| OLD | NEW |
|---|
| (Empty) | |
| 1 <!DOCTYPE html> |
| 2 <html> |
| 3 <head> |
| 4 <title>child-src-blocked</title> |
| 5 <script src="/resources/testharness.js"></script> |
| 6 <script src="/resources/testharnessreport.js"></script> |
| 7 <script src='../support/logTest.sub.js?logs=["PASS IFrame %231 generated a l
oad event."]'></script> |
| 8 <script> |
| 9 window.addEventListener("message", function(event) { |
| 10 alert_assert(event.data); |
| 11 }, false); |
| 12 |
| 13 function alert_assert(msg) { |
| 14 t_log.step(function() { |
| 15 if (msg.match(/^FAIL/i)) { |
| 16 assert_unreached(msg); |
| 17 t_log.done(); |
| 18 } |
| 19 for (var i = 0; i < expected_alerts.length; i++) { |
| 20 if (expected_alerts[i] == msg) { |
| 21 assert_true(expected_alerts[i] == msg); |
| 22 expected_alerts.splice(i, 1); |
| 23 if (expected_alerts.length == 0) { |
| 24 t_log.done(); |
| 25 } |
| 26 return; |
| 27 } |
| 28 } |
| 29 assert_unreached('unexpected alert: ' + msg); |
| 30 t_log.done(); |
| 31 }); |
| 32 } |
| 33 |
| 34 </script> |
| 35 <!-- enforcing policy: |
| 36 frame-src 'none'; child-src 'self'; script-src 'self' 'unsafe-inline'; connect-s
rc 'self'; |
| 37 --> |
| 38 <p> |
| 39 A more permissive child-src should not relax restrictions from a less- |
| 40 permissive frame-src. Directives still combine for least privilege, eve
n when |
| 41 one obsoletes another. |
| 42 </p> |
| 43 <script> |
| 44 window.wasPostTestScriptParsed = true; |
| 45 var loads = 0; |
| 46 |
| 47 function loadEvent() { |
| 48 loads++; |
| 49 log("PASS " + "IFrame #" + loads + " generated a load event."); |
| 50 } |
| 51 |
| 52 </script> |
| 53 </head> |
| 54 |
| 55 <body> |
| 56 <iframe src="/content-security-policy/blink-contrib/resources/postmessage-fa
il.html" onload="loadEvent()" onerror="log('FAIL')"></iframe> |
| 57 <div id="log"></div> |
| 58 <script async defer src="../support/checkReport.sub.js?reportExists=true&
;reportField=violated-directive&reportValue=frame-src%20'none'"></
script> |
| 59 </body> |
| 60 |
| 61 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2695813009:
Import wpt@503f5b5f78ec4e87d144f78609f363f0ed0ea8db (Closed)
