| OLD | NEW |
|---|
| 1 <html> | 1 <html> |
| 2 <head> | 2 <head> |
| 3 <script> | 3 <script> |
| 4 if (window.layoutTestController) { | 4 if (window.layoutTestController) { |
| 5 layoutTestController.waitUntilDone(); | 5 layoutTestController.waitUntilDone(); |
| 6 layoutTestController.dumpAsText(); | 6 layoutTestController.dumpAsText(); |
| 7 } | 7 } |
| 8 | 8 |
| 9 window.onload = function() | 9 window.onload = function() |
| 10 { | 10 { |
| 11 object = document.createElement("object"); | 11 object = document.createElement("object"); |
| 12 object.data = "http://localhost:8000/security/resources/innocent-victim.html
"; | 12 object.data = "http://localhost:8000/security/resources/innocent-victim.html
"; |
| 13 document.body.appendChild(object); | 13 document.body.appendChild(object); |
| 14 object.onload = function() { | 14 object.onload = function() { |
| 15 object.onload = null; | 15 object.onload = null; |
| 16 object.data = "javascript:alert(document.body.innerHTML)"; | 16 object.data = "javascript:alert(document.body.innerHTML)"; |
| 17 object.innerHTML = "foo"; | 17 object.innerHTML = "foo"; |
| 18 | 18 |
| 19 if (window.layoutTestController) | 19 if (window.layoutTestController) |
| 20 setTimeout("layoutTestController.notifyDone()", 50); | 20 setTimeout("layoutTestController.notifyDone()", 50); |
| 21 } | 21 } |
| 22 } | 22 } |
| 23 </script> | 23 </script> |
| 24 </head> | 24 </head> |
| 25 <body> | 25 <body> |
| 26 There should be no alert displayed. | 26 There should be no alert displayed. |
| 27 </body> | 27 </body> |
| 28 </html> | 28 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 8206005:
Merge 96826 - Add check for JavaScript URLs in HTMLPlugInImageElement::allowedToLoadFrameURL (Closed)
Base URL: http://svn.webkit.org/repository/webkit/branches/chromium/874/