summaryrefslogtreecommitdiffstats
path: root/browser/components/sessionstore/test/browser_459906.js
diff options
context:
space:
mode:
Diffstat (limited to 'browser/components/sessionstore/test/browser_459906.js')
-rw-r--r--browser/components/sessionstore/test/browser_459906.js62
1 files changed, 62 insertions, 0 deletions
diff --git a/browser/components/sessionstore/test/browser_459906.js b/browser/components/sessionstore/test/browser_459906.js
new file mode 100644
index 000000000..cadab3e5c
--- /dev/null
+++ b/browser/components/sessionstore/test/browser_459906.js
@@ -0,0 +1,62 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+function test() {
+ /** Test for Bug 459906 **/
+
+ waitForExplicitFinish();
+
+ let testURL = "http://mochi.test:8888/browser/" +
+ "browser/components/sessionstore/test/browser_459906_sample.html";
+ let uniqueValue = "<b>Unique:</b> " + Date.now();
+
+ var frameCount = 0;
+ let tab = gBrowser.addTab(testURL);
+ tab.linkedBrowser.addEventListener("load", function(aEvent) {
+ // wait for all frames to load completely
+ if (frameCount++ < 2)
+ return;
+ tab.linkedBrowser.removeEventListener("load", arguments.callee, true);
+
+ let iframes = tab.linkedBrowser.contentWindow.frames;
+ iframes[1].document.body.innerHTML = uniqueValue;
+
+ frameCount = 0;
+ let tab2 = gBrowser.duplicateTab(tab);
+ tab2.linkedBrowser.addEventListener("load", function(aEvent) {
+ // wait for all frames to load (and reload!) completely
+ if (frameCount++ < 2)
+ return;
+ tab2.linkedBrowser.removeEventListener("load", arguments.callee, true);
+
+ executeSoon(function() {
+ let iframes = tab2.linkedBrowser.contentWindow.frames;
+ if (iframes[1].document.body.innerHTML !== uniqueValue) {
+ // Poll again the value, since we can't ensure to run
+ // after SessionStore has injected innerHTML value.
+ // See bug 521802.
+ info("Polling for innerHTML value");
+ setTimeout(arguments.callee, 100);
+ return;
+ }
+
+ is(iframes[1].document.body.innerHTML, uniqueValue,
+ "rich textarea's content correctly duplicated");
+
+ let innerDomain = null;
+ try {
+ innerDomain = iframes[0].document.domain;
+ }
+ catch (ex) { /* throws for chrome: documents */ }
+ is(innerDomain, "mochi.test", "XSS exploit prevented!");
+
+ // clean up
+ gBrowser.removeTab(tab2);
+ gBrowser.removeTab(tab);
+
+ finish();
+ });
+ }, true);
+ }, true);
+}