From 2aa4a82499d4becd2284cdb482213d541b8804dd Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 28 Apr 2024 16:29:10 +0200
Subject: Adding upstream version 86.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 docshell/test/iframesandbox/.eslintrc.js           |   5 +
 .../file_child_navigation_by_location.html         |   1 +
 .../iframesandbox/file_marquee_event_handlers.html |  17 ++
 ...ile_other_auxiliary_navigation_by_location.html |  15 ++
 .../file_our_auxiliary_navigation_by_location.html |  15 ++
 .../file_parent_navigation_by_location.html        |  18 ++
 .../file_sibling_navigation_by_location.html       |  15 ++
 .../file_top_navigation_by_location.html           |  20 ++
 .../file_top_navigation_by_location_exotic.html    |  27 +++
 docshell/test/iframesandbox/mochitest.ini          |  24 +++
 .../test_child_navigation_by_location.html         |  91 +++++++++
 .../iframesandbox/test_marquee_event_handlers.html |  95 ++++++++++
 ...est_other_auxiliary_navigation_by_location.html |  80 ++++++++
 .../test_our_auxiliary_navigation_by_location.html |  84 +++++++++
 .../test_parent_navigation_by_location.html        |  75 ++++++++
 .../test_sibling_navigation_by_location.html       |  78 ++++++++
 .../test_top_navigation_by_location.html           | 167 +++++++++++++++++
 .../test_top_navigation_by_location_exotic.html    | 204 +++++++++++++++++++++
 18 files changed, 1031 insertions(+)
 create mode 100644 docshell/test/iframesandbox/.eslintrc.js
 create mode 100644 docshell/test/iframesandbox/file_child_navigation_by_location.html
 create mode 100644 docshell/test/iframesandbox/file_marquee_event_handlers.html
 create mode 100644 docshell/test/iframesandbox/file_other_auxiliary_navigation_by_location.html
 create mode 100644 docshell/test/iframesandbox/file_our_auxiliary_navigation_by_location.html
 create mode 100644 docshell/test/iframesandbox/file_parent_navigation_by_location.html
 create mode 100644 docshell/test/iframesandbox/file_sibling_navigation_by_location.html
 create mode 100644 docshell/test/iframesandbox/file_top_navigation_by_location.html
 create mode 100644 docshell/test/iframesandbox/file_top_navigation_by_location_exotic.html
 create mode 100644 docshell/test/iframesandbox/mochitest.ini
 create mode 100644 docshell/test/iframesandbox/test_child_navigation_by_location.html
 create mode 100644 docshell/test/iframesandbox/test_marquee_event_handlers.html
 create mode 100644 docshell/test/iframesandbox/test_other_auxiliary_navigation_by_location.html
 create mode 100644 docshell/test/iframesandbox/test_our_auxiliary_navigation_by_location.html
 create mode 100644 docshell/test/iframesandbox/test_parent_navigation_by_location.html
 create mode 100644 docshell/test/iframesandbox/test_sibling_navigation_by_location.html
 create mode 100644 docshell/test/iframesandbox/test_top_navigation_by_location.html
 create mode 100644 docshell/test/iframesandbox/test_top_navigation_by_location_exotic.html

(limited to 'docshell/test/iframesandbox')

diff --git a/docshell/test/iframesandbox/.eslintrc.js b/docshell/test/iframesandbox/.eslintrc.js
new file mode 100644
index 0000000000..845ed3f013
--- /dev/null
+++ b/docshell/test/iframesandbox/.eslintrc.js
@@ -0,0 +1,5 @@
+"use strict";
+
+module.exports = {
+  extends: ["plugin:mozilla/mochitest-test"],
+};
diff --git a/docshell/test/iframesandbox/file_child_navigation_by_location.html b/docshell/test/iframesandbox/file_child_navigation_by_location.html
new file mode 100644
index 0000000000..7365bed81f
--- /dev/null
+++ b/docshell/test/iframesandbox/file_child_navigation_by_location.html
@@ -0,0 +1 @@
+<script>function onNav() { parent.parent.postMessage("childIframe", "*"); } window.onload = onNav; window.onhashchange = onNav;</script>
diff --git a/docshell/test/iframesandbox/file_marquee_event_handlers.html b/docshell/test/iframesandbox/file_marquee_event_handlers.html
new file mode 100644
index 0000000000..13ee31ddb7
--- /dev/null
+++ b/docshell/test/iframesandbox/file_marquee_event_handlers.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Test marquee attribute event handlers in iframe sandbox</title>
+</head>
+<body>
+  <!-- Note that the width here is slightly longer than the contents, to make
+       sure we bounce and finish very quickly. -->
+  <marquee loop="2" width="145" behavior="alternate" truespeed scrolldelay="1"
+    onstart="parent.postMessage(window.name + ' marquee onstart', '*');"
+    onbounce="parent.postMessage(window.name + ' marquee onbounce', '*');"
+    onfinish="parent.postMessage(window.name + ' marquee onfinish', '*');">
+    Will bounce and finish
+  </marquee>
+</body>
+</html>
diff --git a/docshell/test/iframesandbox/file_other_auxiliary_navigation_by_location.html b/docshell/test/iframesandbox/file_other_auxiliary_navigation_by_location.html
new file mode 100644
index 0000000000..ad24c0f242
--- /dev/null
+++ b/docshell/test/iframesandbox/file_other_auxiliary_navigation_by_location.html
