| OLD | NEW |
|---|
| 1 <html> | 1 <html> |
| 2 <head> | 2 <head> |
| 3 <style> | 3 <style> |
| 4 iframe { width: 400px; height: 200px;} | 4 iframe { width: 400px; height: 200px;} |
| 5 </style> | 5 </style> |
| 6 <script> | 6 <script> |
| 7 if (window.testRunner) { | 7 if (window.testRunner) { |
| 8 testRunner.dumpAsText(); | 8 testRunner.dumpAsText(); |
| 9 testRunner.waitUntilDone(); | 9 testRunner.waitUntilDone(); |
| 10 } | 10 } |
| 11 | 11 |
| 12 function loaded() | 12 function loaded() |
| 13 { | 13 { |
| 14 document.getElementsByTagName('h4')[0].innerHTML = document.domain; | 14 document.getElementsByTagName('h4')[0].innerHTML = document.domain; |
| 15 var iframe = document.getElementById("i"); |
| 16 // The iframe uses eventSender to emulate a user navigatation, which
requires absolute coordinates. |
| 17 // Because the iframe is cross-origin, it can't get the offsets itse
lf, so leak them. |
| 18 frames[0].postMessage({x: iframe.offsetLeft, y: iframe.offsetTop}, "
*"); |
| 15 } | 19 } |
| 16 </script> | 20 </script> |
| 17 </head> | 21 </head> |
| 18 <body onload="loaded();"> | 22 <body onload="loaded();"> |
| 19 <p>This tests that documents can navigate the location of any of it's parent
-frames regardless of domain.</p> | 23 <p>This tests that documents can navigate the location of any of it's parent
-frames regardless of domain, if a |
| 24 user gesture is present.</p> |
| 20 <h4>DOMAIN</h4> | 25 <h4>DOMAIN</h4> |
| 21 <iframe src="http://localhost:8000/security/frameNavigation/resources/iframe
-that-performs-parent-navigation.html"></iframe> | 26 <iframe id="i" src="http://localhost:8000/security/frameNavigation/resources
/iframe-that-performs-parent-navigation.html"></iframe> |
| 22 </body> | 27 </body> |
| 23 </html> | 28 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2092293002:
Block framebusts without a user gesture (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master