mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-11-01 22:55:23 +00:00
b83ba6b825
Backed out changeset b782435e5640 (bug 671389) Backed out changeset 0f8d62109bfe (bug 671389) Backed out changeset 8d6021f66c49 (bug 671389) Backed out changeset cd3e227df9dc (bug 671389)
242 lines
12 KiB
HTML
242 lines
12 KiB
HTML
<!DOCTYPE HTML>
|
|
<html>
|
|
<!--
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=341604
|
|
Implement HTML5 sandbox attribute for IFRAMEs - general tests
|
|
-->
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title>Tests for Bug 341604 and Bug 766282</title>
|
|
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
|
<script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
|
|
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
|
</head>
|
|
<script type="application/javascript">
|
|
/** Test for Bug 341604 - Implement HTML5 sandbox attribute for IFRAMEs - general tests **/
|
|
|
|
SimpleTest.expectAssertions(0, 1);
|
|
SimpleTest.waitForExplicitFinish();
|
|
SimpleTest.requestCompleteLog();
|
|
|
|
// a postMessage handler that is used by sandboxed iframes without
|
|
// 'allow-same-origin' to communicate pass/fail back to this main page.
|
|
// it expects to be called with an object like {ok: true/false, desc:
|
|
// <description of the test> which it then forwards to ok()
|
|
window.addEventListener("message", receiveMessage, false);
|
|
|
|
function receiveMessage(event)
|
|
{
|
|
ok_wrapper(event.data.ok, event.data.desc);
|
|
}
|
|
|
|
var completedTests = 0;
|
|
var passedTests = 0;
|
|
|
|
function ok_wrapper(result, desc) {
|
|
ok(result, desc);
|
|
|
|
completedTests++;
|
|
|
|
if (result) {
|
|
passedTests++;
|
|
}
|
|
|
|
if (completedTests == 27) {
|
|
is(passedTests, completedTests, "There are " + completedTests + " general tests that should pass");
|
|
SimpleTest.finish();
|
|
}
|
|
}
|
|
|
|
function doTest() {
|
|
// passes twice if good
|
|
// 1) test that inline scripts (<script>) can run in an iframe sandboxed with "allow-scripts"
|
|
// (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts')
|
|
|
|
// passes twice if good
|
|
// 2) test that <script src=...> can run in an iframe sandboxed with "allow-scripts"
|
|
// (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts')
|
|
|
|
// passes twice if good
|
|
// 3) test that script in an event listener (body onload) can run in an iframe sandboxed with "allow-scripts"
|
|
// (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts')
|
|
|
|
// passes twice if good
|
|
// 4) test that script in an javascript:url can run in an iframe sandboxed with "allow-scripts"
|
|
// (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts')
|
|
|
|
// fails if bad
|
|
// 5) test that inline scripts cannot run in an iframe sandboxed without "allow-scripts"
|
|
// (done in file_iframe_sandbox_c_if2.html which has sandbox='')
|
|
|
|
// fails if bad
|
|
// 6) test that <script src=...> cannot run in an iframe sandboxed without "allow-scripts"
|
|
// (done in file_iframe_sandbox_c_if2.html which has sandbox='')
|
|
|
|
// fails if bad
|
|
// 7) test that script in an event listener (body onload) cannot run in an iframe sandboxed without "allow-scripts"
|
|
// (done in file_iframe_sandbox_c_if2.html which has sandbox='')
|
|
|
|
// fails if bad
|
|
// 8) test that script in an event listener (img onerror) cannot run in an iframe sandboxed without "allow-scripts"
|
|
// (done in file_iframe_sandbox_c_if2.html which has sandbox='')
|
|
|
|
// fails if bad
|
|
// 9) test that script in an javascript:url cannot run in an iframe sandboxed without "allow-scripts"
|
|
// (done in file_iframe_sandbox_c_if_5.html which has sandbox='allow-same-origin')
|
|
var if_w = document.getElementById('if_5').contentWindow;
|
|
sendMouseEvent({type:'click'}, 'a_link', if_w);
|
|
|
|
// passes if good
|
|
// 10) test that a new iframe has sandbox attribute
|
|
var ifr = document.createElement("iframe");
|
|
ok_wrapper("sandbox" in ifr, "a new iframe should have a sandbox attribute");
|
|
|
|
// passes if good
|
|
// 11) test that the sandbox attribute's default stringyfied value is an empty string
|
|
ok_wrapper(ifr.sandbox.length === 0 && ifr.sandbox == "", "default sandbox attribute should be an empty string");
|
|
|
|
// passes if good
|
|
