diff options
Diffstat (limited to 'testing/web-platform/tests/trusted-types/modify-attributes-in-callback.html')
-rw-r--r-- | testing/web-platform/tests/trusted-types/modify-attributes-in-callback.html | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/testing/web-platform/tests/trusted-types/modify-attributes-in-callback.html b/testing/web-platform/tests/trusted-types/modify-attributes-in-callback.html new file mode 100644 index 0000000000..96b4501128 --- /dev/null +++ b/testing/web-platform/tests/trusted-types/modify-attributes-in-callback.html @@ -0,0 +1,39 @@ +<!DOCTYPE html> +<head> + <script src="/resources/testharness.js"></script> + <script src="/resources/testharnessreport.js"></script> + <meta http-equiv="Content-Security-Policy" + content="require-trusted-types-for 'script'; trusted-types *"> +</head> +<body> +<iframe id="iframe" data-x="" srcdoc="content" onmouseover=""></iframe> +<script> + // This is a regression test for https://g-issues.chromium.org/issues/333739948 + // The test should hold true for any browser that supports Trusted Types. + + let target = "data-x"; + trustedTypes.createPolicy("default", { + createHTML: (s) => { + iframe.removeAttribute(target); + return s; + } + }); + + test(t => { + // Original bug report: Delete an attribute *before* the current one. + assert_equals(iframe.srcdoc, "content"); + assert_equals(iframe.getAttribute("onmouseover"), ""); + iframe.setAttribute("srcdoc", "alert(1)"); + assert_equals(iframe.srcdoc, "alert(1)"); + assert_equals(iframe.getAttribute("onmouseover"), ""); + }, "Ensure the right attributes are modified."); + + test(t => { + // Second case: Delete the exact attribute. It still gets set. + target = "srcdoc"; + assert_equals(iframe.srcdoc, "alert(1)"); + iframe.setAttribute("srcdoc", "new srcdoc value"); + assert_equals(iframe.srcdoc, "new srcdoc value"); + }, "Ensure the deleted attributes is modified."); + +</script> |