| OLD | NEW |
| 1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
| 2 <html> | 2 <html> |
| 3 <head> | 3 <head> |
| 4 <script src="/resources/testharness.js"></script> | 4 <script src="/resources/testharness.js"></script> |
| 5 <script src="/resources/testharnessreport.js"></script> | 5 <script src="/resources/testharnessreport.js"></script> |
| 6 </head> | 6 </head> |
| 7 <body> | 7 <body> |
| 8 <script> | 8 <script> |
| 9 async_test(function (t) { | 9 async_test(function (t) { |
| 10 var i = document.createElement('iframe'); | 10 var i = document.createElement('iframe'); |
| 11 i.src = "../../resources/frame-ancestors-and-x-frame-options.pl?poli
cy='self'&xfo=DENY"; | 11 i.src = "support/frame-ancestors-and-x-frame-options.sub.html?policy
='self'&xfo=DENY"; |
| 12 i.onload = t.step_func_done(function () { | 12 i.onload = t.step_func_done(function () { |
| 13 assert_equals(i.contentDocument.origin, document.origin, "The sa
me-origin page loaded."); | 13 assert_equals(i.contentDocument.origin, document.origin, "The sa
me-origin page loaded."); |
| 14 }); | 14 }); |
| 15 document.body.appendChild(i); | 15 document.body.appendChild(i); |
| 16 }, "A 'frame-ancestors' CSP directive overrides an 'x-frame-options' hea
der which would block the page."); | 16 }, "A 'frame-ancestors' CSP directive overrides an 'x-frame-options' hea
der which would block the page."); |
| 17 | 17 |
| 18 async_test(function (t) { | 18 async_test(function (t) { |
| 19 var i = document.createElement('iframe'); | 19 var i = document.createElement('iframe'); |
| 20 i.src = "../../resources/frame-ancestors-and-x-frame-options.pl?poli
cy=other-origin.com&xfo=SAMEORIGIN"; | 20 i.src = "support/frame-ancestors-and-x-frame-options.sub.html?policy
=other-origin.com&xfo=SAMEORIGIN"; |
| 21 i.onload = t.step_func_done(function () { | 21 i.onload = t.step_func_done(function () { |
| 22 assert_throws( | 22 assert_throws( |
| 23 "SecurityError", | 23 "SecurityError", |
| 24 function () { i.contentDocument.origin }, | 24 function () { i.contentDocument.origin }, |
| 25 "The same-origin page was blocked and sandboxed."); | 25 "The same-origin page was blocked and sandboxed."); |
| 26 }); | 26 }); |
| 27 document.body.appendChild(i); | 27 document.body.appendChild(i); |
| 28 }, "A 'frame-ancestors' CSP directive overrides an 'x-frame-options' hea
der which would allow the page."); | 28 }, "A 'frame-ancestors' CSP directive overrides an 'x-frame-options' hea
der which would allow the page."); |
| 29 </script> | 29 </script> |
| 30 </body> | 30 </body> |
| 31 </html> | 31 </html> |
| OLD | NEW |