summaryrefslogtreecommitdiffstats
path: root/dom/html/test/test_iframe_sandbox_inheritance.html
diff options
context:
space:
mode:
authorMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
committerMatt A. Tobin <mattatobin@localhost.localdomain>2018-02-02 04:16:08 -0500
commit5f8de423f190bbb79a62f804151bc24824fa32d8 (patch)
tree10027f336435511475e392454359edea8e25895d /dom/html/test/test_iframe_sandbox_inheritance.html
parent49ee0794b5d912db1f95dce6eb52d781dc210db5 (diff)
downloadUXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.gz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.lz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.tar.xz
UXP-5f8de423f190bbb79a62f804151bc24824fa32d8.zip
Add m-esr52 at 52.6.0
Diffstat (limited to 'dom/html/test/test_iframe_sandbox_inheritance.html')
-rw-r--r--dom/html/test/test_iframe_sandbox_inheritance.html203
1 files changed, 203 insertions, 0 deletions
diff --git a/dom/html/test/test_iframe_sandbox_inheritance.html b/dom/html/test/test_iframe_sandbox_inheritance.html
new file mode 100644
index 000000000..ddf45f70b
--- /dev/null
+++ b/dom/html/test/test_iframe_sandbox_inheritance.html
@@ -0,0 +1,203 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=341604
+Implement HTML5 sandbox attribute for IFRAMEs - inheritance tests
+-->
+<head>
+ <meta charset="utf-8">
+ <title>Test for Bug 341604</title>
+ <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+ <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<script type="application/javascript">
+/** Test for Bug 341604 - Implement HTML5 sandbox attribute for IFRAMEs **/
+/** Inheritance Tests **/
+
+SimpleTest.waitForExplicitFinish();
+SimpleTest.requestFlakyTimeout("untriaged");
+
+// A postMessage handler that is used by sandboxed iframes without
+// 'allow-same-origin' to communicate pass/fail back to this main page.
+// It expects to be called with an object like {ok: true/false, desc:
+// <description of the test> which it then forwards to ok().
+window.addEventListener("message", receiveMessage, false);
+
+function receiveMessage(event) {
+ switch (event.data.type) {
+ case "attempted":
+ testAttempted();
+ break;
+ case "ok":
+ ok_wrapper(event.data.ok, event.data.desc, event.data.addToAttempted);
+ break;
+ default:
+ // allow for old style message
+ if (event.data.ok != undefined) {
+ ok_wrapper(event.data.ok, event.data.desc, event.data.addToAttempted);
+ }
+ }
+}
+
+var attemptedTests = 0;
+var passedTests = 0;
+var totalTestsToPass = 15;
+var totalTestsToAttempt = 19;
+
+function ok_wrapper(result, desc, addToAttempted = true) {
+ ok(result, desc);
+
+ if (result) {
+ passedTests++;
+ }
+
+ if (addToAttempted) {
+ testAttempted();
+ }
+}
+
+// Added so that tests that don't register unless they fail,
+// can at least notify that they've attempted to run.
+function testAttempted() {
+ attemptedTests++;
+ if (attemptedTests == totalTestsToAttempt) {
+ // Make sure all tests have had a chance to complete.
+ setTimeout(function() {finish();}, 1000);
+ }
+}
+
+var finishCalled = false;
+
+function finish() {
+ if (!finishCalled) {
+ finishCalled = true;
+ is(passedTests, totalTestsToPass, "There are " + totalTestsToPass + " inheritance tests that should pass");
+
+ SimpleTest.finish();
+ }
+}
+
+function doTest() {
+ // fails if bad
+ // 1) an iframe with no sandbox attribute inside an iframe that has sandbox = ""
+ // should not be able to execute scripts (cannot ever loosen permissions)
+ // (done by file_iframe_sandbox_a_if2.html contained within file_iframe_sandbox_a_if1.html)
+ testAttempted();
+
+ // fails if bad
+ // 2) an iframe with sandbox = "allow-scripts" inside an iframe that has sandbox = ""
+ // should not be able to execute scripts (cannot ever loosen permissions)
+ // (done by file_iframe_sandbox_a_if2.html contained within file_iframe_sandbox_a_if1.html)
+ testAttempted();
+
+ // passes if good and fails if bad
+ // 3) an iframe with no sandbox attribute inside an iframe that has sandbox = "allow-scripts"
+ // should not be same origin with the top window
+ // (done by file_iframe_sandbox_a_if4.html contained within file_iframe_sandbox_a_if3.html)
+
+ // passes if good and fails if bad
+ // 4) an iframe with no sandbox attribute inside an iframe that has sandbox = "allow-scripts"
+ // should not be same origin with its parent
+ // (done by file_iframe_sandbox_a_if4.html contained within file_iframe_sandbox_a_if3.html)
+
+ // passes if good
+ // 5) an iframe with 'allow-same-origin' and 'allow-scripts' inside an iframe with 'allow-same-origin'
+ // and 'allow-scripts' should be same origin with the top window
+ // (done by file_iframe_sandbox_a_if6.html contained within file_iframe_sandbox_a_if5.html)
+
+ // passes if good
+ // 6) an iframe with 'allow-same-origin' and 'allow-scripts' inside an iframe with 'allow-same-origin'
+ // and 'allow-scripts' should be same origin with its parent
+ // (done by file_iframe_sandbox_a_if6.html contained within file_iframe_sandbox_a_if5.html)
+
+ // passes if good
+ // 7) an iframe with no sandbox attribute inside an iframe that has sandbox = "allow-scripts"
+ // should be able to execute scripts
+ // (done by file_iframe_sandbox_a_if7.html contained within file_iframe_sandbox_a_if3.html)
+
+ // fails if bad
