diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
| commit | 36d22d82aa202bb199967e9512281e9a53db42c9 (patch) | |
| tree | 105e8c98ddea1c1e4784a60a5a6410fa416be2de /testing/web-platform/tests/html/browsers/sandboxing/sandbox-disallow-scripts-via-unsandboxed-popup.tentative.html | |
| parent | Initial commit. (diff) | |
| download | firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip | |
Adding upstream version 115.7.0esr.upstream/115.7.0esr
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'testing/web-platform/tests/html/browsers/sandboxing/sandbox-disallow-scripts-via-unsandboxed-popup.tentative.html')
| -rw-r--r-- | testing/web-platform/tests/html/browsers/sandboxing/sandbox-disallow-scripts-via-unsandboxed-popup.tentative.html | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/testing/web-platform/tests/html/browsers/sandboxing/sandbox-disallow-scripts-via-unsandboxed-popup.tentative.html b/testing/web-platform/tests/html/browsers/sandboxing/sandbox-disallow-scripts-via-unsandboxed-popup.tentative.html new file mode 100644 index 0000000000..3c8c0b346a --- /dev/null +++ b/testing/web-platform/tests/html/browsers/sandboxing/sandbox-disallow-scripts-via-unsandboxed-popup.tentative.html @@ -0,0 +1,33 @@ +<!DOCTYPE html> +<script src="/resources/testharness.js"></script> +<script src="/resources/testharnessreport.js"></script> +<body> + <script> + async_test(t => { + let i = document.createElement('iframe'); + i.sandbox = "allow-same-origin allow-popups allow-popups-to-escape-sandbox"; + i.srcdoc = `<a target='_blank' rel='opener' + href="javascript:window.opener.top.postMessage('FAIL', '*');">Click me!</a> + <a target='_blank' rel='opener' + href="./resources/post-done-to-opener.html">Click me next!</a>`; + + i.onload = _ => { + // Since the frame is sandboxed, but allow-same-origin, we can reach into it to grab the + // anchor element to click. We'll click the `javascript:` URL first, then pop up a new + // window that posts `DONE`. + // + // TODO(mkwst): This feels like a race, but it's one that we consistently win when I'm + // running the test locally 10,000 times. Good enough!™ + i.contentDocument.body.querySelectorAll('a')[0].click(); + i.contentDocument.body.querySelectorAll('a')[1].click(); + }; + document.body.appendChild(i); + + window.addEventListener('message', t.step_func(e => { + assert_not_equals(e.data, "FAIL"); + if (e.data == "DONE") + t.done(); + })); + }, "Sandboxed => unsandboxed popup"); + </script> +</body> |