| OLD | NEW |
|---|
| 1 <!DOCTYPE HTML> | 1 <!DOCTYPE HTML> |
| 2 <html> | 2 <html> |
| 3 <head> | 3 <head> |
| 4 <title>Null frame access tests</title> | 4 <title>Null frame access tests</title> |
| 5 <script src="../../../resources/js-test.js"></script> | 5 <script src="../../../resources/testharness.js"></script> |
| 6 <script> | 6 <script src="../../../resources/testharnessreport.js"></script> |
| 7 description("This tests access to a window with a null frame. You should see \"P
ASS\" for each of the three tests below."); | |
| 8 | |
| 9 window.jsTestIsAsync = true; | |
| 10 window.onload = function() { | |
| 11 if (window.testRunner) { | |
| 12 testRunner.dumpAsText(); | |
| 13 testRunner.waitUntilDone(); | |
| 14 } | |
| 15 | |
| 16 var tag = document.getElementById('subframe'); | |
| 17 var win = tag.contentWindow; | |
| 18 // remove the element so the window has a null frame | |
| 19 tag.parentNode.removeChild(tag); | |
| 20 | |
| 21 // schedule to run after the frame is null | |
| 22 asyncGC(function() { | |
| 23 debug("missing property: " + (win.test || 'PASS')) | |
| 24 debug("missing array index: " + (win[20] || 'PASS')); | |
| 25 debug("missing interface object: " + (win.Comment || 'PASS')); | |
| 26 finishJSTest(); | |
| 27 }); | |
| 28 }; | |
| 29 </script> | |
| 30 </head> | 7 </head> |
| 31 <body> | 8 <body> |
| 32 <iframe id="subframe" src="data:text/html,<script>window.test='FAIL ... ';
window[20]='FAIL ... ';</script>" /> | 9 <iframe></iframe/> |
| 10 <script> |
| 11 window[0].test = 'abc'; |
| 12 window[0][20] = 123; |
| 13 var childWindow = window[0]; |
| 14 window[0].frameElement.remove(); |
| 15 test(function() { |
| 16 // Removing the owner element from the DOM should null the frame. In Blink, |
| 17 // this can be observed by checking childWindow.parent == null. |
| 18 assert_equals(childWindow.parent, null); |
| 19 assert_equals(childWindow.test, 'abc'); |
| 20 }, 'Named property access on detached Window'); |
| 21 test(function() { |
| 22 // Removing the owner element from the DOM should null the frame. In Blink, |
| 23 // this can be observed by checking childWindow.parent == null. |
| 24 assert_equals(childWindow.parent, null); |
| 25 assert_equals(childWindow[20], '123', 'Indexed property should still be access
ible.'); |
| 26 }, 'Indexed property access on detached Window'); |
| 27 test(function() { |
| 28 // Removing the owner element from the DOM should null the frame. In Blink, |
| 29 // this can be observed by checking childWindow.parent == null. |
| 30 assert_equals(childWindow.parent, null); |
| 31 // TODO(dcheng): Why does this return null? |
| 32 assert_equals(childWindow.Comment, undefined, 'Interface Object should be gone
.'); |
| 33 }, 'Interface Object access on detached Window'); |
| 34 </script> |
| 33 </body> | 35 </body> |
| 34 </html> | 36 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2706923002:
Rework security checks to be based on Window rather than Frame. (Closed)