@@ -0,0 +1,15 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Test window for other auxiliary navigation by location tests</title>
+<script>
+  function onNav() {
+    opener.postMessage(window.name, "*");
+  }
+
+  window.onload = onNav;
+  window.onhashchange = onNav;
+</script>
+</head>
+</html>
diff --git a/docshell/test/iframesandbox/file_our_auxiliary_navigation_by_location.html b/docshell/test/iframesandbox/file_our_auxiliary_navigation_by_location.html
new file mode 100644
index 0000000000..978980df25
--- /dev/null
+++ b/docshell/test/iframesandbox/file_our_auxiliary_navigation_by_location.html
@@ -0,0 +1,15 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Test window for our auxiliary navigation by location tests</title>
+<script>
+  function onNav() {
+    opener.parent.postMessage(window.name, "*");
+  }
+
+  window.onload = onNav;
+  window.onhashchange = onNav;
+</script>
+</head>
+</html>
diff --git a/docshell/test/iframesandbox/file_parent_navigation_by_location.html b/docshell/test/iframesandbox/file_parent_navigation_by_location.html
new file mode 100644
index 0000000000..9a2e95fad0
--- /dev/null
+++ b/docshell/test/iframesandbox/file_parent_navigation_by_location.html
@@ -0,0 +1,18 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Test window for parent navigation by location tests</title>
+<script>
+  function onNav() {
+    parent.postMessage(window.name, "*");
+  }
+
+  window.onload = onNav;
+  window.onhashchange = onNav;
+</script>
+</head>
+<body>
+  <iframe name="childIframe" sandbox="allow-scripts allow-same-origin allow-top-navigation"></iframe>
+</body>
+</html>
diff --git a/docshell/test/iframesandbox/file_sibling_navigation_by_location.html b/docshell/test/iframesandbox/file_sibling_navigation_by_location.html
new file mode 100644
index 0000000000..51a52bb8eb
--- /dev/null
+++ b/docshell/test/iframesandbox/file_sibling_navigation_by_location.html
@@ -0,0 +1,15 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Test window for sibling navigation by location tests</title>
+<script>
+  function onNav() {
+    parent.postMessage(window.name, "*");
+  }
+
+  window.onload = onNav;
+  window.onhashchange = onNav;
+</script>
+</head>
+</html>
diff --git a/docshell/test/iframesandbox/file_top_navigation_by_location.html b/docshell/test/iframesandbox/file_top_navigation_by_location.html
new file mode 100644
index 0000000000..194430f38c
--- /dev/null
+++ b/docshell/test/iframesandbox/file_top_navigation_by_location.html
@@ -0,0 +1,20 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Test window for top navigation by location tests</title>
+<script>
+  function onNav() {
+    opener.postMessage(window.name, "*");
+  }
+
+  window.onload = onNav;
+  window.onhashchange = onNav;
+</script>
+</head>
+<body>
+  <iframe name="if1" sandbox="allow-scripts allow-same-origin"></iframe>
+  <iframe name="if2" sandbox="allow-scripts allow-same-origin allow-top-navigation"></iframe>
+  <iframe name="if3" sandbox="allow-scripts allow-top-navigation"></iframe>
+</body>
+</html>
diff --git a/docshell/test/iframesandbox/file_top_navigation_by_location_exotic.html b/docshell/test/iframesandbox/file_top_navigation_by_location_exotic.html
new file mode 100644
index 0000000000..9a26bc80db
--- /dev/null
+++ b/docshell/test/iframesandbox/file_top_navigation_by_location_exotic.html
@@ -0,0 +1,27 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+<meta charset="utf-8">
+<title>Test window for top navigation by location tests</title>
+<script>
+  function onBlock() {
+    opener.postMessage({ name: window.name, blocked: true }, "*");
+  }
+
+  function onNav() {
+    opener.postMessage({ name: window.name, blocked: false }, "*");
+  }
+
+  function setOwnHref() {
+    // eslint-disable-next-line no-self-assign
+    location.href = location.href;
+  }
+
+  window.onload = onNav;
+</script>
+</head>
+<body>
+  <iframe name="if1" sandbox="allow-scripts allow-same-origin"></iframe>
+  <iframe name="if2" sandbox="allow-scripts allow-same-origin allow-top-navigation"></iframe>
+</body>
+</html>
diff --git a/docshell/test/iframesandbox/mochitest.ini b/docshell/test/iframesandbox/mochitest.ini
new file mode 100644
index 0000000000..f74c23ffb4
--- /dev/null
+++ b/docshell/test/iframesandbox/mochitest.ini
@@ -0,0 +1,24 @@
+[DEFAULT]
+support-files =
+  file_child_navigation_by_location.html
+  file_marquee_event_handlers.html
+  file_other_auxiliary_navigation_by_location.html
+  file_our_auxiliary_navigation_by_location.html
+  file_parent_navigation_by_location.html
+  file_sibling_navigation_by_location.html
+  file_top_navigation_by_location.html
+  file_top_navigation_by_location_exotic.html
+
+[test_child_navigation_by_location.html]
+[test_marquee_event_handlers.html]
+skip-if = true # Bug 1455996
+[test_other_auxiliary_navigation_by_location.html]
+tags = openwindow
+[test_our_auxiliary_navigation_by_location.html]
+tags = openwindow
+[test_parent_navigation_by_location.html]
+tags = openwindow
+[test_sibling_navigation_by_location.html]
+tags = openwindow
