| Index: LayoutTests/fast/xmlhttprequest/set-dangerous-headers-local.html
|
| diff --git a/LayoutTests/fast/xmlhttprequest/set-dangerous-headers-local.html b/LayoutTests/fast/xmlhttprequest/set-dangerous-headers-local.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..f2f3314e8c0f343998884e93d8cdbfb2aa4d7337
|
| --- /dev/null
|
| +++ b/LayoutTests/fast/xmlhttprequest/set-dangerous-headers-local.html
|
| @@ -0,0 +1,34 @@
|
| +<html>
|
| +<body>
|
| +<p>Test that setRequestHeader cannot be used to alter security-sensitive headers
|
| +for file:// urls.</p>
|
| +<pre id=result>FAIL: script didn't run or raised an unexpected exception.</pre>
|
| +
|
| +<script>
|
| +
|
| + if (window.testRunner)
|
| + testRunner.dumpAsText();
|
| +
|
| + if (window.location.href.indexOf("file://") != 0) {
|
| + document.getElementById("result").textContent =
|
| + "ERROR: Not running from file:// origin.";
|
| + } else {
|
| + req = new XMLHttpRequest;
|
| + req.open("GET", "resources/print-headers.cgi", false);
|
| +
|
| + req.setRequestHeader("REFERER", "foobar");
|
| +
|
| + try {
|
| + req.send("");
|
| + if (req.responseText.match("100-continue|foobar|123456"))
|
| + document.getElementById("result").textContent =
|
| + req.responseText;
|
| + else
|
| + document.getElementById("result").textContent = "SUCCESS";
|
| + } catch (ex) {
|
| + document.getElementById("result").textContent = ex;
|
| + }
|
| + }
|
| +</script>
|
| +</body>
|
| +</html>
|
|
|
Chromium Code Reviews
Issue 13979011:
Block all scripts from setting unsafe headers in XMLHttpRequest (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master