-eval/eval-scripts-setTimeout-allowed.sub.htmlPass1 / 1
unsafe-eval/eval-scripts-setTimeout-blocked.sub.htmlPass1 / 1
unsafe-eval/eval-scripts-setTimeout-setInterval-blocked-no-exception.htmlPass2 / 2
unsafe-eval/eval-scripts-setTimeout-setInterval-cross-realm.htmlPass6 / 6
unsafe-eval/eval-scripts-setTimeout-setInterval-policy-added-later.htmlPass2 / 2
unsafe-eval/eval-scripts-setTimeout-setInterval-report-only.htmlPass4 / 4
unsafe-eval/function-constructor-allowed.sub.htmlPass1 / 1
unsafe-eval/function-constructor-blocked.sub.htmlPass1 / 1
unsafe-hashes/javascript_src_allowed-href.htmlPass1 / 1
unsafe-hashes/javascript_src_allowed-href_blank-script-src-attr.htmlPass1 / 1
unsafe-hashes/javascript_src_allowed-href_blank-script-src-elem.htmlPass1 / 1
unsafe-hashes/javascript_src_allowed-href_blank.htmlPass1 / 1
unsafe-hashes/javascript_src_allowed-window_location.htmlPass1 / 1
unsafe-hashes/javascript_src_allowed-window_open.htmlPass1 / 1
unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-href.htmlPass1 / 1
unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-href_blank-script-src-attr.htmlPass1 / 1
unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-href_blank-script-src-elem.htmlPass1 / 1
unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-href_blank.htmlPass1 / 1
unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-window_location.htmlPass1 / 1
unsafe-hashes/javascript_src_denied_missing_unsafe_hashes-window_open.htmlPass1 / 1
unsafe-hashes/javascript_src_denied_wrong_hash-href.htmlPass1 / 1
unsafe-hashes/javascript_src_denied_wrong_hash-href_blank-script-src-attr.htmlPass1 / 1
unsafe-hashes/javascript_src_denied_wrong_hash-href_blank-script-src-elem.htmlPass1 / 1
unsafe-hashes/javascript_src_denied_wrong_hash-href_blank.htmlPass1 / 1
unsafe-hashes/javascript_src_denied_wrong_hash-window_location.htmlPass1 / 1
unsafe-hashes/javascript_src_denied_wrong_hash-window_open.htmlPass1 / 1
unsafe-hashes/script_event_handlers_allowed.htmlPass1 / 1
unsafe-hashes/script_event_handlers_denied_missing_unsafe_hashes.htmlPass1 / 1
unsafe-hashes/script_event_handlers_denied_wrong_hash.htmlPass1 / 1
unsafe-hashes/style_attribute_allowed.htmlPass1 / 1
unsafe-hashes/style_attribute_denied_missing_unsafe_hashes.htmlPass1 / 1
unsafe-hashes/style_attribute_denied_wrong_hash.htmlPass1 / 1
wasm-unsafe-eval/default-src-blocks-wasm-streaming.any.jsPass6 / 6
wasm-unsafe-eval/default-src-blocks-wasm.any.jsPass9 / 9
wasm-unsafe-eval/default-src-unsafe-eval-allows-wasm.any.jsPass15 / 15
wasm-unsafe-eval/default-src-wasm-unsafe-eval-allows-wasm.any.jsPass15 / 15
wasm-unsafe-eval/postMessage-wasm-module.htmlTimeout0 / 1NOT IMPLEMENTEDa WebAssembly.Module deserialized by postMessage() in a realm whose policy does not allow 'wasm-unsafe-eval' is not compiled again, so no wasm-eval violation is reported (Chromium reports one; not specified)
wasm-unsafe-eval/script-src-blocks-wasm-streaming.any.jsPass6 / 6
wasm-unsafe-eval/script-src-blocks-wasm.any.jsPass9 / 9
wasm-unsafe-eval/script-src-spv-asynch.any.jsPass6 / 6
wasm-unsafe-eval/script-src-unsafe-eval-allows-wasm.any.jsPass15 / 15
wasm-unsafe-eval/script-src-wasm-unsafe-eval-allows-wasm.any.jsPass15 / 15
webrtc/webrtc-allowed-default-src-none.htmlFail0 / 1NOT IMPLEMENTEDWebRTC (RTCPeerConnection) and the webrtc directive
webrtc/webrtc-allowed-explicit.htmlFail0 / 1NOT IMPLEMENTEDWebRTC (RTCPeerConnection) and the webrtc directive
webrtc/webrtc-allowed-nopolicy.htmlFail0 / 1NOT IMPLEMENTEDWebRTC (RTCPeerConnection) and the webrtc directive
webrtc/webrtc-blocked-explicit.htmlFail0 / 1NOT IMPLEMENTEDWebRTC (RTCPeerConnection) and the webrtc directive
webrtc/webrtc-blocked-unknown.htmlFail0 / 1NOT IMPLEMENTEDWebRTC (RTCPeerConnection) and the webrtc directive
worker-src/dedicated-child.sub.htmlPass2 / 2
worker-src/dedicated-fallback.sub.htmlPass2 / 2
worker-src/dedicated-list.sub.htmlPass2 / 2
worker-src/dedicated-none.sub.htmlPass2 / 2
worker-src/dedicated-self.sub.htmlPass1 / 1
worker-src/dedicated-worker-src-child-fallback-blocked.sub.htmlPass1 / 1
worker-src/dedicated-worker-src-child-fallback.sub.htmlPass1 / 1
worker-src/dedicated-worker-src-default-fallback.sub.htmlPass1 / 1
worker-src/dedicated-worker-src-script-fallback.sub.htmlPass1 / 1
worker-src/dedicated-worker-src-self-fallback.sub.htmlPass1 / 1
worker-src/service-child.https.sub.htmlPass1 / 1
worker-src/service-fallback.https.sub.htmlPass1 / 1
worker-src/service-list.https.sub.htmlPass1 / 1
worker-src/service-none.https.sub.htmlPass1 / 1
worker-src/service-self.https.sub.htmlPass1 / 1
worker-src/service-worker-src-child-fallback-blocked.https.sub.htmlPass1 / 1
worker-src/service-worker-src-child-fallback.https.sub.htmlPass1 / 1
worker-src/service-worker-src-default-fallback.https.sub.htmlPass1 / 1
worker-src/service-worker-src-script-fallback.https.sub.htmlPass1 / 1
worker-src/service-worker-src-self-fallback.https.sub.htmlPass1 / 1
worker-src/service-worker-static-import-blocked.https.sub.htmlPass2 / 2
worker-src/shared-child.sub.htmlPass2 / 2
worker-src/shared-fallback.sub.htmlPass2 / 2
worker-src/shared-list.sub.htmlPass2 / 2
worker-src/shared-none.sub.htmlPass2 / 2
worker-src/shared-self.sub.htmlPass1 / 1
worker-src/shared-worker-src-child-fallback-blocked.sub.htmlPass1 / 1
worker-src/shared-worker-src-child-fallback.sub.htmlPass1 / 1
worker-src/shared-worker-src-default-fallback.sub.htmlPass1 / 1
worker-src/shared-worker-src-script-fallback.sub.htmlPass1 / 1
worker-src/shared-worker-src-self-fallback.sub.htmlPass1 / 1
xslt/document-function-blocked.htmlTimeout0 / 1NOT IMPLEMENTEDXSLT (<?xml-stylesheet?> XSLT transformations, XSLTProcessor, document())
xslt/xslt-strict-dynamic-blocked.htmlTimeout0 / 1NOT IMPLEMENTEDXSLT (<?xml-stylesheet?> XSLT transformations, XSLTProcessor, document())
xslt/xsltprocessor-include-blocked.htmlTimeout0 / 1NOT IMPLEMENTEDXSLT (<?xml-stylesheet?> XSLT transformations, XSLTProcessor, document())

