1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
|
<!DOCTYPE HTML>
<html>
<head>
<title>Bug 1454027 - Update SameSite cookie handling inside iframes</title>
<script src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<img id="cookieImage">
<iframe id="testframe"></iframe>
<script class="testbody" type="text/javascript">
/*
* Description of the test:
* 1) We load an image from http://mochi.test which sets a same site cookie
* 2) We then load the following iframes:
* (a) cross-origin iframe
* (b) sandboxed iframe
* (c) data: URI iframe
* (d) same origin iframe which loads blob: URI iframe (to simulate same origin blobs)
* (e) cross origin iframe which loads blob: URI iframe (to simulate cross origin blobs)
* which all:
* * navigate the iframe to http://mochi.test
* * include another iframe from http://mochi.test
* 3) We observe that none of the nested iframes have access to the same-site cookie.
*/
SimpleTest.waitForExplicitFinish();
const SAME_ORIGIN = "http://mochi.test:8888/"
const CROSS_ORIGIN = "http://example.com/";
const PATH = "tests/dom/security/test/general/";
const SERVER_FILE = "file_same_site_cookies_iframe.sjs";
const NESTED_DATA_IFRAME_NAVIGATION = `
data:text/html,
<html>
<body>
<a id="testlink" href="http://mochi.test:8888/tests/dom/security/test/general/file_same_site_cookies_iframe.sjs"></a>
<script type="application/javascript">
let link = document.getElementById("testlink");
link.click();
<\/script>
</body>
</html>`;
const NESTED_DATA_IFRAME_INCLUSION = `
data:text/html,
<html>
<body>
<script type="application/javascript">
window.addEventListener("message", receiveMessage);
function receiveMessage(event) {
window.removeEventListener("message", receiveMessage);
window.parent.postMessage({result: event.data.result}, '*');
}
<\/script>
<iframe src="http://mochi.test:8888/tests/dom/security/test/general/file_same_site_cookies_iframe.sjs"></iframe>
</body>
</html>`;
let curTest = 0;
var tests = [
// NAVIGATION TESTS
{
description: "nested same origin iframe navigation [mochi.test -> mochi.test -> mochi.test]",
frameSRC: SAME_ORIGIN + PATH + SERVER_FILE + "?nestedIframeNavigation",
result: "myKey=mySameSiteIframeTestCookie", // cookie should be set for baseline test
},
{
description: "nested cross origin iframe navigation [mochi.test -> example.com -> mochi.test]",
frameSRC: CROSS_ORIGIN + PATH + SERVER_FILE + "?nestedIframeNavigation",
result: "", // no cookie should be set
},
{
description: "nested sandboxed iframe navigation [mochi.test -> sandbox -> mochi.test]",
frameSRC: CROSS_ORIGIN + PATH + SERVER_FILE + "?nestedSandboxIframeNavigation",
result: "", // no cookie should be set
},
{
description: "nested data iframe navigation [mochi.test -> data: -> mochi.test]",
frameSRC: NESTED_DATA_IFRAME_NAVIGATION,
result: "", // no cookie should be set
},
{
description: "nested same site blob iframe navigation [mochi.test -> mochi.test -> blob: -> mochi.test]",
frameSRC: SAME_ORIGIN + PATH + "file_same_site_cookies_blob_iframe_navigation.html",
result: "myKey=mySameSiteIframeTestCookie", // cookie should be set, blobs inherit security context
},
{
description: "nested cross site blob iframe navigation [mochi.test -> example.com -> blob: -> mochi.test]",
frameSRC: CROSS_ORIGIN + PATH + "file_same_site_cookies_blob_iframe_navigation.html",
result: "", // no cookie should be set
},
// INCLUSION TESTS
{
description: "nested same origin iframe inclusion [mochi.test -> mochi.test -> mochi.test]",
frameSRC: SAME_ORIGIN + PATH + SERVER_FILE + "?nestedIframeInclusion",
result: "myKey=mySameSiteIframeTestCookie", // cookie should be set for baseline test
},
{
description: "nested cross origin iframe inclusion [mochi.test -> example.com -> mochi.test]",
frameSRC: CROSS_ORIGIN + PATH + SERVER_FILE + "?nestedIframeInclusion",
result: "", // no cookie should be set
},
{
description: "nested sandboxed iframe inclusion [mochi.test -> sandbox -> mochi.test]",
frameSRC: CROSS_ORIGIN + PATH + SERVER_FILE + "?nestedSandboxIframeInclusion",
result: "", // no cookie should be set
},
{
description: "nested data iframe inclusion [mochi.test -> data: -> mochi.test]",
frameSRC: NESTED_DATA_IFRAME_INCLUSION,
result: "", // no cookie should be set
},
{
description: "nested same site blob iframe inclusion [mochi.test -> mochi.test -> blob: -> mochi.test]",
frameSRC: SAME_ORIGIN + PATH + "file_same_site_cookies_blob_iframe_inclusion.html",
result: "myKey=mySameSiteIframeTestCookie", // cookie should be set, blobs inherit security context
},
{
description: "same-site cookie, nested cross site blob iframe inclusion [mochi.test -> example.com -> blob: -> mochi.test]",
frameSRC: CROSS_ORIGIN + PATH + "file_same_site_cookies_blob_iframe_inclusion.html",
result: "", // no cookie should be set
},
];
window.addEventListener("message", receiveMessage);
function receiveMessage(event) {
is(event.data.result, tests[curTest].result, tests[curTest].description);
curTest += 1;
// // lets see if we ran all the tests
if (curTest == tests.length) {
window.removeEventListener("message", receiveMessage);
SimpleTest.finish();
return;
}
// otherwise it's time to run the next test
setCookieAndInitTest();
}
function setupQueryResultAndRunTest() {
let testframe = document.getElementById("testframe");
testframe.src = tests[curTest].frameSRC;
}
function setCookieAndInitTest() {
var cookieImage = document.getElementById("cookieImage");
cookieImage.onload = function() {
ok(true, "trying to set cookie for test (" + tests[curTest].description + ")");
setupQueryResultAndRunTest();
}
cookieImage.onerror = function() {
ok(false, "could not load image for test (" + tests[curTest].description + ")");
}
// appending math.random to avoid any unexpected caching behavior
cookieImage.src = SAME_ORIGIN + PATH + SERVER_FILE + "?setSameSiteCookie" + Math.random();
}
// fire up the test
setCookieAndInitTest();
</script>
</body>
</html>
|
