1 files changed, 48 insertions, 0 deletions
diff --git a/testing/web-platform/tests/html/cross-origin-embedder-policy/require-corp-about-srcdoc.https.html b/testing/web-platform/tests/html/cross-origin-embedder-policy/require-corp-about-srcdoc.https.html
new file mode 100644
index 0000000000..5d06286d91
--- /dev/null
+++ b/testing/web-platform/tests/html/cross-origin-embedder-policy/require-corp-about-srcdoc.https.html
@@ -0,0 +1,48 @@
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script>
+
+promise_test(t => {
+  return new Promise(resolve => {
+    window.addEventListener("DOMContentLoaded", resolve);
+  });
+}, "Wait for the DOM to be built.");
+
+promise_test(async t => {
+  let iframe = document.createElement("iframe");
+  let iframe_loaded =  new Promise(resolve => iframe.onload = resolve);
+  iframe.srcdoc = "loaded document";
+  document.body.appendChild(iframe);
+
+  // The about:srcdoc document can load.
+  await iframe_loaded;
+  assert_not_equals(iframe.contentDocument, null);
+  assert_equals(iframe.contentDocument.body.innerText, "loaded document");
+}, "about:srcdoc can always be embedded by a 'require-corp' document");
+
+promise_test(async t => {
+  let iframe_C = document.createElement("iframe");
+  let iframe_B = document.createElement("iframe");
+  iframe_B.srcdoc = "dummy content";
+  iframe_C.src = "/common/blank.html";
+  let iframe_B_loaded = new Promise(resolve => iframe_B.onload = resolve);
+  document.body.appendChild(iframe_B);
+
+  // The about:srcdoc frame must be able to load.
+  await iframe_B_loaded;
+  assert_not_equals(iframe_B.contentDocument, null);
+  assert_equals(iframe_B.contentDocument.body.innerText, "dummy content");
+  iframe_B.contentDocument.body.appendChild(iframe_C);
+
+  // The document nested under about:srcdoc must not load because it does not
+  // specify the Cross-Origin-Embedder-Policy: require-corp header.
+  // An error page must be displayed instead.
+  // See https://github.com/whatwg/html/issues/125 for why a timeout is used
+  // here. Long term all network error handling should be similar and have a
+  // reliable event.
+  assert_equals(iframe_C.contentWindow.location.href, "about:blank");
+  assert_not_equals(iframe_C.contentDocument, null);
+  await t.step_wait(() => iframe_C.contentDocument === null);
+}, "A(B(C)) A=require-corp, B=about:srcdoc, C=no-require-corp => C can't load");
+
+</script>