+[test_top_navigation_by_location_exotic.html]
+[test_top_navigation_by_location.html]
diff --git a/docshell/test/iframesandbox/test_child_navigation_by_location.html b/docshell/test/iframesandbox/test_child_navigation_by_location.html
new file mode 100644
index 0000000000..383320a02b
--- /dev/null
+++ b/docshell/test/iframesandbox/test_child_navigation_by_location.html
@@ -0,0 +1,91 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=785310
+html5 sandboxed iframe should not be able to perform top navigation with scripts allowed
+-->
+<head>
+<meta charset="utf-8">
+<title>Test for Bug 785310 - iframe sandbox child navigation by location tests</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+<script>
+  SimpleTest.waitForExplicitFinish();
+
+  var testDataUri = "file_child_navigation_by_location.html";
+
+  function runScriptNavigationTest(testCase) {
+    window.onmessage = function(event) {
+      if (event.data != "childIframe") {
+        ok(false, "event.data: got '" + event.data + "', expected 'childIframe'");
+      }
+      ok(!testCase.shouldBeBlocked, testCase.desc + " - child navigation was NOT blocked");
+      runNextTest();
+    };
+    try {
+      window.parentIframe.eval(testCase.script);
+    } catch (e) {
+      ok(testCase.shouldBeBlocked, testCase.desc + " - " + e.message);
+      runNextTest();
+    }
+  }
+
+  var testCaseIndex = -1;
+  var testCases = [
+    {
+      desc: "Test 1: cross origin child location.replace should NOT be blocked",
+      script: "window['crossOriginChildIframe'].location.replace(\"" + testDataUri + "\")",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 2: cross origin child location.assign should be blocked",
+      script: "window['crossOriginChildIframe'].location.assign(\"" + testDataUri + "\")",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 3: same origin child location.assign should NOT be blocked",
+      script: "window['sameOriginChildIframe'].location.assign(\"" + testDataUri + "\")",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 4: cross origin child location.href should NOT be blocked",
+      script: "window['crossOriginChildIframe'].location.href = \"" + testDataUri + "\"",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 5: cross origin child location.hash should be blocked",
+      script: "window['crossOriginChildIframe'].location.hash = 'wibble'",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 6: same origin child location.hash should NOT be blocked",
+      script: "window['sameOriginChildIframe'].location.hash = 'wibble'",
+      shouldBeBlocked: false,
+    },
+  ];
+
+  function runNextTest() {
+    ++testCaseIndex;
+    if (testCaseIndex == testCases.length) {
+      SimpleTest.finish();
+      return;
+    }
+
+    runScriptNavigationTest(testCases[testCaseIndex]);
+  }
+
+  addLoadEvent(runNextTest);
+</script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=785310">Mozilla Bug 785310</a>
+<p id="display"></p>
+<div id="content">
+Tests for Bug 785310
+</div>
+
+<iframe name="parentIframe" sandbox="allow-scripts allow-same-origin" srcdoc="<iframe name='sameOriginChildIframe'></iframe><iframe name='crossOriginChildIframe' sandbox='allow-scripts'></iframe>"</iframe>
+
+</body>
+</html>
diff --git a/docshell/test/iframesandbox/test_marquee_event_handlers.html b/docshell/test/iframesandbox/test_marquee_event_handlers.html
new file mode 100644
index 0000000000..80added8ab
--- /dev/null
+++ b/docshell/test/iframesandbox/test_marquee_event_handlers.html
@@ -0,0 +1,95 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1277475
+html5 sandboxed iframe should not run marquee attribute event handlers without allow-scripts
+-->
+<head>
+<meta charset="utf-8">
+<title>Test for Bug 1277475 - html5 sandboxed iframe should not run marquee attribute event handlers without allow-scripts</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1277475">Mozilla Bug 1277475</a>
+<p id="display"></p>
+<div id="content">Tests for Bug 1277475</div>
+
+<iframe id="if1" name="if1" src="file_marquee_event_handlers.html"
+   sandbox="allow-same-origin allow-forms allow-top-navigation allow-pointer-lock allow-orientation-lock allow-popups allow-modals allow-popups-to-escape-sandbox">
+</iframe>
+
+<iframe id="if2" name="if2" src="file_marquee_event_handlers.html"
+   sandbox="allow-scripts"></iframe>
+
+<script>
+  SimpleTest.waitForExplicitFinish();
+
+  var expectedMessages = new Set();
+  var numberOfMessagesExpected = 4;
+  var unexpectedMessages = new Set();
+
+  window.onmessage = function(event) {
+    info(event.data + " message received");
+    if (event.data.startsWith("if2") || event.data == "if1 chaser") {
+      expectedMessages.add(event.data);
+      if (expectedMessages.size == numberOfMessagesExpected) {
+        checkRecievedMessages();
+      }
+    } else {
+      unexpectedMessages.add(event.data);
+    }
+  };
+
+  function checkRecievedMessages() {
+    // Check the expected messages explicitly as a cross-check.
