mirror of
https://github.com/mozilla/gecko-dev.git
synced 2025-02-26 12:20:56 +00:00
f6cdd2b50e
The method is exposed only if the consumer has the same principal as the PDF would have if it were not getting the PDF viewer treatment. The method just calls the print() method in the PDF viewer window. It's enough to expose this on nsOuterWindowProxy, not RemoteOuterWindowProxy, because PDF documents end up in the process they would have been in based on their pre-PDF-viewer principal, since we do process determination in the parent process but only run the pdfjs stream converter in the content process, once we have decided which one to use. Differential Revision: https://phabricator.services.mozilla.com/D63711 --HG-- extra : moz-landing-system : lando
63 lines
2.2 KiB
HTML
63 lines
2.2 KiB
HTML
<!DOCTYPE HTML>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title><!-- TODO: insert title here --></title>
|
|
<script src="/tests/SimpleTest/SimpleTest.js"></script>
|
|
<link rel="stylesheet" href="/tests/SimpleTest/test.css"/>
|
|
</head>
|
|
<body>
|
|
<p id="display"></p>
|
|
<div id="content" style="display: none">
|
|
<script>
|
|
SimpleTest.waitForExplicitFinish();
|
|
const blob = new Blob(["x"], { type: "application/pdf" });
|
|
const blobURL = URL.createObjectURL(blob);
|
|
const blobFrame = document.createElement("iframe");
|
|
blobFrame.src = blobURL;
|
|
document.getElementById("content").appendChild(blobFrame);
|
|
|
|
const dataURL = "data:application/pdf,";
|
|
const dataFrame = document.createElement("iframe");
|
|
dataFrame.src = dataURL;
|
|
document.getElementById("content").appendChild(dataFrame);
|
|
|
|
addLoadEvent(function() {
|
|
// blob:// URLs inherit their origin, so the window inside blobFrame
|
|
// should be same-orgin with us except for the PDF viewer messing with
|
|
// origins.
|
|
const printFunc = blobFrame.contentWindow.print;
|
|
is(typeof printFunc, "function", "Should have a 'print' function");
|
|
ok(Object.getOwnPropertyNames(blobFrame.contentWindow).includes("print"),
|
|
"Should see 'print' property in property names");
|
|
|
|
try {
|
|
// data: URLs get nonce origins, so the window inside dataFrame is not
|
|
// same-origin with us in any way.
|
|
dataFrame.contentWindow.print;
|
|
ok(false, "Should throw on cross-origin .print access");
|
|
} catch (e) {
|
|
ok(/Permission denied/.test(e.message), "Should have a security error");
|
|
}
|
|
ok(!Object.getOwnPropertyNames(dataFrame.contentWindow).includes("print"),
|
|
"Should not see 'print' property in property names");
|
|
|
|
try {
|
|
printFunc.call(dataFrame.contentWindow);
|
|
ok(false, "Should throw on cross-origin call");
|
|
} catch (e) {
|
|
ok(/Permission to call/.test(e.message),
|
|
"Should have a security error for call");
|
|
}
|
|
|
|
// It'd be nice to test that calling the function works right, but if it
|
|
// does it'll put up the print dialog, which is not helpful in an
|
|
// automated test.
|
|
SimpleTest.finish();
|
|
});
|
|
</script>
|
|
</div>
|
|
<pre id="test"></pre>
|
|
</body>
|
|
</html>
|