| Index: LayoutTests/http/tests/security/suborigins/suborigin-in-meta-disallowed.html
|
| diff --git a/LayoutTests/http/tests/security/suborigins/suborigin-in-meta-disallowed.html b/LayoutTests/http/tests/security/suborigins/suborigin-in-meta-disallowed.html
|
| index 9c2fbfbfc0efd05b33f6e2343089d85db3345ef8..0af797eea4ce839d023cf92b0114cc39e0badfb6 100644
|
| --- a/LayoutTests/http/tests/security/suborigins/suborigin-in-meta-disallowed.html
|
| +++ b/LayoutTests/http/tests/security/suborigins/suborigin-in-meta-disallowed.html
|
| @@ -1,12 +1,22 @@
|
| <!DOCTYPE html>
|
| <html>
|
| <head>
|
| - <title>Suborigin in <meta> disallowed</title>
|
| - <script src="../../resources/testharness.js"></script>
|
| - <script src="../../resources/testharnessreport.js"></script>
|
| <meta http-equiv="Content-Security-Policy" content="suborigin foobar">
|
| + <title>The <meta> tag does not allow a page to enter a suborigin.</title>
|
| + <script src="/resources/testharness.js"></script>
|
| + <script src="/resources/testharnessreport.js"></script>
|
| </head>
|
| - <body>
|
| - <script>done()</script>
|
| - </body>
|
| + <script>
|
| + window.onmessage = function(event) {
|
| + var secret;
|
| + try {
|
| + secret = document.getElementById('iframe').contentWindow.secret;
|
| + } catch(e) {
|
| + secret = '' + e;
|
| + }
|
| + assert_equals(secret, 'SecurityError: Blocked a frame with origin \"http://127.0.0.1:8000\" from accessing a cross-origin frame.');
|
| + done();
|
| + };
|
| + </script>
|
| + <iframe id="iframe" src="resources/post-to-parent.php?suborigin=foobar"></iframe>
|
| </html>
|
|
|
Chromium Code Reviews
Issue 1180923003:
Add window access checks for Suborigins (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master