Chromium Code Reviews Chromium Code Reviews
Issue 1199183002:
Throw a SecurityError when navigator.serviceWorker is accessed in a sandboxed iframe. (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master| Index: LayoutTests/http/tests/serviceworker/chromium/sandboxed-iframe-navigator-serviceworker.html |
| diff --git a/LayoutTests/http/tests/serviceworker/chromium/sandboxed-iframe-navigator-serviceworker.html b/LayoutTests/http/tests/serviceworker/chromium/sandboxed-iframe-navigator-serviceworker.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..96f0fcce44b3db446f27b9cc0409c96af3806507 |
| --- /dev/null |
| +++ b/LayoutTests/http/tests/serviceworker/chromium/sandboxed-iframe-navigator-serviceworker.html |
| @@ -0,0 +1,88 @@ |
| +<!DOCTYPE html> |
| +<title>Accessing navigator.serviceWorker in sandboxed iframe.</title> |
| +<script src="../../resources/testharness.js"></script> |
| +<script src="../../resources/testharnessreport.js"></script> |
| +<script src="../resources/test-helpers.js"></script> |
| +<body> |
| +<script> |
| + |
| +function with_sandboxed_iframe(url, sandbox) { |
| + return new Promise(function(resolve) { |
| + var frame = document.createElement('iframe'); |
| + frame.sandbox = sandbox; |
| + frame.src = url; |
| + frame.onload = function() { resolve(frame); }; |
| + document.body.appendChild(frame); |
| + }); |
| +} |
| + |
| +var lastCallbackId = 0; |
| +var callbacks = {}; |
| +function postMassageAndWaitResult(frame) { |
| + return new Promise(function(resolve) { |
| + var id = ++lastCallbackId; |
| + callbacks[id] = resolve; |
| + frame.contentWindow.postMessage({id:id}, '*'); |
| + }); |
| +} |
| + |
| +window.onmessage = function (e) { |
| + message = e.data; |
| + var id = message['id']; |
| + var calback = callbacks[id]; |
| + delete callbacks[id]; |
| + calback(message['result']); |
| +}; |
| + |
| +async_test(function(t) { |
|
nhiroki
2015/06/24 02:48:17
promise_test?
horo
2015/06/24 03:39:20
Done.
|
| + var url = 'resources/sandboxed-iframe-navigator-serviceworker-iframe.html'; |
| + var frame; |
| + with_iframe(url) |
| + .then(function(f) { |
| + frame = f; |
| + return postMassageAndWaitResult(f); |
| + }) |
| + .then(function(result) { |
| + frame.remove(); |
| + assert_equals(result, 'ok'); |
| + t.done(); |
| + }) |
| + .catch(unreached_rejection(t)); |
| + }, 'Accessing navigator.serviceWorker in normal iframe should not throw.'); |
| + |
| +async_test(function(t) { |
| + var url = 'resources/sandboxed-iframe-navigator-serviceworker-iframe.html'; |
| + var frame; |
| + with_sandboxed_iframe(url, 'allow-scripts') |
| + .then(function(f) { |
| + frame = f; |
| + return postMassageAndWaitResult(f); |
| + }) |
| + .then(function(result) { |
| + frame.remove(); |
| + assert_equals( |
| + result, |
| + 'SecurityError: Failed to read the \'serviceWorker\' property from \'Navigator\': Service worker is disabled because the context is sandboxed and lacks the \'allow-same-origin\' flag.'); |
| + t.done(); |
| + }) |
| + .catch(unreached_rejection(t)); |
| + }, 'Accessing navigator.serviceWorker in sandboxed iframe should throw.'); |
| + |
| +async_test(function(t) { |
| + var url = 'resources/sandboxed-iframe-navigator-serviceworker-iframe.html'; |
| + var frame; |
| + with_sandboxed_iframe(url, 'allow-scripts allow-same-origin') |
| + .then(function(f) { |
| + frame = f; |
| + return postMassageAndWaitResult(f); |
| + }) |
| + .then(function(result) { |
| + frame.remove(); |
| + assert_equals(result, 'ok'); |
| + t.done(); |
| + }) |
| + .catch(unreached_rejection(t)); |
| + }, 'Accessing navigator.serviceWorker in sandboxed iframe with allow-same-origin flag should not throw.'); |
|
nhiroki
2015/06/24 02:48:17
nit: Can you wrap this at 80 column?
horo
2015/06/24 03:39:20
Done.
|
| + |
| +</script> |
| +</body> |