// 12) test that a sandboxed iframe with 'allow-forms' can submit forms
|
|
// (done in file_iframe_sandbox_c_if3.html which has 'allow-forms' and 'allow-scripts')
|
|
|
|
// fails if bad
|
|
// 13) test that a sandboxed iframe without 'allow-forms' can NOT submit forms
|
|
// (done in file_iframe_sandbox_c_if1.html which only has 'allow-scripts')
|
|
|
|
// fails if bad
|
|
// 14) test that a sandboxed iframe can't open a new window using the target.attribute
|
|
// this is done via file_iframe_sandbox_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin"
|
|
// the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok()
|
|
// function that calls window.parent.ok_wrapper
|
|
|
|
// passes if good
|
|
// 15) test that a sandboxed iframe can't open a new window using window.open
|
|
// this is done via file_iframe_sandbox_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin"
|
|
// the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok()
|
|
// function that calls window.parent.ok_wrapper
|
|
|
|
// passes if good
|
|
// 16) test that a sandboxed iframe can't open a new window using window.ShowModalDialog
|
|
// this is done via file_iframe_sandbox_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin"
|
|
// the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok()
|
|
// function that calls window.parent.ok_wrapper
|
|
|
|
// passes twice if good
|
|
// 17) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute
|
|
// is separated with two spaces
|
|
// done via file_iframe_sandbox_c_if6.html which is sandboxed with " allow-scripts allow-same-origin "
|
|
|
|
// passes twice if good
|
|
// 18) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute
|
|
// is separated with tabs
|
|
// done via file_iframe_sandbox_c_if6.html which is sandboxed with "	allow-scripts	allow-same-origin	"
|
|
|
|
// passes twice if good
|
|
// 19) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute
|
|
// is separated with line feeds
|
|
// done via file_iframe_sandbox_c_if6.html which is sandboxed with "
allow-scripts
allow-same-origin
"
|
|
|
|
// passes twice if good
|
|
// 20) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute
|
|
// is separated with form feeds
|
|
// done via file_iframe_sandbox_c_if6.html which is sandboxed with "allow-scriptsallow-same-origin"
|
|
|
|
// passes twice if good
|
|
// 21) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute
|
|
// is separated with carriage returns
|
|
// done via file_iframe_sandbox_c_if6.html which is sandboxed with "
allow-scripts
allow-same-origin
"
|
|
|
|
// fails if bad
|
|
// 22) test that an iframe with sandbox="" does NOT have script in a src attribute created by a javascript:
|
|
// URL executed
|
|
// done by this page, see if_7
|
|
|
|
// passes if good
|
|
// 23) test that an iframe with sandbox="allow-scripts" DOES have script in a src attribute created by a javascript:
|
|
// URL executed
|
|
// done by this page, see if_8
|
|
|
|
// fails if bad
|
|
// 24) test that an iframe with sandbox="", starting out with a document already loaded, does NOT have script in a newly
|
|
// set src attribute created by a javascript: URL executed
|
|
// done by this page, see if_9
|
|
|
|
// passes if good
|
|
// 25) test that an iframe with sandbox="allow-scripts", starting out with a document already loaded, DOES have script
|
|
// in a newly set src attribute created by a javascript: URL executed
|
|
// done by this page, see if_10
|
|
|
|
// passes if good or fails if bad
|
|
// 26) test that an sandboxed document without 'allow-same-origin' can NOT access indexedDB
|
|
// done via file_iframe_sandbox_c_if7.html, which has sandbox='allow-scripts'
|
|
|
|
// passes if good or fails if bad
|
|
// 27) test that an sandboxed document with 'allow-same-origin' can access indexedDB
|
|
// done via file_iframe_sandbox_c_if8.html, which has sandbox='allow-scripts allow-same-origin'
|
|
|
|
// fails if bad
|
|
// 28) Test that a sandboxed iframe can't open a new window using the target.attribute for a
|
|
// non-existing browsing context (BC341604).
|
|
// This is done via file_iframe_sandbox_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin"
|
|
// the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok()
|
|
// function that calls window.parent.ok_wrapper.
