WebKit export of https://bugs.webkit.org/show_bug.cgi?id=273187
diff --git a/trusted-types/default-policy-callback-arguments.html b/trusted-types/default-policy-callback-arguments.html index 9b07be0..3e591bd 100644 --- a/trusted-types/default-policy-callback-arguments.html +++ b/trusted-types/default-policy-callback-arguments.html
@@ -47,7 +47,7 @@ [ "about:blank", "TrustedScriptURL", "HTMLScriptElement src", _ => script.src = "about:blank" ], [ "2+2", "TrustedScript", "eval", _ => eval("2+2") ], - [ "(function anonymous(\n) {\nreturn 2+2\n})", "TrustedScript", + [ "function anonymous(\n) {\nreturn 2+2\n}", "TrustedScript", "Function", _ => new Function("return 2+2") ], ]; for (var tc of cases) {
diff --git a/trusted-types/eval-csp-tt-default-policy.html b/trusted-types/eval-csp-tt-default-policy.html index 4ca9c56..e0007c8 100644 --- a/trusted-types/eval-csp-tt-default-policy.html +++ b/trusted-types/eval-csp-tt-default-policy.html
@@ -37,5 +37,17 @@ test(t => { assert_equals(new Function('return 1+1')(), 2); }, "Function constructor of string works."); + + test(t => { + assert_equals(new Function(p.createScript('val'),p.createScript('return val+1'))(1), 2); + }, "Function constructor of all TrustedScripts works."); + + test(t => { + assert_equals(new Function('val', 'return val+1')(1), 2); + }, "Function constructor of all strings works."); + + test(t => { + assert_equals(new Function('val', p.createScript('return val+1'))(1), 2); + }, "Function constructor of string and TrustedScript works."); </script>
diff --git a/trusted-types/eval-csp-tt-no-default-policy.html b/trusted-types/eval-csp-tt-no-default-policy.html index c4e5d09..bef7253 100644 --- a/trusted-types/eval-csp-tt-no-default-policy.html +++ b/trusted-types/eval-csp-tt-no-default-policy.html
@@ -40,5 +40,17 @@ test(t => { assert_throws_js(EvalError, _ => new Function('return 1+1')()); }, "Function constructor of string fails."); + + test(t => { + assert_equals(new Function(p.createScript('val'),p.createScript('return val+1'))(1), 2); + }, "Function constructor of all TrustedScripts works."); + + test(t => { + assert_throws_js(EvalError, _ => new Function('val', 'return val+1')(1)); + }, "Function constructor of all strings fails."); + + test(t => { + assert_throws_js(EvalError, _ => new Function('val', p.createScript('return val+1'))(1)); + }, "Function constructor of string and TrustedScript fails."); </script>
diff --git a/trusted-types/eval-no-csp-no-tt.html b/trusted-types/eval-no-csp-no-tt.html index 3f97998..0af4a8e 100644 --- a/trusted-types/eval-no-csp-no-tt.html +++ b/trusted-types/eval-no-csp-no-tt.html
@@ -38,7 +38,19 @@ }, "Function constructor of TrustedScript works."); test(t => { + assert_equals(new Function(p.createScript('val'),p.createScript('return val+1'))(1), 2); + }, "Function constructor of all TrustedScripts works."); + + test(t => { assert_equals(new Function('return 1+1')(), 2); }, "Function constructor of string works."); + + test(t => { + assert_equals(new Function('val', 'return val+1')(1), 2); + }, "Function constructor of all strings works."); + + test(t => { + assert_equals(new Function('val', p.createScript('return val+1'))(1), 2); + }, "Function constructor of string and TrustedScript works."); </script>