From 0ebf5bdf043a27fd3dfb7f92e0cb63d88954c44d Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Fri, 19 Apr 2024 03:47:29 +0200
Subject: Adding upstream version 115.8.0esr.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 .../inheritance/frame-src-javascript-url.html      | 40 ++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 testing/web-platform/tests/content-security-policy/inheritance/frame-src-javascript-url.html

(limited to 'testing/web-platform/tests/content-security-policy/inheritance/frame-src-javascript-url.html')
diff --git a/testing/web-platform/tests/content-security-policy/inheritance/frame-src-javascript-url.html b/testing/web-platform/tests/content-security-policy/inheritance/frame-src-javascript-url.html
new file mode 100644
index 0000000000..b08da85e87
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/inheritance/frame-src-javascript-url.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<meta http-equiv="Content-Security-Policy" content="frame-src 'none'">
+
+<script>
+  const iframe_url = new URL("./support/empty.html", location.href);
+
+  // Regression test for: https://crbug.com/1064676
+  promise_test(async (t) => {
+    await new Promise(r => window.onload = r);
+
+    let url = `javascript:
+
+      window.addEventListener('securitypolicyviolation', e => {
+        parent.postMessage({
+          originalPolicy: e.originalPolicy,
+          blockedURI: e.blockedURI,
+        });
+      });
+
+      let iframe = document.createElement('iframe');
+      iframe.src = '${iframe_url}';
+      document.body.appendChild(iframe);
+
+    `;
+
+    let iframe = document.createElement('iframe');
+    iframe.src = encodeURI(url.replace(/\n/g, ""));
+
+    let violation = new Promise(r => window.addEventListener("message", r));
+    document.body.appendChild(iframe);
+    let {data} = await violation;
+
+    assert_equals(data.originalPolicy, "frame-src 'none'");
+    assert_equals(data.blockedURI, iframe_url.toString());
+
+  }, "<iframe src='javascript:...'>'s inherits policy (dynamically inserted <iframe> is blocked)");
+
+</script>
-- 
cgit v1.2.3

