1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
<!DOCTYPE html>
<html>
<head>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
</head>
<body>
<script>
// Sandbox flags are inherited from a document toward every frame it creates,
// which then is inherited to every new document created in this frame.
//
// Using the flag 'allow-popups-to-escape-sandbox' inhibits this inheritance
// mechanism when the new frame is a popup.
//
// Sandbox flags are not inherited from the initiator/creator when loading a
// local scheme document unlike CSP (tested in
// ./sandbox-inherit-to-blank-document-unsandboxed.html)
//
// This tests in particular the initial empty document and the first
// about:blank navigation and verifies that no sandbox is applied on the
// popups.
promise_test(async test => {
const msg = await new Promise(r => window.addEventListener("message", r));
assert_false(msg.data.access_initial_navigation_to_about_blank_throws,
"Failed to access initial about:blank popup, it is probably sandboxed"
);
assert_false(msg.data.access_first_navigation_to_about_blank_throws,
"Failed to access navigation to about:blank, it is probably sandboxed"
);
assert_false(msg.data.access_after_delay_initial_navigation_to_about_blank_throws,
"Failed to access navigation to about:blank, it is probably sandboxed"
);
assert_false(msg.data.access_after_delay_first_navigation_to_about_blank_throws,
"Failed to access navigation to about:blank, it is probably sandboxed"
);
}, "Popup do not inherit sandbox, because of " +
"'allow-popups-to-escape-sandbox'. The document isn't sandboxed.")
</script>
<iframe
sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox"
srcdoc="
<script>
let access_initial_navigation_to_about_blank_throws = false;
let access_first_navigation_to_about_blank_throws = false;
let access_after_delay_initial_navigation_to_about_blank_throws = false;
let access_after_delay_first_navigation_to_about_blank_throws = false;
const initial_about_blank_window =
window.open('/common/blank.html?pipe=status(204)');
try {
initial_about_blank_window.origin;
} catch(e) {
access_initial_navigation_to_about_blank_throws = true;
}
const renavigated_about_blank_window = window.open('about:blank');
try {
renavigated_about_blank_window.origin;
} catch(e) {
access_first_navigation_to_about_blank_throws = true;
}
setTimeout(() => {
try {
initial_about_blank_window.origin;
} catch(e) {
access_after_delay_initial_navigation_to_about_blank_throws = true;
}
try {
renavigated_about_blank_window.origin;
} catch(e) {
access_after_delay_first_navigation_to_about_blank_throws = true;
}
top.postMessage({
'access_initial_navigation_to_about_blank_throws':
access_initial_navigation_to_about_blank_throws,
'access_first_navigation_to_about_blank_throws':
access_first_navigation_to_about_blank_throws,
'access_after_delay_initial_navigation_to_about_blank_throws':
access_after_delay_initial_navigation_to_about_blank_throws,
'access_after_delay_first_navigation_to_about_blank_throws':
access_after_delay_first_navigation_to_about_blank_throws
}, '*');
}, 500);
</script>"
>
</iframe>
</body>
</html>
|
