Chromium Code Reviews Chromium Code Reviews
Issue 2453093003:
child-src and frame-src CSP are not applicable when navigating a new window. (Closed)
| OLD | NEW |
|---|---|
| (Empty) | |
| 1 <head> | |
| 2 <meta http-equiv="Content-Security-Policy" content="frame-src 'none'"/> | |
| 3 </head> | |
| 4 <div id="container"> | |
| 5 <p>You should run this test in Test Runner</p> | |
| 6 <p>This is a regression test for https://crbug.com/658701</p> | |
| 7 </div> | |
| 8 <div id="log"></div> | |
| 9 <script src="/resources/testharness.js"></script> | |
| 10 <script src="/resources/testharnessreport.js"></script> | |
| 11 <iframe id="iframe" | |
| 12 srcdoc=" | |
| 13 <p>frame-src-vs-shift-click-FRAME.html: | |
| 14 <a id="test-anchor" | |
| 15 href="resources/frame-src-vs-shift-click-target.html" | |
| 16 >Test anchor</a> | |
| 17 </p> | |
| 18 "></iframe> | |
| 19 <script> | |
| 20 var test = async_test("Testing frame-src vs shift-click"); | |
| 21 | |
| 22 function concludeTest(data) | |
| 23 { | |
| 24 test.step(function() { | |
| 25 assert_equals( | |
| 26 data["window.location.href"], | |
| 27 'http://127.0.0.1:8000/security/contentSecurityPolicy/resources/fram e-src-vs-shift-click-target.html', | |
| 28 "Test should be finished from frame-src-vs-shift-click-target.html") ; | |
| 29 assert_equals( | |
| 30 data["history.length"], | |
| 31 1, | |
| 32 "frame-src-vs-shift-click-target.html should be in a fresh window"); | |
| 33 assert_true( | |
| 34 data["window.self == window.parent"], | |
| 35 "frame-src-vs-shift-click-target.html should be the main frame"); | |
| 36 }); | |
| 37 | |
| 38 document.getElementById('container').outerHTML = ''; | |
| 39 test.done(); | |
| 40 } | |
| 41 | |
| 42 if (window.testRunner) { | |
| 43 testRunner.setCanOpenWindows(true); | |
| 44 testRunner.setCloseRemainingWindowsWhenComplete(true); | |
| 45 | |
| 46 // Shift-clicking doesn't set window.opener, so we allow the new window | |
| 47 // to find the opener using the name being set below. | |
| 48 // TODO(lukasza): After fixing https://crbug.com/658386, the test will | |
| 49 // need to use another mechanism for communicating verification results | |
| 50 // (most likely OOPIF-replicated testRunner.setCustomTextOutput). | |
| 51 window.name = "mainTestWindow"; | |
| 52 window.addEventListener('message', function(e) { | |
| 53 concludeTest(e.data); | |
| 54 }); | |
| 55 | |
| 56 window.onload = function() { | |
| 57 var iframe = document.getElementById("iframe"); | |
| 58 var anchor = iframe.contentWindow.document.getElementById('test-anchor') ; | |
|
Mike West
2016/10/27 07:39:43
How does this work? you've set `frame-src 'none'`
Łukasz Anforowicz
2016/10/27 15:28:54
The subframe is populated via srcdoc attribute (no
| |
| 59 var x = iframe.offsetLeft + anchor.offsetLeft + 3; | |
| 60 var y = iframe.offsetTop + anchor.offsetTop + 3; | |
| 61 eventSender.dragMode = false; | |
| 62 eventSender.mouseMoveTo(x, y); | |
| 63 eventSender.mouseDown(0); | |
| 64 eventSender.mouseUp(0, ['shiftKey']); | |
| 65 }; | |
| 66 } | |
| 67 | |
| 68 </script> | |
| OLD | NEW |
