<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <script src="/js-test-resources/testharness.js"></script>
    <script src="/js-test-resources/testharnessreport.js"></script>
    <script src="resources/sri-utilities.js"></script>
</head>
<body>
    <div id="log"></div>
    <div id="container"></div>
<script>

var main_host = '127.0.0.1';
var remote_host = 'localhost';
var port_string = "8000";
var main_host_and_port = main_host + ':' + port_string;
var remote_host_and_port = remote_host + ':' + port_string;

var crossorigin_anon_script = location.protocol + '//' + remote_host_and_port + '/subresource-integrity/resources/crossorigin-anon-script.js';
var crossorigin_creds_script = location.protocol + '//' + remote_host_and_port + '/subresource-integrity/resources/crossorigin-creds-script.js';
var crossorigin_ineligible_script = location.protocol + '//' + remote_host_and_port + '/subresource-integrity/resources/crossorigin-ineligible-script.js';

// Script tests from web-platform-tests/subresource-integrity

new SRIScriptTest(
    true,
    "Same-origin with correct sha256 hash.",
    "resources/matching-digest.js",
    "sha256-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9E="
);

new SRIScriptTest(
    true,
    "Same-origin with correct sha384 hash.",
    "resources/matching-digest.js",
    "sha384-BDRTPSywZFyxfLEAzaLcL4FfERBgJgXfEkuT0r04LG93Yqn1PWNYPZMomaqEfE3H"
);

new SRIScriptTest(
    true,
    "Same-origin with correct sha512 hash.",
    "resources/matching-digest.js",
    "sha512-geByvIIRspbnUnwooKGNNCb39nvg+EW0O9hDScTXeo/9pVZztLSUYU3LNV6H0lZapo8bCJUpyPPLAzE9fDzpxg=="
);

new SRIScriptTest(
    true,
    "Same-origin with empty integrity.",
    "resources/matching-digest.js",
    ""
);

new SRIScriptTest(
    false,
    "Same-origin with incorrect hash.",
    "resources/non-matching-digest.js",
    "sha256-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9e="
);

new SRIScriptTest(
    true,
    "Same-origin with multiple sha256 hashes, including correct.",
    "resources/matching-digest.js",
    "sha256-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9E= sha256-deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdead"
);

new SRIScriptTest(
    true,
    "Same-origin with multiple sha256 hashes, including unknown algorithm.",
    "resources/matching-digest.js",
    "sha256-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9E= foo666-deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdead"
);

new SRIScriptTest(
    true,
    "Same-origin with sha256 mismatch, sha512 match",
    "resources/matching-digest.js",
    "sha512-geByvIIRspbnUnwooKGNNCb39nvg+EW0O9hDScTXeo/9pVZztLSUYU3LNV6H0lZapo8bCJUpyPPLAzE9fDzpxg== sha256-deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdead"
);

new SRIScriptTest(
    false,
    "Same-origin with sha256 match, sha512 mismatch",
    "resources/matching-digest.js",
    "sha512-deadbeefspbnUnwooKGNNCb39nvg+EW0O9hDScTXeo/9pVZztLSUYU3LNV6H0lZapo8bCJUpyPPLAzE9fDzpxg== sha256-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9E="
);

new SRIScriptTest(
    true,
    "<crossorigin='anonymous'> with correct hash, ACAO: *",
    crossorigin_anon_script,
    "sha256-51AjITq701Y0yKSx3/UoIKtIY2UQ9+H8WGyyMuOWOC0=",
    "anonymous"
);

new SRIScriptTest(
    false,
    "<crossorigin='anonymous'> with incorrect hash, ACAO: *",
    crossorigin_anon_script,
    "sha256-deadbeefcSLlbFZCj1OACLxTxVck2TOrBTEdUbwz1yU=",
    "anonymous"
);

new SRIScriptTest(
    true,
    "<crossorigin='use-credentials'> with correct hash, CORS-eligible",
    crossorigin_creds_script,
    "sha256-IaGApVboXPQxVSm2wVFmhMq1Yu37gWklajgMdxKLIvc=",
    "use-credentials"
);

new SRIScriptTest(
    false,
    "<crossorigin='use-credentials'> with incorrect hash CORS-eligible",
    crossorigin_creds_script,
    "sha256-deadbeef2S+pTRZgiw3DWrhC6JLDlt2zRyGpwH7unU8=",
    "use-credentials"
);

new SRIScriptTest(
    false,
    "<crossorigin='anonymous'> with CORS-ineligible resource",
    crossorigin_ineligible_script,
    "sha256-F5fXKTX7SiWjtgybxiBZIo2qhh2WiQnNx372E60XrOo=",
    "anonymous"
);

new SRIScriptTest(
    false,
    "Cross-origin, not CORS request, with correct hash",
    crossorigin_anon_script,
    "sha256-51AjITq701Y0yKSx3/UoIKtIY2UQ9+H8WGyyMuOWOC0="
);

new SRIScriptTest(
    false,
    "Cross-origin, not CORS request, with hash mismatch",
    crossorigin_anon_script,
    "sha256-deadbeef01Y0yKSx3/UoIKtIY2UQ9+H8WGyyMuOWOC0="
);

new SRIScriptTest(
    true,
    "Cross-origin, empty integrity",
    crossorigin_anon_script,
    ""
);

new SRIScriptTest(
    true,
    "Same-origin with correct hash, options.",
    "resources/matching-digest.js",
    "sha256-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9E=?foo=bar?spam=eggs"
);

new SRIScriptTest(
    true,
    "Same-origin with unknown algorithm only.",
    "resources/matching-digest.js",
    "foo666-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9E="
);

// WebKit additions to the web-platform-tests test cases.
// FIXME: Upstream these additional tests to the official web-platform-tests repository.

new SRIScriptTest(
    true,
    "Same-origin with correct sha256 hash, using base64URL encoding.",
    "resources/matching-digest.js",
    "sha256-U9WYDtBWkcHx13-9UKk_3Q5eoqDc4YGxYb07EPWzb9E="
);

new SRIScriptTest(
    false,
    "Same-origin with correct sha256 hash, using intermixed base64 and base64URL encoding, should fail.",
    "resources/matching-digest.js",
    "sha256-U9WYDtBWkcHx13+9UKk_3Q5eoqDc4YGxYb07EPWzb9E="
);

new SRIScriptTest(
    true,
    "Same-origin with invalid syntax only.",
    "resources/matching-digest.js",
    "?foo=bar?spam=eggs"
);

new SRIScriptTest(
    true,
    "Same-origin with multiple valid sha256 hashes, including correct.",
    "resources/matching-digest.js",
    "sha256-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9e= sha256-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9E="
);

new SRIScriptTest(
    false,
    "Same-origin with incorrect hash, options.",
    "resources/matching-digest.js",
    "sha256-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9e=?foo=bar?spam=eggs"
);

SRITests.execute();

</script>
</body>
</html>