Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(143)

Side by Side Diff: LayoutTests/http/tests/security/xss-DENIED-iframe-src-alias.html

Issue 253843002: Deprecate Attr.nodeValue / Attr.textContent (Closed) Base URL: svn://svn.chromium.org/blink/trunk
Patch Set: Rebaseline more tests Created 6 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 <html> 1 <html>
2 <head> 2 <head>
3 <script> 3 <script>
4 window.onload = function() 4 window.onload = function()
5 { 5 {
6 if (window.testRunner) { 6 if (window.testRunner) {
7 testRunner.dumpAsText(); 7 testRunner.dumpAsText();
8 } 8 }
9 9
10 function alertMsg(msg) { 10 function alertMsg(msg) {
11 return "javascript:alert(\"FAIL: " + msg + 11 return "javascript:alert(\"FAIL: " + msg +
12 "\");document.body.innerHTML=\"<p style='font-weight:bold;color:red' >Failure testing " + msg + "</p>\";//"; 12 "\");document.body.innerHTML=\"<p style='font-weight:bold;color:red' >Failure testing " + msg + "</p>\";//";
13 } 13 }
14 // Test different ways of setting iframe.src 14 // Test different ways of setting iframe.src
15 var aliasTests = [ 15 var aliasTests = [
16 // Attr/Node attributes 16 // Attr/Node attributes
17 function(iFrame) { iFrame.attributes['src'].value = alertMsg("value"); i Frame.src = iFrame.src;}, 17 function(iFrame) { iFrame.attributes['src'].value = alertMsg("value"); i Frame.src = iFrame.src;},
18 function(iFrame) { iFrame.attributes['src'].textContent = alertMsg("text Content");},
19 function(iFrame) { iFrame.attributes['src'].nodeValue = alertMsg("nodeVa lue");},
20 18
21 // Text Node Manipulation 19 // Text Node Manipulation
22 function(iFrame) { iFrame.attributes['src'].firstChild.replaceWholeText( alertMsg("nodeValue"));}, 20 function(iFrame) { iFrame.attributes['src'].firstChild.replaceWholeText( alertMsg("nodeValue"));},
23 function(iFrame) { iFrame.attributes['src'].firstChild.data = alertMsg(" nodeValue");}, 21 function(iFrame) { iFrame.attributes['src'].firstChild.data = alertMsg(" nodeValue");},
24 22
25 // Node attribute manipulation functions 23 // Node attribute manipulation functions
26 function(iFrame) { iFrame.setAttribute("src", alertMsg("setAttribute")); }, 24 function(iFrame) { iFrame.setAttribute("src", alertMsg("setAttribute")); },
27 function(iFrame) { iFrame.setAttributeNS(null, "src", alertMsg("setAttri buteNS"));}, 25 function(iFrame) { iFrame.setAttributeNS(null, "src", alertMsg("setAttri buteNS"));},
28 function(iFrame) { 26 function(iFrame) {
29 var a = document.createAttribute('src'); 27 var a = document.createAttribute('src');
30 a.nodeValue = alertMsg("setAttributeNode"); 28 a.value = alertMsg("setAttributeNode");
31 iFrame.setAttributeNode(a); 29 iFrame.setAttributeNode(a);
32 }, 30 },
33 // Child manipulation methods 31 // Child manipulation methods
34 function(iFrame) { 32 function(iFrame) {
35 var src = iFrame.attributes['src']; 33 var src = iFrame.attributes['src'];
36 src.appendChild(document.createTextNode(alertMsg("appendChild() + re moveChild()"))); 34 src.appendChild(document.createTextNode(alertMsg("appendChild() + re moveChild()")));
37 src.removeChild(src.firstChild); 35 src.removeChild(src.firstChild);
38 }, 36 },
39 function(iFrame) { 37 function(iFrame) {
40 var src = iFrame.attributes['src']; 38 var src = iFrame.attributes['src'];
(...skipping 13 matching lines...) Expand all
54 src.appendChild(document.createTextNode(msg.slice(0,4))); 52 src.appendChild(document.createTextNode(msg.slice(0,4)));
55 src.appendChild(document.createTextNode(msg.slice(4))); 53 src.appendChild(document.createTextNode(msg.slice(4)));
56 }, 54 },
57 function(iFrame) { 55 function(iFrame) {
58 var src = iFrame.attributes['src']; 56 var src = iFrame.attributes['src'];
59 src.insertBefore(document.createTextNode(alertMsg("insertBefore()")) , src.firstChild); 57 src.insertBefore(document.createTextNode(alertMsg("insertBefore()")) , src.firstChild);
60 }, 58 },
61 // NamedNodeMap 59 // NamedNodeMap
62 function(iFrame) { 60 function(iFrame) {
63 var a = document.createAttribute('src'); 61 var a = document.createAttribute('src');
64 a.nodeValue = alertMsg("setNamedItem()"); 62 a.value = alertMsg("setNamedItem()");
65 iFrame.attributes.setNamedItem(a); 63 iFrame.attributes.setNamedItem(a);
66 }, 64 },
67 function(iFrame) { 65 function(iFrame) {
68 var a = document.createAttribute('src'); 66 var a = document.createAttribute('src');
69 a.nodeValue = alertMsg("setNamedItemNS()"); 67 a.value = alertMsg("setNamedItemNS()");
70 iFrame.attributes.setNamedItemNS(a); 68 iFrame.attributes.setNamedItemNS(a);
71 } 69 }
72 ]; 70 ];
73 71
74 function makeOnloadHandler (idx, tgtFrame) { 72 function makeOnloadHandler (idx, tgtFrame) {
75 return function() { 73 return function() {
76 tgtFrame.onload = null; 74 tgtFrame.onload = null;
77 try { 75 try {
78 aliasTests[idx](tgtFrame); 76 aliasTests[idx](tgtFrame);
79 } catch (e) {} 77 } catch (e) {}
(...skipping 12 matching lines...) Expand all
92 } 90 }
93 91
94 </script> 92 </script>
95 </head> 93 </head>
96 <body> 94 <body>
97 <p>This script tests if iframe.src can be set to a JavaScript URL via alternate 95 <p>This script tests if iframe.src can be set to a JavaScript URL via alternate
98 DOM interfaces (such as Node.textContent or NamedNode.setNamedItem). 96 DOM interfaces (such as Node.textContent or NamedNode.setNamedItem).
99 The test is successful if no alerts appear and the page finishes loading.</p> 97 The test is successful if no alerts appear and the page finishes loading.</p>
100 </body> 98 </body>
101 </html> 99 </html>
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698