<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <script src="/js-test-resources/testharness.js"></script>
    <script src="/js-test-resources/testharnessreport.js"></script>
    <script src="resources/sri-utilities.js"></script>
</head>
<body>
    <div id="log"></div>
    <div id="container"></div>
<script>

var main_host = '127.0.0.1';
var remote_host = 'localhost';
var port_string = "8000";
var main_host_and_port = main_host + ':' + port_string;
var remote_host_and_port = remote_host + ':' + port_string;

var crossorigin_anon_script = location.protocol + '//' + remote_host_and_port + '/subresource-integrity/resources/crossorigin-anon-script-module.js';
var crossorigin_creds_script = location.protocol + '//' + remote_host_and_port + '/subresource-integrity/resources/crossorigin-creds-script-module.js';
var crossorigin_ineligible_script = location.protocol + '//' + remote_host_and_port + '/subresource-integrity/resources/crossorigin-ineligible-script-module.js';

// Script tests from web-platform-tests/subresource-integrity

new SRIModuleTest(
    true,
    "Same-origin with correct sha256 hash.",
    "resources/matching-digest-module.js",
    "sha256-cWh9nPfm7/mRbKhzarnRYlsJWz5XTNcsqPFzKEx+zSU="
);

new SRIModuleTest(
    true,
    "Same-origin with correct sha384 hash.",
    "resources/matching-digest-module.js",
    "sha384-g8fn+xx4btmBZDJlonZNN+dDSYjP5NsMqlJw0CSN6oGG+6MSH71sRhEPeAcRUMqJ"
);

new SRIModuleTest(
    true,
    "Same-origin with correct sha512 hash.",
    "resources/matching-digest-module.js",
    "sha512-v+XJeYrctfE2nOuR5oCz/JzMyhSzUtbmG4YEy2YbeAUzr+QaW3WmSdWAL9/JrSPFJW8BkLo5jQTO8GaWcNtRRg=="
);

new SRIModuleTest(
    true,
    "Same-origin with empty integrity.",
    "resources/matching-digest-module.js",
    ""
);

new SRIModuleTest(
    false,
    "Same-origin with incorrect hash.",
    "resources/non-matching-digest-module.js",
    "sha256-cWh9nPfm7/mRbKhzarnRYlsJWz5XTNcsqPFzKEx+zSU="
);

new SRIModuleTest(
    true,
    "Same-origin with multiple sha256 hashes, including correct.",
    "resources/matching-digest-module.js",
    "sha256-cWh9nPfm7/mRbKhzarnRYlsJWz5XTNcsqPFzKEx+zSU= sha256-deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdead"
);

new SRIModuleTest(
    true,
    "Same-origin with multiple sha256 hashes, including unknown algorithm.",
    "resources/matching-digest-module.js",
    "sha256-cWh9nPfm7/mRbKhzarnRYlsJWz5XTNcsqPFzKEx+zSU= foo666-deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdead"
);

new SRIModuleTest(
    true,
    "Same-origin with sha256 mismatch, sha512 match",
    "resources/matching-digest-module.js",
    "sha512-v+XJeYrctfE2nOuR5oCz/JzMyhSzUtbmG4YEy2YbeAUzr+QaW3WmSdWAL9/JrSPFJW8BkLo5jQTO8GaWcNtRRg== sha256-deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdead"
);

new SRIModuleTest(
    false,
    "Same-origin with sha256 match, sha512 mismatch",
    "resources/matching-digest-module.js",
    "sha512-deadbeefspbnUnwooKGNNCb39nvg+EW0O9hDScTXeo/9pVZztLSUYU3LNV6H0lZapo8bCJUpyPPLAzE9fDzpxg== sha256-cWh9nPfm7/mRbKhzarnRYlsJWz5XTNcsqPFzKEx+zSU="
);

new SRIModuleTest(
    true,
    "<crossorigin='anonymous'> with correct hash, ACAO: *",
    crossorigin_anon_script,
    "sha256-viLyCYB6YddJKjUAJ4dZ1eHe+242Dd7wTICmvNj2IAA=",
    "anonymous"
);

new SRIModuleTest(
    false,
    "<crossorigin='anonymous'> with incorrect hash, ACAO: *",
    crossorigin_anon_script,
    "sha256-deadbeefcSLlbFZCj1OACLxTxVck2TOrBTEdUbwz1yU=",
    "anonymous"
);

new SRIModuleTest(
    true,
    "<crossorigin='use-credentials'> with correct hash, CORS-eligible",
    crossorigin_creds_script,
    "sha256-NngWiHG2N6KWjHhOcgGuF0iJXKR+MPMxl3Ip6wDAEGg=",
    "use-credentials"
);

new SRIModuleTest(
    false,
    "<crossorigin='use-credentials'> with incorrect hash CORS-eligible",
    crossorigin_creds_script,
    "sha256-deadbeef2S+pTRZgiw3DWrhC6JLDlt2zRyGpwH7unU8=",
    "use-credentials"
);

new SRIModuleTest(
    false,
    "<crossorigin='anonymous'> with CORS-ineligible resource",
    crossorigin_ineligible_script,
    "sha256-IhB+PkTnIf881zBDWNEOJ6pKtju9Kiw+L1fK5Zn/pl0=",
    "anonymous"
);

new SRIModuleTest(
    true,
    "Cross-origin, empty integrity",
    crossorigin_anon_script,
    ""
);

new SRIModuleTest(
    true,
    "Same-origin with correct hash, options.",
    "resources/matching-digest-module.js",
    "sha256-cWh9nPfm7/mRbKhzarnRYlsJWz5XTNcsqPFzKEx+zSU=?foo=bar?spam=eggs"
);

new SRIModuleTest(
    true,
    "Same-origin with unknown algorithm only.",
    "resources/matching-digest-module.js",
    "foo666-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9E="
);

// WebKit additions to the web-platform-tests test cases.
// FIXME: Upstream these additional tests to the official web-platform-tests repository.

new SRIModuleTest(
    true,
    "Same-origin with correct sha256 hash, using base64URL encoding.",
    "resources/matching-digest-module.js",
    "sha256-cWh9nPfm7_mRbKhzarnRYlsJWz5XTNcsqPFzKEx-zSU="
);

new SRIModuleTest(
    false,
    "Same-origin with correct sha256 hash, using intermixed base64 and base64URL encoding, should fail.",
    "resources/matching-digest-module.js",
    "sha256-cWh9nPfm7_mRbKhzarnRYlsJWz5XTNcsqPFzKEx+zSU="
);

new SRIModuleTest(
    true,
    "Same-origin with invalid syntax only.",
    "resources/matching-digest-module.js",
    "?foo=bar?spam=eggs"
);

new SRIModuleTest(
    true,
    "Same-origin with multiple valid sha256 hashes, including correct.",
    "resources/matching-digest-module.js",
    "sha256-cWh9nPfm7/mRbKhzarnRYlsJWz5XTNcsqPFzKEx+zSU= sha256-cWh9nPfm7/mRbKhzarnRYlsJWz5XTNcsqPFzKEx+zSU="
);

new SRIModuleTest(
    false,
    "Same-origin with incorrect hash, options.",
    "resources/matching-digest-module.js",
    "sha256-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9e=?foo=bar?spam=eggs"
);

SRITests.execute();

</script>
</body>
</html>