CSP Suborigins

LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-blocked-in-http-header.html

Index: LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-blocked-in-http-header.html
diff --git a/LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-blocked-in-http-header.html b/LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-blocked-in-http-header.html
new file mode 100644
index 0000000000000000000000000000000000000000..8647aa00fa196c03a107ef68cadd238f74e7ef25
--- /dev/null
+++ b/LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-blocked-in-http-header.html
@@ -0,0 +1,21 @@
+<script>
+if (window.testRunner) {
+    testRunner.waitUntilDone();
+    testRunner.dumpAsText();
+}
+
+function iframeLoaded() {
+    var iframe = document.getElementById('iframe');
+    try {
+        var secret = iframe.contentWindow.secret;
+        alert("FAIL: Secret is '" + secret + "'.");
+    } catch(e) {
+        alert('PASS: Prevented from accessing the content of the iframe in a different suborigin.');
+    }
+    testRunner.notifyDone();
+}
+</script>
+<p>
+This tests whether a frame is prevented from accessing secrets in a frame in a different suborigin.
+</p>
+<iframe onload="iframeLoaded();" id="iframe" src="resources/suborigin.php?suborigin=foobar"></iframe>

[Mike West, 2014/10/23 12:59:18]

As a general note, I'd suggest postMessaging the frame's loaded status up to the
parent.

[jww, 2015/03/20 22:50:02]

Done.