| OLD | NEW | 
| (Empty) |  | 
 |   1 <?php | 
 |   2 header("Content-Security-Policy: suborigin foobar1"); | 
 |   3 ?> | 
 |   4 <!DOCTYPE html> | 
 |   5 <html> | 
 |   6 <head> | 
 |   7 <title>Block a frame in one suborigin from accessing another suborigin</title> | 
 |   8 <script src="/resources/testharness.js"></script> | 
 |   9 <script src="/resources/testharnessreport.js"></script> | 
 |  10 </head> | 
 |  11 <script> | 
 |  12 window.onmessage = function() { | 
 |  13     var iframe = document.getElementById('iframe'); | 
 |  14     var secret = ''; | 
 |  15     try { | 
 |  16         secret = iframe.contentWindow.secret; | 
 |  17         assert_unreached(); | 
 |  18         done(); | 
 |  19     } catch(e) { | 
 |  20         assert_equals(secret, "", "The parent frame should not be able to get th
    e secret value from the child iframe."); | 
 |  21         done(); | 
 |  22     }; | 
 |  23 }; | 
 |  24 </script> | 
 |  25 <iframe id="iframe" src="resources/childsuborigin.php?suborigin=foobar2"></ifram
    e> | 
 |  26 </html> | 
| OLD | NEW |