Tentative tests

TestResultSubtestsKindDescription
embedded-enforcement/subsumption_algorithm-trusted_types.tentative.htmlFail14 / 21NOT IMPLEMENTEDthe subsumption of the Trusted Types directives (require-trusted-types-for and trusted-types, a tentative extension of https://w3c.github.io/webappsec-cspee/#subsume-policy): the subsumption only compares the source lists, the sandboxing flags and upgrade-insecure-requests, so a response that does not enforce the required Trusted Types directives is loaded
generic/domparser-document-suppresses-csp-warning-for-inline-style.tentative.htmlPass1 / 1
img-src/css-filter-blocked.tentative.htmlPass1 / 1
img-src/svg-use-blocked.tentative.htmlPass1 / 1
script-src/tentative/script-url-allowed-by-hash.https.htmlFail4 / 28NOT IMPLEMENTEDthe URL hash sources of script-src ('url-sha256-…', tentative) and their reports
script-src/tentative/script-url-blocked-report-contains-hash-dedicated-worker.https.htmlFail0 / 1NOT IMPLEMENTEDthe URL hash sources of script-src ('url-sha256-…', tentative) and their reports
script-src/tentative/script-url-blocked-report-contains-hash-service-worker.https.htmlTimeout0 / 1NOT IMPLEMENTEDthe URL hash sources of script-src ('url-sha256-…', tentative) and their reports
script-src/tentative/script-url-blocked-report-contains-hash-shared-worker.https.htmlFail0 / 1NOT IMPLEMENTEDthe URL hash sources of script-src ('url-sha256-…', tentative) and their reports
script-src/tentative/script-url-blocked-report-contains-hash.https.htmlError0 / 1NOT IMPLEMENTEDthe URL hash sources of script-src ('url-sha256-…', tentative) and their reports
script-src/tentative/url-hash-in-header-and-meta.https.htmlFail4 / 6NOT IMPLEMENTEDthe URL hash sources of script-src ('url-sha256-…', tentative) and their reports
securitypolicyviolation/linenumber.tentative.htmlPass1 / 1
unsafe-eval/tentative/eval-allowed-by-hash-long-script.sub.htmlPass1 / 1
unsafe-eval/tentative/eval-allowed-by-hash.sub.htmlPass1 / 1
unsafe-eval/tentative/eval-blocked-report-contains-hash.htmlPass2 / 2
unsafe-eval/tentative/eval-hashes-override-unsafe-eval.sub.htmlPass1 / 1

Reftests

TestResultVariantsKindDescription
generic/image-document-ignores-csp-for-loading-main-image.tentative.htmlPass1 / 1
img-src/shared-stylesheet-image-cache-bypass-strict-first.htmlPass1 / 1
img-src/shared-stylesheet-image-cache-bypass.htmlPass1 / 1
img-src/shared-stylesheet-image-set-cache-bypass-strict-first.htmlPass1 / 1
img-src/shared-stylesheet-image-set-cache-bypass.htmlPass1 / 1
img-src/shared-stylesheet-mask-cache-bypass-strict-first.htmlPass1 / 1
img-src/shared-stylesheet-mask-cache-bypass.htmlPass1 / 1
svg/svg-inline-without-scripting.htmlPass1 / 1