+    ok(expectedMessages.has("if1 chaser"),
+       "if1 chaser message should have been received");
+    ok(expectedMessages.has("if2 marquee onstart"),
+       "if2 marquee onstart should have run in iframe sandbox with allow-scripts");
+    ok(expectedMessages.has("if2 marquee onbounce"),
+       "if2 marquee onbounce should have run in iframe sandbox with allow-scripts");
+    ok(expectedMessages.has("if2 marquee onfinish"),
+       "if2 marquee onfinish should have run in iframe sandbox with allow-scripts");
+
+    unexpectedMessages.forEach(
+      (v) => {
+        ok(false, v + " should NOT have run in iframe sandbox without allow-scripts");
+      }
+    );
+
+    SimpleTest.finish();
+  }
+
+  // If things are working properly the attribute event handlers won't run on
+  // the marquee in if1, so add our own capturing listeners on its window, so we
+  // know when they have fired. (These will run as we are not sandboxed.)
+  var if1FiredEvents = new Set();
+  var if1NumberOfEventsExpected = 3;
+  var if1Win = document.getElementById("if1").contentWindow;
+  if1Win.addEventListener("start", () => { checkMarqueeEvent("start"); }, true);
+  if1Win.addEventListener("bounce", () => { checkMarqueeEvent("bounce"); }, true);
+  if1Win.addEventListener("finish", () => { checkMarqueeEvent("finish"); }, true);
+
+  function checkMarqueeEvent(eventType) {
+    info("if1 event " + eventType + " fired");
+    if1FiredEvents.add(eventType);
+    if (if1FiredEvents.size == if1NumberOfEventsExpected) {
+      // Only send the chasing message after a tick of the event loop to allow
+      // event handlers on the marquee to process.
+      SimpleTest.executeSoon(sendChasingMessage);
+    }
+  }
+
+  function sendChasingMessage() {
+    // Add our own message listener to if1's window and echo back a chasing
+    // message to make sure that any messages from incorrectly run marquee
+    // attribute event handlers should have arrived before it.
+    if1Win.addEventListener("message",
+                            (e) => { if1Win.parent.postMessage(e.data, "*"); });
+    if1Win.postMessage("if1 chaser", "*");
+    info("if1 chaser message sent");
+  }
+</script>
+</body>
+</html>
diff --git a/docshell/test/iframesandbox/test_other_auxiliary_navigation_by_location.html b/docshell/test/iframesandbox/test_other_auxiliary_navigation_by_location.html
new file mode 100644
index 0000000000..3440878db7
--- /dev/null
+++ b/docshell/test/iframesandbox/test_other_auxiliary_navigation_by_location.html
@@ -0,0 +1,80 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=785310
+html5 sandboxed iframe should not be able to perform top navigation with scripts allowed
+-->
+<head>
+<meta charset="utf-8">
+<title>Test for Bug 785310 - iframe sandbox other auxiliary navigation by location tests</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+<script>
+  SimpleTest.waitForExplicitFinish();
+
+  function runScriptNavigationTest(testCase) {
+    window.onmessage = function(event) {
+      if (event.data != "otherWindow") {
+        ok(false, "event.data: got '" + event.data + "', expected 'otherWindow'");
+      }
+      ok(false, testCase.desc + " - auxiliary navigation was NOT blocked");
+      runNextTest();
+    };
+    try {
+      window.testIframe.eval(testCase.script);
+    } catch (e) {
+      ok(true, testCase.desc + " - " + e.message);
+      runNextTest();
+    }
+  }
+
+  var testCaseIndex = -1;
+  var testCases = [
+    {
+      desc: "Test 1: location.replace on auxiliary NOT opened by us should be blocked",
+      script: "parent.openedWindow.location.replace('file_other_auxiliary_navigation_by_location.html')",
+    },
+    {
+      desc: "Test 2: location.assign on auxiliary NOT opened by us should be blocked",
+      script: "parent.openedWindow.location.assign('file_other_auxiliary_navigation_by_location.html')",
+    },
+    {
+      desc: "Test 3: location.href on auxiliary NOT opened by us should be blocked",
+      script: "parent.openedWindow.location.href = 'file_other_auxiliary_navigation_by_location.html'",
+    },
+    {
+      desc: "Test 4: location.hash on auxiliary NOT opened by us should be blocked",
+      script: "parent.openedWindow.location.hash = 'wibble'",
+    },
+  ];
+
+  function runNextTest() {
+    ++testCaseIndex;
+    if (testCaseIndex == testCases.length) {
+      window.openedWindow.close();
+      SimpleTest.finish();
+      return;
+    }
+
+    runScriptNavigationTest(testCases[testCaseIndex]);
+  }
+
+  window.onmessage = runNextTest;
+
+  window.onload = function() {
+    window.openedWindow = window.open("file_other_auxiliary_navigation_by_location.html", "otherWindow");
+  };
+</script>
+
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=785310">Mozilla Bug 785310</a>
+<p id="display"></p>
+<div id="content">
+Tests for Bug 785310
+</div>
+
+<iframe name="testIframe" sandbox="allow-scripts allow-same-origin allow-top-navigation allow-popups"></iframe>
+</body>
+</html>
diff --git a/docshell/test/iframesandbox/test_our_auxiliary_navigation_by_location.html b/docshell/test/iframesandbox/test_our_auxiliary_navigation_by_location.html
new file mode 100644
index 0000000000..1719f566a5
--- /dev/null
+++ b/docshell/test/iframesandbox/test_our_auxiliary_navigation_by_location.html
@@ -0,0 +1,84 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=785310
+html5 sandboxed iframe should not be able to perform top navigation with scripts allowed
+-->
+<head>
+<meta charset="utf-8">
+<title>Test for Bug 785310 - iframe sandbox our auxiliary navigation by location tests</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+<script>