+ // 8) an iframe with sandbox="" inside an iframe that has allow-scripts should not be able
+ // to execute scripts
+ // (done by file_iframe_sandbox_a_if2.html contained within file_iframe_sandbox_a_if3.html)
+ testAttempted();
+
+ // passes if good
+ // 9) make sure that changing the sandbox flags on an iframe (if_8) doesn't affect
+ // the sandboxing of subloads of content within that iframe
+ var if_8 = document.getElementById('if_8');
+ if_8.sandbox = 'allow-scripts';
+ if_8.contentWindow.doSubload();
+
+ // passes if good
+ // 10) a <frame> inside an <iframe> sandboxed with 'allow-scripts' should not be same
+ // origin with this document
+ // done by file_iframe_sandbox_a_if11.html which is contained with file_iframe_sandbox_a_if10.html
+
+ // passes if good
+ // 11) a <frame> inside a <frame> inside an <iframe> sandboxed with 'allow-scripts' should not be same
+ // origin with its parent frame or this document
+ // done by file_iframe_sandbox_a_if12.html which is contained with file_iframe_sandbox_a_if11.html
+
+ // passes if good, fails if bad
+ // 12) An <object> inside an <iframe> sandboxed with 'allow-scripts' should not be same
+ // origin with this document
+ // Done by file_iframe_sandbox_a_if14.html which is contained within file_iframe_sandbox_a_if13.html
+
+ // passes if good, fails if bad
+ // 13) An <object> inside an <object> inside an <iframe> sandboxed with 'allow-scripts' should not be same
+ // origin with its parent frame or this document
+ // Done by file_iframe_sandbox_a_if15.html which is contained within file_iframe_sandbox_a_if14.html
+
+ // passes if good, fails if bad
+ // 14) An <object> inside a <frame> inside an <iframe> sandboxed with 'allow-scripts' should not be same
+ // origin with its parent frame or this document
+ // Done by file_iframe_sandbox_a_if15.html which is contained within file_iframe_sandbox_a_if16.html
+ // which is contained within file_iframe_sandbox_a_if10.html
+
+ // passes if good
+ // 15) An <object> inside an <object> inside an <iframe> sandboxed with 'allow-scripts allow-forms'
+ // should be able to submit forms.
+ // Done by file_iframe_sandbox_a_if15.html which is contained within file_iframe_sandbox_a_if14.html
+
+ // passes if good
+ // 16) An <object> inside a <frame> inside an <iframe> sandboxed with 'allow-scripts allow-forms'
+ // should be able to submit forms.
+ // Done by file_iframe_sandbox_a_if15.html which is contained within file_iframe_sandbox_a_if16.html
+ // which is contained within file_iframe_sandbox_a_if10.html
+
+ // fails if bad
+ // 17) An <object> inside an <iframe> sandboxed with 'allow-same-origin'
+ // should not be able to run scripts.
+ // Done by iframe "if_no_scripts" using a data: load.
+ testAttempted();
+
+ // passes if good
+ // 18) An <object> inside an <iframe> sandboxed with 'allow-scripts allow-same-origin'
+ // should be able to run scripts and be same origin with this document.
+ // Done by iframe "if_scripts" using a data: load.
+
+ // passes if good, fails if bad
+ // 19) Make sure that the parent's document's sandboxing flags are copied when
+ // changing the sandbox flags on an iframe inside an iframe.
+ // Done in file_iframe_sandbox_a_if17.html and file_iframe_sandbox_a_if18.html
+}
+
+addLoadEvent(doTest);
+</script>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=341604">Mozilla Bug 341604</a> - Implement HTML5 sandbox attribute for IFRAMEs
+<p id="display"></p>
+<div id="content">
+<iframe sandbox="" id="if_1" src="file_iframe_sandbox_a_if1.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts" id="if_3" src="file_iframe_sandbox_a_if3.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts allow-same-origin" id="if_5" src="file_iframe_sandbox_a_if5.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts allow-same-origin" id="if_8" src="file_iframe_sandbox_a_if8.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts allow-forms" id="if_10" src="file_iframe_sandbox_a_if10.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts allow-forms" id="if_13" src="file_iframe_sandbox_a_if13.html" height="10" width="10"></iframe>
+<iframe sandbox="allow-same-origin" id="if_no_scripts" src="data:text/html,<object%20data='data:text/html,<script>parent.parent.ok_wrapper(false, &quot;an object inside an iframe sandboxed with only allow-same-origin should not be able to run scripts&quot;)</script>'></object>" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts allow-same-origin" id="if_scripts" src="data:text/html,<object%20data='data:text/html,<script>parent.parent.ok_wrapper(true, &quot;an object inside an iframe sandboxed with allow-scripts allow-same-origin should be able to run scripts and call functions in the parent of the iframe&quot;)</script>'></object>" height="10" width="10"></iframe>
+<iframe sandbox="allow-same-origin" id="if_19" src="data:text/html,<iframe%20data='data:text/html,<script>parent.parent.ok_wrapper(true, &quot;an object inside an iframe sandboxed with allow-scripts allow-same-origin should be able to run scripts and call functions in the parent of the iframe&quot;)</script>'></object>" height="10" width="10"></iframe>
+<iframe sandbox="allow-scripts" id="if_17" src="file_iframe_sandbox_a_if17.html" height="10" width="10"></iframe>
+</div>
+</body>
+</html>
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-16 15:58:21 +0000