LayoutTests/security/cannot-read-self-from-file.html - Issue 1140203002: make file: an effectively unique origin

Side by Side Diff: LayoutTests/security/cannot-read-self-from-file.html

Issue 1140203002: make file: an effectively unique origin (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: added test Created 5 years, 7 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

OLD	NEW
(Empty)
	1 <html>
	Mike West 2015/05/17 08:40:48 Nit: doctype. Nit: doctype. TheJH 2015/05/17 14:35:19 Hm, ok, added one to both HTML documents. (Not one Show quoted text On 2015/05/17 08:40:48, Mike West (holiday in DE) wrote: > Nit: doctype. Hm, ok, added one to both HTML documents. (Not one the documents really conform to, as far as I understand, since there's no <title>.)
	2 <head>

	3 <script>

	4 testRunner.dumpAsText();
	Mike West 2015/05/17 08:40:48 Rather than setting these manually, please convert Rather than setting these manually, please convert this to use `testrunner.js`, which will set up the environment for you. That is, include: <script src="/resources/testharness.js"></script> <script src="/resources/testharnessreport.js"></script> at the top of the document, and use the provided assertion mechanisms to execute your test. http://darobin.github.io/test-harness-tutorial/docs/using-testharness.html has details. TheJH 2015/05/17 14:35:19 Note that I need to use relative URLs because I'm Show quoted text On 2015/05/17 08:40:48, Mike West (holiday in DE) wrote: > Rather than setting these manually, please convert this to use `testrunner.js`, > which will set up the environment for you. That is, include: > > <script src="/resources/testharness.js"></script> > <script src="/resources/testharnessreport.js"></script> Note that I need to use relative URLs because I'm running from file:. Show quoted text > at the top of the document, and use the provided assertion mechanisms to execute > your test. I can't get it to work. That is, the tested code clearly does run, and the tested code would print different console output if the test failed, so you'd notice a fail, but that's just the "CONSOLE ERROR: XMLHttpRequest cannot load cannot-read-self-from-file.html. Cross origin requests are only supported for protocol schemes: http, data, https." message. Whether or not code in assert_throws() throws seems to have no impact on the outcome of the test. To see it for yourself: 1. Run the test - it passes. 2. Apply this patch: diff --git a/LayoutTests/security/resources/cannot-read-self-from-file.html b/LayoutTests/security/resources/cannot-read-self-from-file.html index ce246fa..12d8969 100644 --- a/LayoutTests/security/resources/cannot-read-self-from-file.html +++ b/LayoutTests/security/resources/cannot-read-self-from-file.html @@ -7,7 +7,8 @@ test(function() { var req = new XMLHttpRequest(); req.open('GET', location); - assert_throws("NetworkError", function(){req.send()}, "request should fail"); + try { req.send() } catch(e) {} + assert_throws("NetworkError", function(){}, "request should fail"); }, "file: URI documents can't request themselves"); </script> </head> 3. Run the test again. Still passes. Can someone who is a bit more familiar with this stuff tell me what I'm doing wrong?
	5 testRunner.setAllowUniversalAccessFromFileURLs(false);

	6 testRunner.setAllowFileAccessFromFileURLs(false);
	Mike West 2015/05/17 08:40:48 These default to `false`, don't they? Why do you n These default to `false`, don't they? Why do you need to set them? TheJH 2015/05/17 14:35:19 See ./content/shell/common/test_runner/test_prefer Show quoted text On 2015/05/17 08:40:48, Mike West (holiday in DE) wrote: > These default to `false`, don't they? Why do you need to set them? See ./content/shell/common/test_runner/test_preferences.cc: void TestPreferences::Reset() { [...] allow_file_access_from_file_urls = true; [...] // Allow those layout tests running as local files, i.e. under // LayoutTests/http/tests/local, to access http server. allow_universal_access_from_file_urls = true; [...] }
	7 </script>

	8 </head>

	9 <body>

	10 <iframe src="resources/cannot-read-self-from-file.html"></iframe>
	Mike West 2015/05/17 08:40:48 Why do this work in an `<iframe>`? Wouldn't the re Why do this work in an `<iframe>`? Wouldn't the result be the same if you executed the same code in this file? TheJH 2015/05/17 14:35:19 As far as I understand, I need to create a new ori Show quoted text On 2015/05/17 08:40:48, Mike West (holiday in DE) wrote: > Why do this work in an `<iframe>`? Wouldn't the result be the same if you > executed the same code in this file? As far as I understand, I need to create a new origin to let testRunner.setAllowUniversalAccessFromFileURLs(false); and testRunner.setAllowFileAccessFromFileURLs(false); take effect, which can be achieved by loading a new document in an iframe. There's a bunch of other tests that follow the same pattern. I actually tried it without the iframe first, which didn't work.
	11 Documents loaded from file: shouldn't be able to access themselves via XHR.

	12 </body>

	13 </html>

OLD	NEW