LayoutTests/http/tests/security/xss-DENIED-iframe-src-alias.html - Issue 1158433004: Remove Attr child nodes (making Attr a Node, not a ContainerNode)

Side by Side Diff: LayoutTests/http/tests/security/xss-DENIED-iframe-src-alias.html

Issue 1158433004: Remove Attr child nodes (making Attr a Node, not a ContainerNode) (Closed) Base URL: svn://svn.chromium.org/blink/trunk

Patch Set: address feedback Created 5 years, 6 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

« no previous file with comments | « LayoutTests/fast/storage/storage-detached-iframe-expected.txt ('k') | LayoutTests/http/tests/security/xss-DENIED-iframe-src-alias-expected.txt » ('j') | Source/core/dom/Attr.cpp » ('J')
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
1 <html>	1 <html>

2 <head>	2 <head>

3 <script>	3 <script>

4 window.onload = function()	4 window.onload = function()

5 {	5 {

6 if (window.testRunner) {	6 if (window.testRunner) {

7 testRunner.dumpAsText();	7 testRunner.dumpAsText();

8 }	8 }

9	9

10 function alertMsg(msg) {	10 function alertMsg(msg) {

(...skipping 14 matching lines...) Expand all Loading...
25 function(iFrame) {	25 function(iFrame) {

26 var a = document.createAttribute('src');	26 var a = document.createAttribute('src');

27 a.value = alertMsg("setAttributeNode");	27 a.value = alertMsg("setAttributeNode");

28 iFrame.setAttributeNode(a);	28 iFrame.setAttributeNode(a);

29 },	29 },

30 function(iFrame) {	30 function(iFrame) {

31 var a = document.createAttribute('src');	31 var a = document.createAttribute('src');

32 a.nodeValue = alertMsg("setAttributeNodeNS");	32 a.nodeValue = alertMsg("setAttributeNodeNS");

33 iFrame.setAttributeNodeNS(a);	33 iFrame.setAttributeNodeNS(a);

34 },	34 },

35 // Child manipulation methods

36 function(iFrame) {

37 var src = iFrame.attributes['src'];

38 src.appendChild(document.createTextNode(alertMsg("appendChild() + re moveChild()")));

39 src.removeChild(src.firstChild);

40 },

41 function(iFrame) {

42 var src = iFrame.attributes['src'];

43 src.replaceChild(document.createTextNode(alertMsg("replaceChild()")) , src.firstChild);

44 },

45 function(iFrame) {

46 var src = iFrame.attributes['src'];

47 while (src.firstChild)

48 src.removeChild(src.firstChild);

49 src.appendChild(document.createTextNode(alertMsg("removeChild() + ap pendChild()")));

50 },

51 function(iFrame) {

52 var src = iFrame.attributes['src'];

53 while (src.firstChild)

54 src.removeChild(src.firstChild);

55 var msg = alertMsg("removeChild() + appendChild() + appendChild()");

56 src.appendChild(document.createTextNode(msg.slice(0,4)));

57 src.appendChild(document.createTextNode(msg.slice(4)));

58 },

59 function(iFrame) {

60 var src = iFrame.attributes['src'];

61 src.insertBefore(document.createTextNode(alertMsg("insertBefore()")) , src.firstChild);

62 },

63 // NamedNodeMap	35 // NamedNodeMap

64 function(iFrame) {	36 function(iFrame) {

65 var a = document.createAttribute('src');	37 var a = document.createAttribute('src');

66 a.value = alertMsg("setNamedItem()");	38 a.value = alertMsg("setNamedItem()");

67 iFrame.attributes.setNamedItem(a);	39 iFrame.attributes.setNamedItem(a);

68 },	40 },

69 function(iFrame) {	41 function(iFrame) {

70 var a = document.createAttribute('src');	42 var a = document.createAttribute('src');

71 a.value = alertMsg("setNamedItemNS()");	43 a.value = alertMsg("setNamedItemNS()");

72 iFrame.attributes.setNamedItemNS(a);	44 iFrame.attributes.setNamedItemNS(a);

(...skipping 21 matching lines...) Expand all Loading...
94 }	66 }

95	67

96 </script>	68 </script>

97 </head>	69 </head>

98 <body>	70 <body>

99 <p>This script tests if iframe.src can be set to a JavaScript URL via alternate	71 <p>This script tests if iframe.src can be set to a JavaScript URL via alternate

100 DOM interfaces (such as Node.textContent or NamedNode.setNamedItem).	72 DOM interfaces (such as Node.textContent or NamedNode.setNamedItem).

101 The test is successful if no alerts appear and the page finishes loading.</p>	73 The test is successful if no alerts appear and the page finishes loading.</p>

102 </body>	74 </body>

103 </html>	75 </html>

OLD	NEW