Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(248)

Side by Side Diff: LayoutTests/http/tests/security/window-named-proto.html

Issue 8020005: Merge 95488 - Named property confusion with __proto__ (Closed) Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/874/
Patch Set: Created 9 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 <script> 1 <script>
2 if (window.layoutTestController) { 2 if (window.layoutTestController) {
3 layoutTestController.dumpAsText(); 3 layoutTestController.dumpAsText();
4 layoutTestController.waitUntilDone(); 4 layoutTestController.waitUntilDone();
5 } 5 }
6 6
7 window.onload = function() 7 window.onload = function()
8 { 8 {
9 frame = document.body.appendChild(document.createElement("iframe")); 9 frame = document.body.appendChild(document.createElement("iframe"));
10 frame.src = "http://localhost:8080/security/resources/innocent-victim-with-i frame.html"; 10 frame.src = "http://localhost:8080/security/resources/innocent-victim-with-i frame.html";
11 frame.onload = function() { 11 frame.onload = function() {
12 frame.onload = null; 12 frame.onload = null;
13 13
14 frame.contentWindow[0].location = "data:text/html,<script>(" + function( ) { 14 frame.contentWindow[0].location = "data:text/html,<script>(" + function( ) {
15 15
16 setTimeout(function() { 16 setTimeout(function() {
17 if (window.layoutTestController) 17 if (window.layoutTestController)
18 layoutTestController.notifyDone(); 18 layoutTestController.notifyDone();
19 }, 0); 19 }, 0);
20 20
21 window.name = "__proto__"; 21 window.name = "__proto__";
22 parent.__proto__.alert.constructor("alert(document.body.innerHTML)") (); 22 parent.__proto__.alert.constructor("alert(document.body.innerHTML)") ();
23 } + ")()</scr" + "ipt>"; 23 } + ")()</scr" + "ipt>";
24 } 24 }
25 } 25 }
26 </script> 26 </script>
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698