From c4aaf0a7d288a5b53a75e795efb3dc5551bd79b1 Mon Sep 17 00:00:00 2001
From: ldm0 <ldm2993593805@163.com>
Date: Tue, 8 Sep 2026 18:10:43 +0800
Subject: [PATCH] test(wpt): serve dynamic import redirects without CORS
 headers

---
 .../moli_benchmark/wpt_cross/server.py        | 23 +++++++++++
 moli-benchmark/tests/test_wpt_cross.py        | 41 +++++++++++++++++++
 2 files changed, 64 insertions(+)

diff --git a/moli-benchmark/moli_benchmark/wpt_cross/server.py b/moli-benchmark/moli_benchmark/wpt_cross/server.py
index ac5acec53a..4a4d808264 100644
--- a/moli-benchmark/moli_benchmark/wpt_cross/server.py
+++ b/moli-benchmark/moli_benchmark/wpt_cross/server.py
@@ -2300,6 +2300,29 @@ def _make_handler(
                 )
                 return
 
+            if path == (
+                "/html/semantics/scripting-1/the-script-element/module/"
+                "dynamic-import/beta/redirect.py"
+            ):
+                params = parse_qs(parsed.query, keep_blank_values=True)
+                try:
+                    status_code = int(params.get("status", ["302"])[0])
+                except ValueError:
+                    status_code = 302
+                location = params.get("location", [""])[0]
+                if not 100 <= status_code <= 599 or any(
+                    character in location for character in "\r\n"
+                ):
+                    self.send_error(400)
+                    return
+                self._send_bytes(
+                    "text/plain; charset=utf-8",
+                    b"",
+                    emit_body=emit_body,
+                    extra_headers=[("Location", location)],
+                    status_code=status_code,
+                )
+                return
             if path in {
                 "/fetch/api/resources/redirect.py",
                 "/common/redirect.py",
diff --git a/moli-benchmark/tests/test_wpt_cross.py b/moli-benchmark/tests/test_wpt_cross.py
index a98b630044..2ce44bfa25 100644
--- a/moli-benchmark/tests/test_wpt_cross.py
+++ b/moli-benchmark/tests/test_wpt_cross.py
@@ -4453,6 +4453,47 @@ test(() => {}, "ok");
             ],
         )
 
+    def test_fixture_server_models_dynamic_import_redirect_without_cors(self) -> None:
+        with tempfile.TemporaryDirectory() as root:
+            root_path = Path(root)
+            (root_path / "resources").mkdir()
+            (root_path / "resources" / "testharness.js").write_text(
+                "// testharness", encoding="utf-8"
+            )
+            with WptFixtureServer(root_path) as server:
+                for method in ("GET", "HEAD"):
+                    for query, status, location in (
+                        ("location=%2Ftarget", 302, "/target"),
+                        (
+                            "status=307&location=https%3A%2F%2Fexample.test%2Fx",
+                            307,
+                            "https://example.test/x",
+                        ),
+                        ("status=invalid&location=%2Ftarget", 302, "/target"),
+                        (
+                            "status=302&status=307&location=%2Fa&location=%2Fb",
+                            302,
+                            "/a",
+                        ),
+                    ):
+                        with self.subTest(method=method, query=query):
+                            connection = HTTPConnection("127.0.0.1", server.port, timeout=2)
+                            try:
+                                connection.request(
+                                    method,
+                                    "/html/semantics/scripting-1/the-script-element/module/"
+                                    f"dynamic-import/beta/redirect.py?{query}",
+                                )
+                                response = connection.getresponse()
+                                self.assertEqual(response.status, status)
+                                self.assertEqual(response.headers.get("Location"), location)
+                                self.assertIsNone(
+                                    response.headers.get("Access-Control-Allow-Origin")
+                                )
+                                self.assertEqual(response.read(), b"")
+                            finally:
+                                connection.close()
+
     def test_fixture_server_models_common_redirect_opt_in_handler(self) -> None:
         with tempfile.TemporaryDirectory() as root:
             root_path = Path(root)