Index: Source/web/tests/WebFrameTest.cpp |
diff --git a/Source/web/tests/WebFrameTest.cpp b/Source/web/tests/WebFrameTest.cpp |
index 092bead1c60da397956adfc24db471dd7a533000..c03922caf383c0d5a2ab84d3457a1d6476081135 100644 |
--- a/Source/web/tests/WebFrameTest.cpp |
+++ b/Source/web/tests/WebFrameTest.cpp |
@@ -41,6 +41,7 @@ |
#include "core/css/resolver/ViewportStyleResolver.h" |
#include "core/dom/DocumentMarkerController.h" |
#include "core/dom/FullscreenElementStack.h" |
+#include "core/dom/NodeRenderStyle.h" |
#include "core/dom/Range.h" |
#include "core/editing/Editor.h" |
#include "core/editing/FrameSelection.h" |
@@ -4338,6 +4339,27 @@ TEST_F(WebFrameTest, MoveCaretSelectionTowardsWindowPointWithNoSelection) |
frame->moveCaretSelection(WebPoint(0, 0)); |
} |
+TEST_F(WebFrameTest, NavigateToSandboxedMarkup) |
+{ |
+ FrameTestHelpers::WebViewHelper webViewHelper; |
+ WebViewImpl* webViewImpl = webViewHelper.initializeAndLoad("about:blank", true); |
+ WebLocalFrameImpl* frame = toWebLocalFrameImpl(webViewHelper.webView()->mainFrame()); |
+ |
+ frame->document().setIsTransitionDocument(); |
+ |
+ std::string markup("<div id='foo'></div><script>document.getElementById('foo').setAttribute('dir', 'rtl')</script>"); |
+ frame->navigateToSandboxedMarkup(WebData(markup.data(), markup.length())); |
+ FrameTestHelpers::runPendingTasks(); |
+ |
+ WebDocument document = webViewImpl->mainFrame()->document(); |
+ WebElement transitionElement = document.getElementById("foo"); |
+ // Check that the markup got navigated to successfully. |
+ EXPECT_FALSE(transitionElement.isNull()); |
+ |
+ // Check that the inline script was not executed. |
+ EXPECT_FALSE(transitionElement.hasAttribute("dir")); |
+} |
+ |
class SpellCheckClient : public WebSpellCheckClient { |
public: |
explicit SpellCheckClient(uint32_t hash = 0) : m_numberOfTimesChecked(0), m_hash(hash) { } |