|
|
}
|
|
|
|
addLoadEvent(doTest);
|
|
|
|
var started_if_9 = false;
|
|
var started_if_10 = false;
|
|
|
|
function start_if_9() {
|
|
if (started_if_9)
|
|
return;
|
|
|
|
started_if_9 = true;
|
|
sendMouseEvent({type:'click'}, 'a_button');
|
|
}
|
|
|
|
function start_if_10() {
|
|
if (started_if_10)
|
|
return;
|
|
|
|
started_if_10 = true;
|
|
sendMouseEvent({type:'click'}, 'a_button2');
|
|
}
|
|
|
|
function do_if_9() {
|
|
var if_9 = document.getElementById('if_9');
|
|
if_9.src = 'javascript:"<html><script>window.parent.ok_wrapper(false, \'an iframe sandboxed without allow-scripts should not execute script in a javascript URL in a newly set src attribute\');<\/script><\/html>"';
|
|
}
|
|
|
|
function do_if_10() {
|
|
var if_10 = document.getElementById('if_10');
|
|
if_10.src = 'javascript:"<html><script>window.parent.ok_wrapper(true, \'an iframe sandboxed with allow-scripts should execute script in a javascript URL in a newly set src attribute\');<\/script><\/html>"';
|
|
}
|
|
</script>
|
|
<body>
|
|
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=341604">Mozilla Bug 341604</a> - Implement HTML5 sandbox attribute for IFRAMEs
|
|
<p id="display"></p>
|
|
<div id="content">
|
|
<iframe sandbox="allow-same-origin allow-scripts" id="if_1" src="file_iframe_sandbox_c_if1.html" height="10" width="10"></iframe>
|
|
<iframe sandbox="aLlOw-SAME-oRiGin ALLOW-sCrIpTs" id="if_1_case_insensitive" src="file_iframe_sandbox_c_if1.html" height="10" width="10"></iframe>
|
|
<iframe sandbox="" id="if_2" src="file_iframe_sandbox_c_if2.html" height="10" width="10"></iframe>
|
|
<iframe sandbox="allow-forms allow-scripts" id="if_3" src="file_iframe_sandbox_c_if3.html" height="10" width="10"></iframe>
|
|
<iframe sandbox="allow-same-origin allow-scripts" id="if_4" src="file_iframe_sandbox_c_if4.html" height="10" width="10"></iframe>
|
|
<iframe sandbox="allow-same-origin" id="if_5" src="file_iframe_sandbox_c_if5.html" height="10" width="10"></iframe>
|
|
<iframe sandbox=" allow-same-origin allow-scripts " id="if_6_a" src="file_iframe_sandbox_c_if6.html" height="10" width="10"></iframe>
|
|
<iframe sandbox="	allow-same-origin	allow-scripts	" id="if_6_b" src="file_iframe_sandbox_c_if6.html" height="10" width="10"></iframe>
|
|
<iframe sandbox="
allow-same-origin
allow-scripts
" id="if_6_c" src="file_iframe_sandbox_c_if6.html" height="10" width="10"></iframe>
|
|
<iframe sandbox="allow-same-originallow-scripts" id="if_6_d" src="file_iframe_sandbox_c_if6.html" height="10" width="10"></iframe>
|
|
<iframe sandbox="
allow-same-origin
allow-scripts
" id="if_6_e" src="file_iframe_sandbox_c_if6.html" height="10" width="10"></iframe>
|
|
<iframe sandbox="allow-same-origin" id='if_7' src="javascript:'<html><script>window.parent.ok_wrapper(false, \'an iframe sandboxed without allow-scripts should not execute script in a javascript URL in its src attribute\');<\/script><\/html>';" height="10" width="10"></iframe>
|
|
<iframe sandbox="allow-same-origin allow-scripts" id='if_8' src="javascript:'<html><script>window.parent.ok_wrapper(true, \'an iframe sandboxed without allow-scripts should execute script in a javascript URL in its src attribute\');<\/script><\/html>';" height="10" width="10"></iframe>
|
|
<iframe sandbox="allow-same-origin" onload='start_if_9()' id='if_9' src="about:blank" height="10" width="10"></iframe>
|
|
<iframe sandbox="allow-same-origin allow-scripts" onload='start_if_10()' id='if_10' src="about:blank" height="10" width="10"></iframe>
|
|
<iframe sandbox="allow-scripts" id='if_11' src="file_iframe_sandbox_c_if7.html" height="10" width="10"></iframe>
|
|
<iframe sandbox="allow-same-origin allow-scripts" id='if_12' src="file_iframe_sandbox_c_if8.html" height="10" width="10"></iframe>
|
|
<input type='button' id="a_button" onclick='do_if_9()'>
|
|
<input type='button' id="a_button2" onclick='do_if_10()'>
|
|
</div>
|
|
</body>
|
|
</html>
|