| OLD | NEW |
|---|
| (Empty) | |
| 1 <!DOCTYPE html> |
| 2 <html> |
| 3 |
| 4 <head> |
| 5 <!-- Programmatically converted from a WebKit Reftest, please forgive result
ing idiosyncracies.--> |
| 6 <title>frame-src-cross-origin-load</title> |
| 7 <script src="/resources/testharness.js"></script> |
| 8 <script src="/resources/testharnessreport.js"></script> |
| 9 <script src='../support/logTest.sub.js?logs=["PASS IFrame %231 generated a l
oad event.","PASS IFrame %232 generated a load event.","PASS IFrame %233 generat
ed a load event."]'></script> |
| 10 <script> |
| 11 window.addEventListener("message", function(event) { |
| 12 alert_assert(event.data); |
| 13 }, false); |
| 14 |
| 15 var t_alert = async_test('Expecting alerts: ["PASS","PASS"]'); |
| 16 var expected_alerts = ["PASS", "PASS"]; |
| 17 |
| 18 function alert_assert(msg) { |
| 19 t_alert.step(function() { |
| 20 if (msg.match(/^FAIL/i)) { |
| 21 assert_unreached(msg); |
| 22 t_alert.done(); |
| 23 } |
| 24 for (var i = 0; i < expected_alerts.length; i++) { |
| 25 if (expected_alerts[i] == msg) { |
| 26 assert_true(expected_alerts[i] == msg); |
| 27 expected_alerts.splice(i, 1); |
| 28 if (expected_alerts.length == 0) { |
| 29 t_alert.done(); |
| 30 } |
| 31 return; |
| 32 } |
| 33 } |
| 34 assert_unreached('unexpected alert: ' + msg); |
| 35 t_alert.done(); |
| 36 }); |
| 37 } |
| 38 |
| 39 </script> |
| 40 <!-- enforcing policy: |
| 41 frame-src 'self' http://www1.{{host}}:{{ports[http][0]}}; script-src 'self' 'uns
afe-inline'; connect-src 'self'; |
| 42 --> |
| 43 <p> |
| 44 IFrames blocked by CSP should generate a 'load', not 'error' event, rega
rdless of blocked state. This means they appear to be normal cross-origin loads,
thereby not leaking URL information directly to JS. |
| 45 </p> |
| 46 <script> |
| 47 window.wasPostTestScriptParsed = true; |
| 48 var loads = 0; |
| 49 |
| 50 function loadEvent() { |
| 51 loads++; |
| 52 log("PASS " + "IFrame #" + loads + " generated a load event."); |
| 53 } |
| 54 |
| 55 </script> |
| 56 </head> |
| 57 |
| 58 <body> |
| 59 <iframe src="resources/postmessage-pass.html" onload="loadEvent()"></iframe> |
| 60 <iframe src="http://www1.{{host}}:{{ports[http][0]}}/content-security-policy
/blink-contrib/resources/postmessage-pass.html" onload="loadEvent()"></iframe> |
| 61 <iframe src="http://www2.{{host}}:{{ports[http][0]}}/content-security-policy
/blink-contrib/resources/postmessage-fail.html" onload="loadEvent()" onerror="lo
g('FAIL')"></iframe> |
| 62 <div id="log"></div> |
| 63 <script async defer src="../support/checkReport.sub.js?reportExists=true&
;reportField=violated-directive&reportValue=frame-src%20'self'http
://www1.{{host}}:{{ports[http][0]}}"></script> |
| 64 </body> |
| 65 |
| 66 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2704543002:
Import wpt@3bd204d7e86fd81e98e63f4ce59b95d98bad1c54 (Closed)
