Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-24 13:21:05 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1301138. Set the one allowed sandbox navigator even when popups are allowed to escape the sandbox, so the new popup can be navigated by the sandboxed document. r=smaug

Browse Source 
--HG--
rename : testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping.html => testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-1.html
rename : testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping.html => testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-2.html
rename : testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping.html => testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-3.html
rename : testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_helper.html => testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_helper-1.html
rename : testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_helper.html => testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_helper-2.html
rename : testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_helper.html => testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_helper-3.html
rename : testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping.html => testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-1.html
rename : testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping.html => testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-2.html
rename : testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping.html => testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-3.html
This commit is contained in:
Boris Zbarsky 2016-09-08 00:17:11 -04:00
parent bcf43cc08c
commit 2095bc6fba
11 changed files with 170 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
embedding/components/windowwatcher/nsWindowWatcher.cpp
View File

@ -1053,16 +1053,19 @@ nsWindowWatcher::OpenWindowInternal(mozIDOMWindowProxy* aParent,
nsCOMPtr<nsIDocShell> newDocShell(do_QueryInterface(newDocShellItem));
NS_ENSURE_TRUE(newDocShell, NS_ERROR_UNEXPECTED);
// If our parent is sandboxed, set it as the one permitted sandboxed navigator
// on the new window we're opening.
if (activeDocsSandboxFlags && parentWindow) {
newDocShell->SetOnePermittedSandboxedNavigator(
parentWindow->GetDocShell());
}
// Copy sandbox flags to the new window if activeDocsSandboxFlags says to do
// so. Note that it's only nonzero if the window is new, so clobbering
// sandbox flags on the window makes sense in that case.
if (activeDocsSandboxFlags &
SANDBOX_PROPAGATES_TO_AUXILIARY_BROWSING_CONTEXTS) {
newDocShell->SetSandboxFlags(activeDocsSandboxFlags);
if (parentWindow) {
newDocShell->SetOnePermittedSandboxedNavigator(
parentWindow->GetDocShell());
}
}
rv = ReadyOpenedDocShellItem(newDocShellItem, parentWindow, windowIsNew, aResult);

32
testing/web-platform/meta/MANIFEST.json
View File

@ -19486,12 +19486,12 @@
"url": "/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_allow_script.html"
},
{
"path": "html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping.html",
"url": "/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping.html"
"path": "html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-1.html",
"url": "/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-1.html"
},
{
"path": "html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping.html",
"url": "/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping.html"
"path": "html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-1.html",
"url": "/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-1.html"
},
{
"path": "html/semantics/embedded-content/the-iframe-element/move_iframe_in_dom_01.html",
@ -37806,6 +37806,30 @@
"url": "/html/browsers/history/the-location-interface/location-prototype-setting.html"
}
],
"html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-2.html": [
{
"path": "html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-2.html",
"url": "/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-2.html"
}
],
"html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-3.html": [
{
"path": "html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-3.html",
"url": "/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-3.html"
}
],
"html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-2.html": [
{
"path": "html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-2.html",
"url": "/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-2.html"
}
],
"html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-3.html": [
{
"path": "html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-3.html",
"url": "/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-3.html"
}
],
"html/semantics/forms/the-form-element/form-submission-sandbox.html": [
{
"path": "html/semantics/forms/the-form-element/form-submission-sandbox.html",

2
testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping.html → testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-1.html
View File

@ -19,7 +19,7 @@
assert_equals(e.data.origin, ourOrigin, "Should have escaped the sandbox");
});
document.querySelector("iframe").src = "iframe_sandbox_popups_helper.html";
document.querySelector("iframe").src = "iframe_sandbox_popups_helper-1.html";
});
postMessage("hello", "*");
</script>

31
testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-2.html Normal file
View File

@ -0,0 +1,31 @@
<!doctype html>
<meta charset=utf-8>
<title>Check that popups from a sandboxed iframe escape the sandbox if
allow-popups-to-escape-sandbox is used</title>
<script src=/resources/testharness.js></script>
<script src=/resources/testharnessreport.js></script>
<iframe sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox">
</iframe>
<script>
var t = async_test();
var ourOrigin;
onmessage = t.step_func(function(e) {
assert_equals(e.data, "hello", "This is our origin getter message");
ourOrigin = e.origin;
onmessage = t.step_func_done(function(e) {
assert_equals(e.origin, "null", "It came from a sandboxed iframe");
assert_equals(e.data.data, undefined, "Should have the right message");
assert_equals(e.data.origin, ourOrigin, "Should have escaped the sandbox");
});
var iframe = document.querySelector("iframe");
iframe.onload = function() {
frames[0].postMessage("start", "*");
}
iframe.src = "iframe_sandbox_popups_helper-2.html";
});
addEventListener("load", function() {
postMessage("hello", "*");
});
</script>