+  SimpleTest.waitForExplicitFinish();
+
+  function runScriptNavigationTest(testCase) {
+    window.onmessage = function(event) {
+      if (event.data != "ourWindow") {
+        ok(false, "event.data: got '" + event.data + "', expected 'ourWindow'");
+      }
+      ok(!testCase.shouldBeBlocked, testCase.desc + " - auxiliary navigation was NOT blocked");
+      runNextTest();
+    };
+    try {
+      SpecialPowers.wrap(window.testIframe).eval(testCase.script);
+    } catch (e) {
+      ok(testCase.shouldBeBlocked, testCase.desc + " - " + SpecialPowers.wrap(e).message);
+      runNextTest();
+    }
+  }
+
+  var testCaseIndex = -1;
+  var testCases = [
+    {
+      desc: "Test 1: location.replace on auxiliary opened by us should NOT be blocked",
+      script: "openedWindow.location.replace('file_our_auxiliary_navigation_by_location.html')",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 2: location.assign on auxiliary opened by us should be blocked without allow-same-origin",
+      script: "openedWindow.location.assign('file_our_auxiliary_navigation_by_location.html')",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 3: location.href on auxiliary opened by us should NOT be blocked",
+      script: "openedWindow.location.href = 'file_our_auxiliary_navigation_by_location.html'",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 4: location.hash on auxiliary opened by us should be blocked without allow-same-origin",
+      script: "openedWindow.location.hash = 'wibble'",
+      shouldBeBlocked: true,
+    },
+  ];
+
+  function runNextTest() {
+    ++testCaseIndex;
+    if (testCaseIndex == testCases.length) {
+      SpecialPowers.wrap(window.testIframe).eval("openedWindow.close()");
+      SimpleTest.finish();
+      return;
+    }
+
+    runScriptNavigationTest(testCases[testCaseIndex]);
+  }
+
+  window.onmessage = runNextTest;
+
+  window.onload = function() {
+    SpecialPowers.wrap(window.testIframe).eval("var openedWindow = window.open('file_our_auxiliary_navigation_by_location.html', 'ourWindow')");
+  };
+</script>
+
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=785310">Mozilla Bug 785310</a>
+<p id="display"></p>
+<div id="content">
+Tests for Bug 785310
+</div>
+
+<iframe name="testIframe" sandbox="allow-scripts allow-popups"></iframe>
+</body>
+</html>
diff --git a/docshell/test/iframesandbox/test_parent_navigation_by_location.html b/docshell/test/iframesandbox/test_parent_navigation_by_location.html
new file mode 100644
index 0000000000..ac6977a3f3
--- /dev/null
+++ b/docshell/test/iframesandbox/test_parent_navigation_by_location.html
@@ -0,0 +1,75 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=785310
+html5 sandboxed iframe should not be able to perform top navigation with scripts allowed
+-->
+<head>
+<meta charset="utf-8">
+<title>Test for Bug 785310 - iframe sandbox parent navigation by location tests</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+<script>
+  SimpleTest.waitForExplicitFinish();
+
+  function runScriptNavigationTest(testCase) {
+    window.onmessage = function(event) {
+      if (event.data != "parentIframe") {
+        ok(false, "event.data: got '" + event.data + "', expected 'parentIframe'");
+      }
+      ok(false, testCase.desc + " - parent navigation was NOT blocked");
+      runNextTest();
+    };
+    try {
+      window.parentIframe.childIframe.eval(testCase.script);
+    } catch (e) {
+      ok(true, testCase.desc + " - " + e.message);
+      runNextTest();
+    }
+  }
+
+  var testCaseIndex = -1;
+  var testCases = [
+    {
+      desc: "Test 1: parent.location.replace should be blocked even when sandboxed with allow-same-origin allow-top-navigation",
+      script: "parent.location.replace('file_parent_navigation_by_location.html')",
+    },
+    {
+      desc: "Test 2: parent.location.assign should be blocked even when sandboxed with allow-same-origin allow-top-navigation",
+      script: "parent.location.assign('file_parent_navigation_by_location.html')",
+    },
+    {
+      desc: "Test 3: parent.location.href should be blocked even when sandboxed with allow-same-origin allow-top-navigation",
+      script: "parent.location.href = 'file_parent_navigation_by_location.html'",
+    },
+    {
+      desc: "Test 4: parent.location.hash should be blocked even when sandboxed with allow-same-origin allow-top-navigation",
+      script: "parent.location.hash = 'wibble'",
+    },
+  ];
+
+  function runNextTest() {
+    ++testCaseIndex;
+    if (testCaseIndex == testCases.length) {
+      SimpleTest.finish();
+      return;
+    }
+
+    runScriptNavigationTest(testCases[testCaseIndex]);
+  }
+
+  window.onmessage = runNextTest;
+</script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=785310">Mozilla Bug 785310</a>
+<p id="display"></p>
+<div id="content">
+Tests for Bug 785310
+</div>
+
+<iframe name="parentIframe" src="file_parent_navigation_by_location.html"></iframe>
+
+</body>
+</html>
diff --git a/docshell/test/iframesandbox/test_sibling_navigation_by_location.html b/docshell/test/iframesandbox/test_sibling_navigation_by_location.html
new file mode 100644
index 0000000000..d7508d5748
--- /dev/null
+++ b/docshell/test/iframesandbox/test_sibling_navigation_by_location.html
@@ -0,0 +1,78 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=785310
+html5 sandboxed iframe should not be able to perform top navigation with scripts allowed
+-->
+<head>
+<meta charset="utf-8">
+<title>Test for Bug 785310 - iframe sandbox sibling navigation by location tests</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+
+<script>
+  SimpleTest.waitForExplicitFinish();
+
