diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
commit | 36d22d82aa202bb199967e9512281e9a53db42c9 (patch) | |
tree | 105e8c98ddea1c1e4784a60a5a6410fa416be2de /browser/components/sessionstore/test/browser_459906.js | |
parent | Initial commit. (diff) | |
download | firefox-esr-upstream.tar.xz firefox-esr-upstream.zip |
Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'browser/components/sessionstore/test/browser_459906.js')
-rw-r--r-- | browser/components/sessionstore/test/browser_459906.js | 79 |
1 files changed, 79 insertions, 0 deletions
diff --git a/browser/components/sessionstore/test/browser_459906.js b/browser/components/sessionstore/test/browser_459906.js new file mode 100644 index 0000000000..e232b59f13 --- /dev/null +++ b/browser/components/sessionstore/test/browser_459906.js @@ -0,0 +1,79 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ +/* eslint-disable mozilla/no-arbitrary-setTimeout */ + +function test() { + /** Test for Bug 459906 **/ + + waitForExplicitFinish(); + + let testURL = + "http://mochi.test:8888/browser/" + + "browser/components/sessionstore/test/browser_459906_sample.html"; + let uniqueValue = "<b>Unique:</b> " + Date.now(); + + var frameCount = 0; + let tab = BrowserTestUtils.addTab(gBrowser, testURL); + tab.linkedBrowser.addEventListener( + "load", + function listener(aEvent) { + // wait for all frames to load completely + if (frameCount++ < 2) { + return; + } + tab.linkedBrowser.removeEventListener("load", listener, true); + + let iframes = tab.linkedBrowser.contentWindow.frames; + // eslint-disable-next-line no-unsanitized/property + iframes[1].document.body.innerHTML = uniqueValue; + + frameCount = 0; + let tab2 = gBrowser.duplicateTab(tab); + tab2.linkedBrowser.addEventListener( + "load", + function loadListener(eventTab2) { + // wait for all frames to load (and reload!) completely + if (frameCount++ < 2) { + return; + } + tab2.linkedBrowser.removeEventListener("load", loadListener, true); + + executeSoon(function innerHTMLPoller() { + let iframesTab2 = tab2.linkedBrowser.contentWindow.frames; + if (iframesTab2[1].document.body.innerHTML !== uniqueValue) { + // Poll again the value, since we can't ensure to run + // after SessionStore has injected innerHTML value. + // See bug 521802. + info("Polling for innerHTML value"); + setTimeout(innerHTMLPoller, 100); + return; + } + + is( + iframesTab2[1].document.body.innerHTML, + uniqueValue, + "rich textarea's content correctly duplicated" + ); + + let innerDomain = null; + try { + innerDomain = iframesTab2[0].document.domain; + } catch (ex) { + /* throws for chrome: documents */ + } + is(innerDomain, "mochi.test", "XSS exploit prevented!"); + + // clean up + gBrowser.removeTab(tab2); + gBrowser.removeTab(tab); + + finish(); + }); + }, + true + ); + }, + true + ); +} |