| OLD | NEW |
|---|
| 1 <pre id="iframe1-srcdoc" style="display: none;"> |
| 2 <script> |
| 3 try { |
| 4 top.navigator; |
| 5 console.log('FAIL'); |
| 6 } catch (e) { |
| 7 console.log("iframe1: " + e.toString()); |
| 8 } |
| 9 this.x = 7; |
| 10 window.name = 'navigator'; |
| 11 try { |
| 12 top.navigator; |
| 13 console.log('FAIL'); |
| 14 } catch (e) { |
| 15 console.log("iframe1: " + e.toString()); |
| 16 } |
| 17 </script> |
| 18 </pre> |
| 19 |
| 20 <pre id="iframe2-srcdoc" style="display: none;"> |
| 21 <script> |
| 22 try { |
| 23 top.navigator; |
| 24 console.log('FAIL'); |
| 25 } catch (e) { |
| 26 console.log("iframe2: " + e.toString()); |
| 27 } |
| 28 </script> |
| 29 </pre> |
| 30 |
| 1 <script> | 31 <script> |
| 2 if (window.testRunner) | 32 if (window.testRunner) |
| 3 testRunner.dumpAsText(); | 33 testRunner.dumpAsText(); |
| 34 |
| 35 function createIFrame(srcdoc) { |
| 36 var iframe = document.createElement('iframe'); |
| 37 iframe.sandbox = "allow-scripts"; |
| 38 iframe.srcdoc = srcdoc; |
| 39 return iframe; |
| 40 } |
| 41 |
| 42 var iframe1 = createIFrame( |
| 43 document.getElementById('iframe1-srcdoc').textContent); |
| 44 var iframe2 = createIFrame( |
| 45 document.getElementById('iframe2-srcdoc').textContent); |
| 46 |
| 47 iframe1.addEventListener('load', () => { |
| 48 document.body.appendChild(iframe2); |
| 49 }, false); |
| 50 document.body.appendChild(iframe1); |
| 4 </script> | 51 </script> |
| 5 <iframe | |
| 6 sandbox="allow-scripts" | |
| 7 srcdoc=" | |
| 8 <script> | |
| 9 try { | |
| 10 top.navigator; | |
| 11 console.log('FAIL'); | |
| 12 } catch (e) { | |
| 13 console.log(e.toString()); | |
| 14 } | |
| 15 this.x = 7; | |
| 16 window.name = 'navigator'; | |
| 17 try { | |
| 18 top.navigator; | |
| 19 console.log('FAIL'); | |
| 20 } catch (e) { | |
| 21 console.log(e.toString()); | |
| 22 } | |
| 23 </script>" | |
| 24 ></iframe> | |
| 25 <iframe | |
| 26 sandbox="allow-scripts" | |
| 27 srcdoc=" | |
| 28 <script> | |
| 29 try { | |
| 30 top.navigator; | |
| 31 console.log('FAIL'); | |
| 32 } catch (e) { | |
| 33 console.log(e.toString()); | |
| 34 } | |
| 35 </script>" | |
| 36 ></iframe> | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2800053003:
v8binding: Makes xss-DENIED-window-name-navigator deterministic. (Closed)
