DevExpress / testcafe

A Node.js tool to automate end-to-end web testing.
https://testcafe.io
MIT License
9.82k stars 670 forks source link

Support for webpacks implementation of trusted types in combination with 'eval-source-map' #7423

Closed mspoerer closed 1 year ago

mspoerer commented 1 year ago

What is your Scenario?

Trusted Types is a new experimental DOM API created to combat DOM XSS, supported now in Chrome 83, with a polyfill available for other browsers. Webpack5 is capable of using Trusted Types to load dynamically constructed scripts, to adhere to CSP require-trusted-types-for directive restrictions. See output.trustedTypes configuration option.

With 'trusted types' & 'eval-source-map' devtool enabled, Hammerhead does not rewrite all properties of the appropriate JavaScript objects that contain URL values.

What is the Current behavior?

It seems like there is a problem with the initialization order. The following images show lines of code from the generated Webpack bundles.

  1. Trusted Types = disabled; Devtool = 'eval-source-map'

    image
  2. Manipulated through Hummerhead - Works as expected Trusted Types = disabled; Devtool = 'eval-source-map';

    image
  3. Trusted Types = enabled; Devtool = 'eval-source-map'

    image
  4. Manipulated through Hummerhead - Does not rewrite properties as expected Trusted Types = enabled; Devtool = 'eval-source-map';

    image

What is the Expected behavior?

Hummerhead should rewrite all properties as expected.

What is your public website URL? (or attach your complete example)

Simple React, Webpack 5 & testcafe project. https://github.com/mspoerer/react-webpack-testcafe

What is your TestCafe test code?


Your complete configuration file

No response

Your complete test report

No response

Screenshots

No response

Steps to Reproduce

  1. Checkout project
  2. run npm install
  3. run npm run dev
  4. execute testcafe test via npm run test
  5. landing page prints wrong href value ('hash-of-testcafe/http://localhost:3000')
  6. open webpack.config.js and delete trustedTypes
  7. execute testcafe test via npm run test
  8. landing page prints correct href value ('http://localhost:3000')

TestCafe version

2.1.0

Node.js version

No response

Command-line arguments


Browser name(s) and version(s)

No response

Platform(s) and version(s)

No response

Other

No response

miherlosev commented 1 year ago

Hi @mspoerer,

Thank you for the example. I've reproduced this issue.

As a workaround, you can try running tests with the --experimental-proxyless option. The application renders the correct URL if you run tests with this option.

Note that this option is available only in Google Chrome. Also, you need to upgrade testcafe to the 2.1.1-alpha.3 version.

miherlosev commented 1 year ago

Hi @mspoerer,

This issue is not reproduced with combination of testcafe@3.0.1 and the Google Chrome browser. Feel free to reopen this issue if you encounter it in other browsers.