third_party/WebKit/LayoutTests/bluetooth/requestDevice-sandboxed-iframe.html - Issue 1862953002: Disallow use of Web Bluetooth from cross-origin iframes.

Side by Side Diff: third_party/WebKit/LayoutTests/bluetooth/requestDevice-sandboxed-iframe.html

Issue 1862953002: Disallow use of Web Bluetooth from cross-origin iframes. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@lkcr

Patch Set: Created 4 years, 8 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

« content/browser/bluetooth/bluetooth_dispatcher_host.cc ('K') | « content/browser/bluetooth/bluetooth_dispatcher_host.cc ('k') | third_party/WebKit/Source/modules/bluetooth/BluetoothError.cpp » ('j') | url/origin.h » ('J')
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
1 <!DOCTYPE html>	1 <!DOCTYPE html>

2 <script src="../resources/testharness.js"></script>	2 <script src="../resources/testharness.js"></script>

3 <script src="../resources/testharnessreport.js"></script>	3 <script src="../resources/testharnessreport.js"></script>

4 <script src="resources/bluetooth-helpers.js"></script>	4 <script src="resources/bluetooth-helpers.js"></script>

5 <body>	5 <body>

6 <script>	6 <script>

7 "use strict";	7 "use strict";

8 async_test(test => {	8 async_test(test => {

9 window.onmessage = messageEvent => test.step(() => {	9 window.onmessage = messageEvent => test.step(() => {

10 if (messageEvent.data === 'Ready') {	10 if (messageEvent.data === 'Ready') {

11 let iframe = document.querySelector('iframe');	11 let iframe = document.querySelector('iframe');

12 callWithKeyDown(() => {	12 callWithKeyDown(() => {

13 iframe.contentWindow.postMessage('Go', '*');	13 iframe.contentWindow.postMessage('Go', '*');

14 });	14 });

15 } else {	15 } else {

16 assert_equals(messageEvent.data, 'SecurityError: requestDevice() ' +	16 assert_equals(messageEvent.data, 'SecurityError: requestDevice() ' +

17 'called from sandboxed or otherwise ' +	17 'called from cross-origin iframe.');
	Mike West 2016/04/06 06:06:59 Hrm. Can you talk about the trickyness a bit? Load Hrm. Can you talk about the trickyness a bit? Loading cross-origin frames is certainly possible. For example, you could load `http://127.0.0.1:8080/resources/requestDevice-in-sandboxed-iframe.html` or `https://example.test:8443/resources/requestDevice-in-sandboxed-iframe.html` if you'd like to actually test a cross-origin-but-not-sandboxed frame. I think that would be a good idea, since sandboxing has a lot of side-effects. Jeffrey Yasskin 2016/04/06 06:17:15 Yep, I'd missed those options. I'll write that tes Show quoted text On 2016/04/06 06:06:59, Mike West (OOO through 31st) wrote: > Hrm. Can you talk about the trickyness a bit? Loading cross-origin frames is > certainly possible. For example, you could load > `http://127.0.0.1:8080/resources/requestDevice-in-sandboxed-iframe.html` or > `https://example.test:8443/resources/requestDevice-in-sandboxed-iframe.html` if > you'd like to actually test a cross-origin-but-not-sandboxed frame. I think that > would be a good idea, since sandboxing has a lot of side-effects. Yep, I'd missed those options. I'll write that test tomorrow.
18 'unique origin.');

19 test.done();	18 test.done();

20 }	19 }

21 });	20 });

22 setBluetoothFakeAdapter('HeartRateAdapter')	21 setBluetoothFakeAdapter('HeartRateAdapter')

23 .then(() => {	22 .then(() => {

24 let iframe = document.createElement('iframe');	23 let iframe = document.createElement('iframe');

25 iframe.sandbox.add('allow-scripts');	24 iframe.sandbox.add('allow-scripts');

26 iframe.src = 'resources/requestDevice-in-sandboxed-iframe.html';	25 iframe.src = 'resources/requestDevice-in-sandboxed-iframe.html';

27 document.body.appendChild(iframe);	26 document.body.appendChild(iframe);

28 });	27 });

29 }, 'Request device from a unique origin. Should reject with SecurityError.');	28 }, 'Request device from a unique origin. Should reject with SecurityError.');

30 </script>	29 </script>

31 </body>	30 </body>

OLD	NEW