Chromium Code Reviews Chromium Code Reviews
Issue 2678223002:
WPT test for reading Blob URLs minted in iframes w/ and w/o sandboxing. (Closed)
| Index: third_party/WebKit/LayoutTests/external/wpt/FileAPI/url/blob-url-in-sandboxed-iframe.html |
| diff --git a/third_party/WebKit/LayoutTests/external/wpt/FileAPI/url/blob-url-in-sandboxed-iframe.html b/third_party/WebKit/LayoutTests/external/wpt/FileAPI/url/blob-url-in-sandboxed-iframe.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..46c34c539caa1d0c2f16555a772ac92b836dd4b2 |
| --- /dev/null |
| +++ b/third_party/WebKit/LayoutTests/external/wpt/FileAPI/url/blob-url-in-sandboxed-iframe.html |
| @@ -0,0 +1,70 @@ |
| +<!doctype html> |
| +<meta charset="utf-8"> |
| +<title>FileAPI Test: Creating Blob URL with Blob</title> |
| +<link rel="author" title="Victor Costan" href="mailto:pwnall@chromium.org"> |
| +<link rel="help" href="https://w3c.github.io/FileAPI/#originOfBlobURL"> |
| +<link rel="help" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin"> |
| +<link rel="help" href="https://url.spec.whatwg.org/#url-parsing"> |
| +<link rel="help" href="https://fetch.spec.whatwg.org/#main-fetch"> |
| +<script src="/resources/testharness.js"></script> |
| +<script src="/resources/testharnessreport.js"></script> |
| + |
| +<style> |
| +iframe { width: 10px; height: 10px; } |
| +</style> |
| + |
| +<iframe id="unconstrained-iframe"></iframe> |
| +<iframe id="sandboxed-iframe" sandbox="allow-scripts"></iframe> |
| + |
| +<script id="iframe-srcdoc" language="text/html"> |
| +<!doctype html> |
| +<script> |
| +'use strict'; |
| + |
| +window.onload = () => { |
| + const blob = new Blob(['Hello world!']); |
| + const blobUrl = URL.createObjectURL(blob); |
| + |
| + fetch(blobUrl).then(response => response.text()).then(text => { |
| + window.parent.postMessage({ blobUrl, text }, '*'); |
| + }); |
| +}; |
| +// The script tag is closed in readBlobURL(). |
|
Marijn Kruisselbrink
2017/02/07 19:02:40
I think you meant readBlobFromUrl?
pwnall
2017/02/07 20:14:59
Yes, thank you for catching this!
|
| +</script> |
| + |
| +<script> |
| + |
| +// Carries out the test of minting a Blob URL in an iframe, and reading it back. |
| +// |
| +// Returns a promise resolved with an object with properties blobUrl and text |
| +// (the text read back from the Blob URL). |
| +function readBlobFromUrl(t, iframeSelector) { |
| + return new Promise((resolve, reject) => { |
| + window.onmessage = t.step_func((message) => { resolve(message.data); }); |
| + |
| + const frame = document.querySelector(iframeSelector); |
| + const html = document.querySelector('#iframe-srcdoc').textContent + |
| + '<' + '/script>'; |
| + frame.setAttribute('srcdoc', html); |
| + }); |
| +} |
| + |
| +promise_test(t => readBlobFromUrl(t, '#unconstrained-iframe').then(data => { |
| + assert_true(data.blobUrl.startsWith('blob:'), |
| + "The Blob's URL should use the blob: scheme"); |
| + assert_false(data.blobUrl.startsWith('blob:null/'), |
| + "The serialized origin in the Blob's URL should not be null"); |
| + assert_equals(data.text, 'Hello world!', |
| + "The result of reading the Blob's URL should be the Blob's contents"); |
| +}), 'reading a Blob URL in an unconstrained iframe'); |
| + |
| +promise_test(t => readBlobFromUrl(t, '#sandboxed-iframe').then(data => { |
| + assert_true(data.blobUrl.startsWith('blob:'), |
| + "The Blob's URL should use the blob: scheme"); |
| + assert_true(data.blobUrl.startsWith('blob:null/'), |
| + "The serialized origin in the Blob's URL should be null"); |
|
Marijn Kruisselbrink
2017/02/07 19:02:40
Note that the spec explicitly does not have any re
pwnall
2017/02/07 20:14:59
IIUC, https://html.spec.whatwg.org/multipage/brows
Marijn Kruisselbrink
2017/02/07 20:22:22
See https://w3c.github.io/FileAPI/#unicodeSerializ
pwnall
2017/02/08 01:35:55
Ah, thanks!
This bit is tricky! Do you think we c
|
| + assert_equals(data.text, 'Hello world!', |
| + "The result of reading the Blob's URL should be the Blob's contents"); |
| +}), 'reading a Blob URL in a sandboxed iframe without the same-origin flag'); |
| + |
| +</script> |
