diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
| commit | 26a029d407be480d791972afb5975cf62c9360a6 (patch) | |
| tree | f435a8308119effd964b339f76abb83a57c29483 /testing/web-platform/tests/content-security-policy/unsafe-eval/eval-in-iframe.html | |
| parent | Initial commit. (diff) | |
| download | firefox-26a029d407be480d791972afb5975cf62c9360a6.tar.xz firefox-26a029d407be480d791972afb5975cf62c9360a6.zip | |
Adding upstream version 124.0.1.upstream/124.0.1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'testing/web-platform/tests/content-security-policy/unsafe-eval/eval-in-iframe.html')
| -rw-r--r-- | testing/web-platform/tests/content-security-policy/unsafe-eval/eval-in-iframe.html | 49 |
1 files changed, 49 insertions, 0 deletions
diff --git a/testing/web-platform/tests/content-security-policy/unsafe-eval/eval-in-iframe.html b/testing/web-platform/tests/content-security-policy/unsafe-eval/eval-in-iframe.html new file mode 100644 index 0000000000..bca5decd25 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/unsafe-eval/eval-in-iframe.html @@ -0,0 +1,49 @@ +<!DOCTYPE html> +<html> + +<head> + <title>eval-in-iframe</title> + <script src="/resources/testharness.js"></script> + <script src="/resources/testharnessreport.js"></script> + <script src="/common/utils.js"></script> +</head> + +<body> + <p>This test checks that the CSP of calleeRealm only (and not of + the callerRealm) is checked for allowing eval.</p> + <script> + let tests = [ + { "directive": "script-src", "csp": "script-src 'unsafe-inline'" }, + { "directive": "default-src", "csp": "default-src 'unsafe-inline'" }, + ]; + + tests.forEach(test => { + let child = document.createElement('iframe'); + child.src = '/content-security-policy/unsafe-eval/support' + + '/echo-eval-with-policy.py?policy=' + encodeURIComponent(test.csp); + document.body.appendChild(child); + let msg = new Promise(resolve => { + window.addEventListener('message', e => { + if (e.source == child.contentWindow) + resolve(e.data); + }); + }); + + promise_test(async t => { + assert_equals((await msg).evalInIframe, "blocked"); + }, `(${test.directive}) Eval code should not execute ` + + `from iframe in iframe`); + promise_test(async t => { + assert_equals((await msg).evalInParent, "allowed"); + }, `(${test.directive}) Eval code should execute ` + + `from iframe in parent`); + promise_test(async t => { + assert_throws_js(child.contentWindow.EvalError, _ => + child.contentWindow.eval('1+1')); + }, `(${test.directive}) Eval code should not execute ` + + `from parent in iframe`); + }); + </script> +</body> + +</html> |