+  function runScriptNavigationTest(testCase) {
+    window.onmessage = function(event) {
+      if (event.data != "siblingIframe") {
+        ok(false, "event.data: got '" + event.data + "', expected 'siblingIframe'");
+      }
+
+      ok(false, testCase.desc + " - sibling navigation was NOT blocked");
+      runNextTest();
+    };
+
+    try {
+      window.testIframe.eval(testCase.script);
+    } catch (e) {
+      ok(true, testCase.desc + " - " + e.message);
+      runNextTest();
+    }
+  }
+
+  var testCaseIndex = -1;
+  var testCases = [
+    {
+      desc: "Test 1: sibling location.replace should be blocked even when sandboxed with allow-same-origin allow-top-navigation",
+      script: "parent['siblingIframe'].location.replace('file_sibling_navigation_by_location.html')",
+    },
+    {
+      desc: "Test 2: sibling location.assign should be blocked even when sandboxed with allow-same-origin allow-top-navigation",
+      script: "parent['siblingIframe'].location.assign('file_sibling_navigation_by_location.html')",
+    },
+    {
+      desc: "Test 3: sibling location.href should be blocked even when sandboxed with allow-same-origin allow-top-navigation",
+      script: "parent['siblingIframe'].location.href = 'file_sibling_navigation_by_location.html'",
+    },
+    {
+      desc: "Test 4: sibling location.hash should be blocked even when sandboxed with allow-same-origin allow-top-navigation",
+      script: "parent['siblingIframe'].location.hash = 'wibble'",
+    },
+  ];
+
+  function runNextTest() {
+    ++testCaseIndex;
+    if (testCaseIndex == testCases.length) {
+      SimpleTest.finish();
+      return;
+    }
+
+    runScriptNavigationTest(testCases[testCaseIndex]);
+  }
+
+  window.onmessage = runNextTest;
+</script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=785310">Mozilla Bug 785310</a>
+<p id="display"></p>
+<div id="content">
+Tests for Bug 785310
+</div>
+
+<iframe name="testIframe" sandbox="allow-scripts allow-same-origin allow-top-navigation"></iframe>
+<iframe name="siblingIframe" src="file_sibling_navigation_by_location.html"></iframe>
+
+</body>
+</html>
diff --git a/docshell/test/iframesandbox/test_top_navigation_by_location.html b/docshell/test/iframesandbox/test_top_navigation_by_location.html
new file mode 100644
index 0000000000..248f854bbf
--- /dev/null
+++ b/docshell/test/iframesandbox/test_top_navigation_by_location.html
@@ -0,0 +1,167 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=785310
+html5 sandboxed iframe should not be able to perform top navigation with scripts allowed
+-->
+<head>
+<meta charset="utf-8">
+<title>Test for Bug 785310 - iframe sandbox top navigation by location tests</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+<script>
+  SimpleTest.waitForExplicitFinish();
+
+  var testWin;
+
+  function runScriptNavigationTest(testCase) {
+    window.onmessage = function(event) {
+      if (event.data != "newTop") {
+        ok(false, "event.data: got '" + event.data + "', expected 'newTop'");
+      }
+      ok(!testCase.shouldBeBlocked, testCase.desc + " - top navigation was NOT blocked");
+      runNextTest();
+    };
+    try {
+      SpecialPowers.wrap(testWin[testCase.iframeName]).eval(testCase.script);
+    } catch (e) {
+      ok(testCase.shouldBeBlocked, testCase.desc + " - " + SpecialPowers.wrap(e).message);
+      runNextTest();
+    }
+  }
+
+  var testCaseIndex = -1;
+  var testCases = [
+    {
+      desc: "Test 1: top.location.replace should be blocked when sandboxed without allow-top-navigation",
+      script: "top.location.replace('file_top_navigation_by_location.html')",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 2: top.location.assign should be blocked when sandboxed without allow-top-navigation",
+      script: "top.location.assign('file_top_navigation_by_location.html')",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 3: top.location.href should be blocked when sandboxed without allow-top-navigation",
+      script: "top.location.href = 'file_top_navigation_by_location.html'",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 4: top.location.pathname should be blocked when sandboxed without allow-top-navigation",
+      script: "top.location.pathname = top.location.pathname",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 5: top.location should be blocked when sandboxed without allow-top-navigation",
+      script: "top.location = 'file_top_navigation_by_location.html'",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 6: top.location.hash should be blocked when sandboxed without allow-top-navigation",
+      script: "top.location.hash = 'wibble'",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 7: top.location.replace should NOT be blocked when sandboxed with allow-same-origin allow-top-navigation",
+      script: "top.location.replace('file_top_navigation_by_location.html')",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 8: top.location.assign should NOT be blocked when sandboxed with allow-same-origin allow-top-navigation",
+      script: "top.location.assign('file_top_navigation_by_location.html')",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 9: top.location.href should NOT be blocked when sandboxed with allow-same-origin allow-top-navigation",
+      script: "top.location.href = 'file_top_navigation_by_location.html'",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 10: top.location.pathname should NOT be blocked when sandboxed with allow-same-origin allow-top-navigation",
+      script: "top.location.pathname = top.location.pathname",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 11: top.location should NOT be blocked when sandboxed with allow-same-origin allow-top-navigation",
