@@ -72,3 +72,55 @@ test("require subdomain iframe", async ({ page }) => {
7272 "Sorry, due to security settings, this ReplayWeb.page embed only be viewed within a subdomain iframe." ,
7373 ) ;
7474} ) ;
75+
76+ test ( "csp blocking in place" , async ( { page } ) => {
77+ await page . goto ( "http://localhost:9990/embed.html" ) ;
78+
79+ const frame = page
80+ . locator ( "replay-web-page" )
81+ . frameLocator ( "iframe" )
82+ . locator ( "replay-app-main wr-item wr-coll-replay" )
83+ . frameLocator ( "iframe" )
84+ . locator ( ":root" ) ;
85+
86+ const didNotFetch = await frame . evaluate ( async ( ) => {
87+ const blocked = async ( win , url ) => {
88+ try {
89+ const resp = await win . fetch ( url ) ;
90+ if ( ! resp . ok ) {
91+ return 1 ;
92+ }
93+ return 0 ;
94+ } catch ( e ) {
95+ return 1 ;
96+ }
97+ } ;
98+
99+ let block = 0 ;
100+
101+ // blocks (1 - 3)
102+ block += await blocked ( window , "https://webrecorder.net/" ) ;
103+ block += await blocked ( window , "http://localhost:9990/ui.js" ) ;
104+ block += await blocked ( window , "http://localhost:9990/sw.js" ) ;
105+
106+ const iframe = document . createElement ( "iframe" ) ;
107+ iframe . src = "http://localhost:9990/static/wombat.js" ;
108+ document . body . appendChild ( iframe ) ;
109+
110+ await new Promise ( ( resolve ) => setTimeout ( resolve , 1000 ) ) ;
111+
112+ // (4) still blocked from loading due to csp
113+ block += await blocked ( iframe . contentWindow , "https://webrecorder.net/" ) ;
114+
115+ // (5-6) blocked by csp policy, even though local
116+ block += await blocked ( iframe . contentWindow , "http://localhost:9990/sw.js" ) ;
117+ block += await blocked (
118+ iframe . contentWindow ,
119+ "http://localhost:9990/static/wombat.js" ,
120+ ) ;
121+
122+ return block ;
123+ } ) ;
124+
125+ expect ( didNotFetch ) . toBe ( 6 ) ;
126+ } ) ;
0 commit comments