| Index: third_party/WebKit/LayoutTests/http/tests/serviceworker/insecure-parent-frame.html
|
| diff --git a/third_party/WebKit/LayoutTests/http/tests/serviceworker/insecure-parent-frame.html b/third_party/WebKit/LayoutTests/http/tests/serviceworker/insecure-parent-frame.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..98cdf66ffe3eb7fd27d78d3654bd89e218f06540
|
| --- /dev/null
|
| +++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/insecure-parent-frame.html
|
| @@ -0,0 +1,85 @@
|
| +<!DOCTYPE html>
|
| +<meta charset="utf-8">
|
| +<script src="../resources/testharness.js"></script>
|
| +<script src="../resources/testharnessreport.js"></script>
|
| +<script src="../resources/get-host-info.js?pipe=sub"></script>
|
| +<script src="resources/test-helpers.js"></script>
|
| +<title>Insecure parent frame test</title>
|
| +<body></body>
|
| +<script>
|
| +// Asks |worker| to call clients.claim. Returns a promise that resolves when
|
| +// the worker acks that claim finished.
|
| +function wait_for_claim(worker) {
|
| + var saw_message = new Promise(resolve => {
|
| + var channel = new MessageChannel();
|
| + channel.port1.onmessage = (e => resolve(e.data));
|
| + worker.postMessage({port: channel.port2}, [channel.port2]);
|
| + });
|
| +
|
| + return saw_message.then(data => {
|
| + assert_equals(data, 'PASS', 'claim should finish');
|
| + });
|
| +}
|
| +
|
| +// Asks |frame| whether it has a controller. Returns a promise that resolves
|
| +// if controller was null.
|
| +function assert_no_controller(frame, description) {
|
| + var saw_message = new Promise(resolve => {
|
| + window.onmessage = (e => resolve(e.data));
|
| + frame.contentWindow.postMessage('', '*');
|
| + });
|
| +
|
| + return saw_message.then(data => assert_equals(data, 'PASS', description));
|
| +}
|
| +
|
| +// This test creates https iframes inside insecure http iframes. It registers a
|
| +// service worker that should not control the in-scope iframes. The iframes
|
| +// communicate whether they have a controller to the top-level frame.
|
| +promise_test(t => {
|
| + var script = 'resources/claim-worker.js';
|
| + var scope = 'resources/insecure-inscope';
|
| + var registration;
|
| + var insecure_url = get_host_info().UNAUTHENTICATED_ORIGIN +
|
| + '/serviceworker/resources/insecure-parent.html';
|
| + var pre_registration_frame;
|
| + var post_registration_frame;
|
| +
|
| + return navigator.serviceWorker.getRegistration(scope)
|
| + // Unregister.
|
| + .then(reg => {
|
| + if (reg)
|
| + return reg.unregister();
|
| + })
|
| +
|
| + // Create an iframe prior to registration.
|
| + .then(() => with_iframe(insecure_url))
|
| +
|
| + // Register.
|
| + .then(frame => {
|
| + pre_registration_frame = frame;
|
| + add_result_callback(() => pre_registration_frame.remove());
|
| + return navigator.serviceWorker.register(script, {scope:scope});
|
| + })
|
| + .then(reg => {
|
| + registration = reg;
|
| + return wait_for_state(t, registration.installing, 'activated');
|
| + })
|
| +
|
| + // Create an iframe after registration.
|
| + .then(() => with_iframe(insecure_url))
|
| + .then(frame => post_registration_frame = frame)
|
| +
|
| + // Check that no frame is controlled.
|
| + .then(() => assert_no_controller(pre_registration_frame,
|
| + 'pre_registration_frame should not be controlled'))
|
| + .then(() => assert_no_controller(post_registration_frame,
|
| + 'post_registration_frame should not be controlled'))
|
| +
|
| + // Attempt to claim. The iframes should still have no controllers.
|
| + .then(() => wait_for_claim(registration.active))
|
| + .then(() => assert_no_controller(pre_registration_frame,
|
| + 'pre_registration_frame should not be claimed'))
|
| + .then(() => assert_no_controller(post_registration_frame,
|
| + 'post_registration_frame should not be claimed'));
|
| + }, 'Service worker does not control a subframe of an insecure frame');
|
| +</script>
|
|
|
Chromium Code Reviews
Issue 2061203002:
WIP Reland: service worker: Don't control a subframe of an insecure context
Base URL: https://chromium.googlesource.com/chromium/src.git@master