+      script: "top.location = 'file_top_navigation_by_location.html'",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 12: top.location.hash should NOT be blocked when sandboxed with allow-same-origin allow-top-navigation",
+      script: "top.location.hash = 'wibble'",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 13: top.location.replace should NOT be blocked when sandboxed with allow-top-navigation, but without allow-same-origin",
+      script: "top.location.replace('file_top_navigation_by_location.html')",
+      iframeName: "if3",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 14: top.location.assign should be blocked when sandboxed with allow-top-navigation, but without allow-same-origin",
+      script: "top.location.assign('file_top_navigation_by_location.html')",
+      iframeName: "if3",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 15: top.location.href should NOT be blocked when sandboxed with allow-top-navigation, but without allow-same-origin",
+      script: "top.location.href = 'file_top_navigation_by_location.html'",
+      iframeName: "if3",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 16: top.location.pathname should be blocked when sandboxed with allow-top-navigation, but without allow-same-origin",
+      script: "top.location.pathname = top.location.pathname",
+      iframeName: "if3",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 17: top.location should NOT be blocked when sandboxed with allow-top-navigation, but without allow-same-origin",
+      script: "top.location = 'file_top_navigation_by_location.html'",
+      iframeName: "if3",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 18: top.location.hash should be blocked when sandboxed with allow-top-navigation, but without allow-same-origin",
+      script: "top.location.hash = 'wibble'",
+      iframeName: "if3",
+      shouldBeBlocked: true,
+   },
+  ];
+
+  function runNextTest() {
+    ++testCaseIndex;
+    if (testCaseIndex == testCases.length) {
+      testWin.close();
+      SimpleTest.finish();
+      return;
+    }
+
+    runScriptNavigationTest(testCases[testCaseIndex]);
+  }
+
+  window.onmessage = runNextTest;
+  testWin = window.open("file_top_navigation_by_location.html", "newTop");
+</script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=785310">Mozilla Bug 785310</a>
+<p id="display"></p>
+<div id="content">
+Tests for Bug 785310
+</div>
+</body>
+</html>
diff --git a/docshell/test/iframesandbox/test_top_navigation_by_location_exotic.html b/docshell/test/iframesandbox/test_top_navigation_by_location_exotic.html
new file mode 100644
index 0000000000..11b7c78699
--- /dev/null
+++ b/docshell/test/iframesandbox/test_top_navigation_by_location_exotic.html
@@ -0,0 +1,204 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=785310
+html5 sandboxed iframe should not be able to perform top navigation with scripts allowed
+-->
+<head>
+<meta charset="utf-8">
+<title>Test for Bug 785310 - iframe sandbox top navigation by location via exotic means tests</title>
+<script src="/tests/SimpleTest/SimpleTest.js"></script>
+<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+<script>
+  SimpleTest.waitForExplicitFinish();
+
+  var testWin;
+
+  function runScriptNavigationTest(testCase) {
+    window.onmessage = function(event) {
+      if (event.data.name != "newWindow") {
+        ok(false, "event.data.name: got '" + event.data.name + "', expected 'newWindow'");
+      }
+      var diag = "top navigation was " + (event.data.blocked ? "" : "NOT ") + "blocked";
+      ok((testCase.shouldBeBlocked == event.data.blocked), testCase.desc + " - " + diag);
+      runNextTest();
+    };
+    try {
+      testWin[testCase.iframeName].eval(testCase.script);
+    } catch (e) {
+      ok(testCase.shouldBeBlocked, testCase.desc + " - " + e.message);
+      runNextTest();
+    }
+  }
+
+  var testCaseIndex = -1;
+  var testCases = [
+    {
+      desc: "Test 1: location.replace.call(top.location, ...) should be blocked when sandboxed without allow-top-navigation",
+      script: "location.replace.call(top.location, 'file_top_navigation_by_location_exotic.html')",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 2: location.replace.bind(top.location, ...) should be blocked when sandboxed without allow-top-navigation",
+      script: "location.replace.bind(top.location, 'file_top_navigation_by_location_exotic.html')()",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 3: Function.bind.call(location.replace, top.location, ...) should be blocked when sandboxed without allow-top-navigation",
+      script: "Function.bind.call(location.replace, top.location, 'file_top_navigation_by_location_exotic.html')()",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 4: location.replace.call(top.location, ...) should NOT be blocked when sandboxed with allow-top-navigation",
+      script: "location.replace.call(top.location, 'file_top_navigation_by_location_exotic.html')",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 5: location.replace.bind(top.location, ...) should NOT be blocked when sandboxed with allow-top-navigation",
+      script: "location.replace.bind(top.location, 'file_top_navigation_by_location_exotic.html')()",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 6: Function.bind.call(location.replace, top.location, ...) should NOT be blocked when sandboxed with allow-top-navigation",
+      script: "Function.bind.call(location.replace, top.location, 'file_top_navigation_by_location_exotic.html')()",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 7: top.location.href, via setTimeout, should be blocked when sandboxed without allow-top-navigation",
