blob: cf1f099c63e22d282a4fe0ae80c3b31209215cbd (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
<!doctype html>
<title>Referrer Policy: iframes with javascript url reuse referrer policy</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/get-host-info.sub.js"></script>
<script src="resources/make-html-script.js"></script>
<meta name="referrer" content="unsafe-url">
<div id="log"></div>
<script>
[
{
fetchReferrer: "",
// Because the URL of the Document of <iframe src="javascript:..."> is
// "about:blank", the stripped URL is no referrer:
// https://w3c.github.io/webappsec-referrer-policy/#strip-url.
expected: undefined
},
{
fetchReferrer: location.origin+"/custom",
// <iframe src="javascript:..."> inherits its parent's referrer policy.
// Note: Setting an explicit URL as referrer succeeds
// because the same-origin check at
// https://fetch.spec.whatwg.org/#dom-request
// is done against <iframe>'s origin, which inherits the parent
// Document's origin == location.orgin. Furthermore, since the iframe
// inherits its parent's referrer policy, the URL should be restricted to
// its origin.
expected: self.origin + "/custom"
}
].forEach(({ fetchReferrer, expected }) => {
promise_test(t => {
return new Promise(resolve => {
window.addEventListener("message", t.step_func(msg => {
assert_equals(msg.data.referrer, expected);
resolve();
}), { once: true });
const iframe = document.createElement("iframe");
iframe.src = `javascript:'${createScriptString(get_host_info().REMOTE_ORIGIN, fetchReferrer)}'`;
document.body.appendChild(iframe);
});
});
});
</script>
|
