blob: 292d100b2fc7d2274a9e1bbf3dec85ed67f4fb32 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
<!doctype html>
<meta charset="utf-8">
<title>
Async Clipboard write ([image/svg+xml ClipboardItem]) -> readSvg (and remove scripts) tests
</title>
<link rel="help" href="https://w3c.github.io/clipboard-apis/#async-clipboard-api">
<body>Body needed for test_driver.click()</body>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/resources/testdriver.js"></script>
<script src="/resources/testdriver-vendor.js"></script>
<script src="resources/user-activation.js"></script>
<script>
'use strict';
// This function removes extra spaces between tags in svg. For example, the
// following svg: "<svg> <g> </g> </svg>" would turn into this
// svg: "<svg> <g> </g> </svg>"
// We remove the extra spaces because in svg they are considered equivalent,
// but when we are comparing for equality the spaces make a difference.
function reformatSvg(svg) {
const parser = new DOMParser();
const svgString =
parser.parseFromString(svg, 'text/html').documentElement.innerHTML;
const reformattedString = svgString.replace(/\>\s*\</g, '> <');
return reformattedString;
}
// The string must be concatenated in this way because the html parser
// will recognize a script tag even in quotes as a real script tag. By
// splitting it up in this way we avoid that error.
const svg_with_script =
`<svg> <script>const a = 5;</scr' + 'ipt>
<a href="javascript:alert(2)"> test </a> </svg>`;
const svg_without_script =
`<svg> </svg>`;
promise_test(async t => {
await test_driver.set_permission({name: 'clipboard-read'}, 'granted');
await test_driver.set_permission({name: 'clipboard-write'}, 'granted');
const blobInput = new Blob([svg_with_script], {type: 'image/svg+xml'});
const clipboardItem = new ClipboardItem({'image/svg+xml': blobInput});
await waitForUserActivation();
await navigator.clipboard.write([clipboardItem]);
await waitForUserActivation();
const clipboardItems =
await navigator.clipboard.read({type: 'image/svg+xml'});
const svg = clipboardItems[0];
assert_equals(svg.types.length, 1);
assert_equals(svg.types[0], 'image/svg+xml');
const blobOutput = await svg.getType('image/svg+xml');
assert_equals(blobOutput.type, 'image/svg+xml');
const blobText = await (new Response(blobOutput)).text();
const outputSvg = reformatSvg(blobText);
const inputSvg = reformatSvg(svg_without_script);
assert_equals(outputSvg, inputSvg);
}, 'Verify write and read clipboard with scripts removed given image/svg+xml: '
+ svg_with_script);
</script>
|