+      script: "setTimeout(function() { try { top.location.href = 'file_top_navigation_by_location_exotic.html' } catch (e) { top.onBlock() } }, 0)",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 8: top.location.href, via setTimeout, should NOT be blocked when sandboxed with allow-top-navigation",
+      script: "setTimeout(function() { try { top.location.href = 'file_top_navigation_by_location_exotic.html' } catch(e) { top.onBlock() } }, 0)",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 9: top.location.href, via eval, should be blocked when sandboxed without allow-top-navigation",
+      script: "eval('top.location.href = \"file_top_navigation_by_location_exotic.html\"')",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 10: top.location.href, via eval, should NOT be blocked when sandboxed with allow-top-navigation",
+      script: "eval('top.location.href = \"file_top_navigation_by_location_exotic.html\"')",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 11: top.location.href, via anonymous function, should be blocked when sandboxed without allow-top-navigation",
+      script: "(function() { top.location.href = 'file_top_navigation_by_location_exotic.html' })()",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 12: top.location.href, via anonymous function, should NOT be blocked when sandboxed with allow-top-navigation",
+      script: "(function() { top.location.href = 'file_top_navigation_by_location_exotic.html' })()",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 13: top.location.href, via function inserted in top, should be blocked when sandboxed without allow-top-navigation",
+      script: "top.doTest = function() { top.location.href = 'file_top_navigation_by_location_exotic.html' }; top.doTest();",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 14: top.location.href, via function inserted in top, should NOT be blocked when sandboxed with allow-top-navigation",
+      script: "top.doTest = function() { top.location.href = 'file_top_navigation_by_location_exotic.html' }; top.doTest();",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 15: top.location.href, via function inserted in us by top, should NOT be blocked when sandboxed without allow-top-navigation",
+      script: "top.eval('window[\"if1\"].doTest = function() { top.location.href = \"file_top_navigation_by_location_exotic.html\" };'), doTest();",
+      iframeName: "if1",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 16: top.location.href, via function inserted in top, should NOT be blocked when sandboxed with allow-top-navigation",
+      script: "top.eval('window[\"if2\"].doTest = function() { top.location.href = \"file_top_navigation_by_location_exotic.html\" };'), doTest();",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 17: top.location.href, via function in top, should NOT be blocked when sandboxed without allow-top-navigation",
+      script: "top.setOwnHref()",
+      iframeName: "if1",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 18: top.location.href, via function in top, should NOT be blocked when sandboxed with allow-top-navigation",
+      script: "top.setOwnHref()",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 19: top.location.href, via eval in top, should NOT be blocked when sandboxed without allow-top-navigation",
+      script: "top.eval('location.href = \"file_top_navigation_by_location_exotic.html\"')",
+      iframeName: "if1",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 20: top.location.href, via eval in top, should NOT be blocked when sandboxed with allow-top-navigation",
+      script: "top.eval('location.href = \"file_top_navigation_by_location_exotic.html\"')",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 21: top.location.href, via eval in top calling us, should be blocked when sandboxed without allow-top-navigation",
+      script: "function doTest() { top.location.href = 'file_top_navigation_by_location_exotic.html' } top.eval('window[\"if1\"].doTest()');",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 22: top.location.href, via eval in top calling us, should NOT be blocked when sandboxed with allow-top-navigation",
+      script: "function doTest() { top.location.href = 'file_top_navigation_by_location_exotic.html' } top.eval('window[\"if2\"].doTest()');",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+    {
+      desc: "Test 23: top.location.href, via function bound to top, should be blocked when sandboxed without allow-top-navigation",
+      script: "(function() { top.location.href = 'file_top_navigation_by_location_exotic.html' }).bind(top)();",
+      iframeName: "if1",
+      shouldBeBlocked: true,
+    },
+    {
+      desc: "Test 24: top.location.href, via function bound to top, should NOT be blocked when sandboxed with allow-top-navigation",
+      script: "(function() { top.location.href = 'file_top_navigation_by_location_exotic.html' }).bind(top)();",
+      iframeName: "if2",
+      shouldBeBlocked: false,
+    },
+  ];
+
+  function runNextTest() {
+    ++testCaseIndex;
+    if (testCaseIndex == testCases.length) {
+      testWin.close();
+      SimpleTest.finish();
+      return;
+    }
+
+    runScriptNavigationTest(testCases[testCaseIndex]);
+  }
+
+  window.onmessage = runNextTest;
+  testWin = window.open("file_top_navigation_by_location_exotic.html", "newWindow");
+</script>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=785310">Mozilla Bug 785310</a>
+<p id="display"></p>
+<div id="content">
+Tests for Bug 785310
+</div>
+</body>
+</html>
-- 
cgit v1.2.3