25
testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_escaping-3.html Normal file
View File

@ -0,0 +1,25 @@
<!doctype html>
<meta charset=utf-8>
<title>Check that popups from a sandboxed iframe escape the sandbox if
allow-popups-to-escape-sandbox is used</title>
<script src=/resources/testharness.js></script>
<script src=/resources/testharnessreport.js></script>
<iframe sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox">
</iframe>
<script>
var t = async_test();
var ourOrigin;
onmessage = t.step_func(function(e) {
assert_equals(e.data, "hello", "This is our origin getter message");
ourOrigin = e.origin;
onmessage = t.step_func_done(function(e) {
assert_equals(e.origin, "null", "It came from a sandboxed iframe");
assert_equals(e.data.data, undefined, "Should have the right message");
assert_equals(e.data.origin, ourOrigin, "Should have escaped the sandbox");
});
document.querySelector("iframe").src = "iframe_sandbox_popups_helper-3.html";
});
postMessage("hello", "*");
</script>

1
testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_helper.html → testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_helper-1.html
View File

@ -1,6 +1,5 @@
<!DOCTYPE html>
<script>
var popupWin;
if (opener) {
// We're the popup. Send back our state. What we really want to send is
// our origin, but that will come automatically.

27
testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_helper-2.html Normal file
View File

@ -0,0 +1,27 @@
<!DOCTYPE html>
<body>
<script>
if (opener) {
// We're the popup. Send back our state. What we really want to send is
// our origin, but that will come automatically.
opener.postMessage(undefined, "*");
self.close();
} else {
// We're the child. Start listening for messages from our parent and open
// ourselves as the popup when we get the "start" message.
onmessage = function (e) {
if (e.data == "start") {
// Now listen for messages from the thing we plan to open.
onmessage = function(e) {
parent.postMessage({ data: e.data, origin: e.origin }, "*");
}
var a = document.createElement("a");
a.href = location.href;
a.target = "_blank";
document.body.appendChild(a);
a.click();
}
};
}
</script>

17
testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_helper-3.html Normal file
View File

@ -0,0 +1,17 @@
<!DOCTYPE html>
<script>
if (opener) {
// We're the popup. Send back our state. What we really want to send is
// our origin, but that will come automatically.
opener.postMessage(undefined, "*");
self.close();
} else {
// We're the child. Start listening for messages and open ourselves as the
// popup.
onmessage = function (e) {
parent.postMessage({ data: e.data, origin: e.origin }, "*");
};
var popupWin = window.open();
popupWin.location.href = location.href;
}
</script>

2
testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping.html → testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-1.html
View File

@ -12,4 +12,4 @@
});
</script>
<iframe sandbox="allow-scripts allow-popups"
src="iframe_sandbox_popups_helper.html"></iframe>
src="iframe_sandbox_popups_helper-1.html"></iframe>

18
testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-2.html Normal file
View File

@ -0,0 +1,18 @@
<!doctype html>
<meta charset=utf-8>
<title>Check that popups from a sandboxed iframe do not escape the sandbox</title>
<script src=/resources/testharness.js></script>
<script src=/resources/testharnessreport.js></script>
<script>
var t = async_test();
onmessage = t.step_func_done(function(e) {
assert_equals(e.origin, "null", "It came from a sandboxed iframe");
assert_equals(e.data.data, undefined, "Should have the right message");
assert_equals(e.data.origin, "null", "Should not have escaped the sandbox");
});
addEventListener("load", function() {
frames[0].postMessage("start", "*");
});
</script>
<iframe sandbox="allow-scripts allow-popups"
src="iframe_sandbox_popups_helper-2.html"></iframe>

15
testing/web-platform/tests/html/semantics/embedded-content/the-iframe-element/iframe_sandbox_popups_nonescaping-3.html Normal file
View File

@ -0,0 +1,15 @@
<!doctype html>
<meta charset=utf-8>
<title>Check that popups from a sandboxed iframe do not escape the sandbox</title>
<script src=/resources/testharness.js></script>
<script src=/resources/testharnessreport.js></script>
<script>
var t = async_test();
onmessage = t.step_func_done(function(e) {
assert_equals(e.origin, "null", "It came from a sandboxed iframe");
assert_equals(e.data.data, undefined, "Should have the right message");
assert_equals(e.data.origin, "null", "Should not have escaped the sandbox");
});
</script>
<iframe sandbox="allow-scripts allow-popups"
src="iframe_sandbox_popups_helper-3.html"></iframe>