44 lines
1.9 KiB
HTML
44 lines
1.9 KiB
HTML
<!doctype html>
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
<script src="return-value/resources/helpers.js"></script>
|
|
<iframe id="i" src="/common/blank.html?startI" sandbox="allow-same-origin"></iframe>
|
|
<iframe id="i2" src="/common/blank.html?startI2" sandbox="allow-scripts allow-same-origin"></iframe>
|
|
|
|
<script>
|
|
// Intended setup:
|
|
// Step 0:
|
|
// - Parent: (current URL)
|
|
// - i: /common/blank.html?startI
|
|
// - i2: /common/blank.html?startI2
|
|
// Step 1:
|
|
// - Parent: (current URL)
|
|
// - i: /common/blank.html?startI
|
|
// - i2: resources/navigation-back.html
|
|
// Step 2:
|
|
// - Parent: (current URL)
|
|
// - i: /common/blank.html?endI
|
|
// - i2: resources/navigation-back.html
|
|
//
|
|
// Then, calling navigation.back() in i2 will take is from step 2 to step 0, which would navigate i.
|
|
// That is not allowed, so the call to back() must reject.
|
|
|
|
promise_test(async t => {
|
|
await new Promise(resolve => window.onload = resolve);
|
|
|
|
i2.contentWindow.location.href = new URL("resources/navigation-back.html", location.href);
|
|
await new Promise(resolve => i2.onload = resolve);
|
|
|
|
i.contentWindow.location.href = "/common/blank.html?endI";
|
|
await new Promise(resolve => i.onload = resolve);
|
|
|
|
i.contentWindow.navigation.onnavigate = t.unreached_func("navigate must not fire");
|
|
i.contentWindow.navigation.onnavigateerror = t.unreached_func("navigateerror must not fire");
|
|
i.contentWindow.onbeforeunload = t.unreached_func("beforeunload must not fire");
|
|
i.contentWindow.onunload = t.unreached_func("unload must not fire");
|
|
i.contentWindow.onpagehide = t.unreached_func("pagehide must not fire");
|
|
i.contentWindow.onpopstate = t.unreached_func("popstate must not fire");
|
|
|
|
await assertBothRejectDOM(t, i2.contentWindow.doNavigationBack(), "SecurityError", i2.contentWindow);
|
|
}, "A sandboxed iframe cannot navigate its sibling via its own navigation object by using back()");
|
|
</script>
|