third_party/WebKit/LayoutTests/http/tests/security/view-source-navigation-block.html - Issue 1917073002: Block webpages from navigating to view-source URLs

Side by Side Diff: third_party/WebKit/LayoutTests/http/tests/security/view-source-navigation-block.html

Issue 1917073002: Block webpages from navigating to view-source URLs (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master

Patch Set: Add layout and browser tests Created 4 years, 6 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

« content/public/test/content_browser_test_utils.cc ('K') | « content/renderer/render_thread_impl.cc ('k') | third_party/WebKit/LayoutTests/http/tests/security/view-source-navigation-block-expected.txt » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
(Empty)
	1 <html lang="en">

	2 <head>

	3 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">

	4 <title>view-source navigation should be blocked</title>

	5 </head>

	6 <script>

	7 window.onunload = function() {

	8 console.error('FAIL');

	9 testRunner.notifyDone();
	Nate Chapin 2016/05/27 23:57:32 Nit: if (window.testRunner) Nit: if (window.testRunner)
	10 }

	11 function test() {

	12 window.location = "view-source:about:blank";

	13 setTimeout(function() {

	14 if (window.testRunner) {

	15 document.getElementById("result").innerHTML = "PASS";

	16 testRunner.notifyDone();

	17 }

	18 }, 1000);
	meacer 2016/05/23 23:57:47 This is ugly as it uses setTimeout with a non-zero This is ugly as it uses setTimeout with a non-zero value, but I can't find a better way to check that a navigation doesn't complete. Happy to change to something nicer. Charlie Reis 2016/05/24 22:54:17 Yeah, we shouldn't do this. Maybe there's an erro Show quoted text On 2016/05/23 23:57:47, Mustafa Emre Acer wrote: > This is ugly as it uses setTimeout with a non-zero value, but I can't find a > better way to check that a navigation doesn't complete. Happy to change to > something nicer. Yeah, we shouldn't do this. Maybe there's an error event we can listen for? Nate might know. Nate Chapin 2016/05/27 23:57:32 This is a bit tougher because it's view-source. No Show quoted text On 2016/05/24 22:54:17, Charlie Reis wrote: > On 2016/05/23 23:57:47, Mustafa Emre Acer wrote: > > This is ugly as it uses setTimeout with a non-zero value, but I can't find a > > better way to check that a navigation doesn't complete. Happy to change to > > something nicer. > > Yeah, we shouldn't do this. Maybe there's an error event we can listen for? > Nate might know. This is a bit tougher because it's view-source. Normally I'd say to navigate to pass-and-notify-done.html, but its script won't run if it's view-source'ed. :) Instead of using waitUntilDone/notifyDone, you could use testRunner.queueLoad(). The test won't complete while a queued load hasn't completed, so you could have this page just display PASS, and try to navigationt to view-source:fail.html or similar. It might work to just drop the waitUntilDone/notifyDone calls, too, I can't remember if setting window.location before the load event is guaranteed to block test completion. meacer 2016/05/31 23:57:54 Looks like queueLoad triggers a browser initiated Show quoted text On 2016/05/27 23:57:32, Nate Chapin wrote: > On 2016/05/24 22:54:17, Charlie Reis wrote: > > On 2016/05/23 23:57:47, Mustafa Emre Acer wrote: > > > This is ugly as it uses setTimeout with a non-zero value, but I can't find a > > > better way to check that a navigation doesn't complete. Happy to change to > > > something nicer. > > > > Yeah, we shouldn't do this. Maybe there's an error event we can listen for? > > Nate might know. > > This is a bit tougher because it's view-source. Normally I'd say to navigate to > pass-and-notify-done.html, but its script won't run if it's view-source'ed. :) > > Instead of using waitUntilDone/notifyDone, you could use testRunner.queueLoad(). > The test won't complete while a queued load hasn't completed, so you could have > this page just display PASS, and try to navigationt to view-source:fail.html or > similar. > > It might work to just drop the waitUntilDone/notifyDone calls, too, I can't > remember if setting window.location before the load event is guaranteed to block > test completion. Looks like queueLoad triggers a browser initiated navigation, so it's not helping here. Unfortunately removing waitUntilDone/notifyDone doesn't work either, the test finishes before the console message is printed (hence the setTimeout in my original case). Do we have something that does queueContentInitiatedLoad()? Should we introduce one? Charlie Reis 2016/06/01 22:59:51 Do we actually need a layout test for this? You'v Show quoted text On 2016/05/31 23:57:54, Mustafa Emre Acer wrote: > On 2016/05/27 23:57:32, Nate Chapin wrote: > > On 2016/05/24 22:54:17, Charlie Reis wrote: > > > On 2016/05/23 23:57:47, Mustafa Emre Acer wrote: > > > > This is ugly as it uses setTimeout with a non-zero value, but I can't find > a > > > > better way to check that a navigation doesn't complete. Happy to change to > > > > something nicer. > > > > > > Yeah, we shouldn't do this. Maybe there's an error event we can listen for? > > > > Nate might know. > > > > This is a bit tougher because it's view-source. Normally I'd say to navigate > to > > pass-and-notify-done.html, but its script won't run if it's view-source'ed. :) > > > > Instead of using waitUntilDone/notifyDone, you could use > testRunner.queueLoad(). > > The test won't complete while a queued load hasn't completed, so you could > have > > this page just display PASS, and try to navigationt to view-source:fail.html > or > > similar. > > > > It might work to just drop the waitUntilDone/notifyDone calls, too, I can't > > remember if setting window.location before the load event is guaranteed to > block > > test completion. > > Looks like queueLoad triggers a browser initiated navigation, so it's not > helping here. > > Unfortunately removing waitUntilDone/notifyDone doesn't work either, the test > finishes before the console message is printed (hence the setTimeout in my > original case). > > Do we have something that does queueContentInitiatedLoad()? Should we introduce > one? Do we actually need a layout test for this? You've already added browser_test coverage for renderer-initiated navigations, which should cover the same thing. I'd suggest proceeding without it unless there's a reason I'm missing.
	19 }

	20 if (window.testRunner) {

	21 testRunner.dumpAsText();

	22 testRunner.waitUntilDone();

	23 }

	24 document.addEventListener('DOMContentLoaded', test, false);

	25 </script>

	26 <div id="result"></div>

	27 </html>

OLD	NEW