1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
|
/*
* Test for bug 593387
* Loads a chrome document in a content docshell and then inserts a
* X-Frame-Options: DENY iframe into the document and verifies that the document
* loads. The policy we are enforcing is outlined here:
* https://bugzilla.mozilla.org/show_bug.cgi?id=593387#c17
*/
add_task(function* test() {
yield BrowserTestUtils.withNewTab({ gBrowser,
url: "chrome://global/content/mozilla.xhtml" },
function* (newBrowser) {
// NB: We load the chrome:// page in the parent process.
yield testXFOFrameInChrome(newBrowser);
// Run next test (try the same with a content top-level context)
yield BrowserTestUtils.loadURI(newBrowser, "http://example.com/");
yield BrowserTestUtils.browserLoaded(newBrowser);
yield ContentTask.spawn(newBrowser, null, testXFOFrameInContent);
});
});
function testXFOFrameInChrome(newBrowser) {
// Insert an iframe that specifies "X-Frame-Options: DENY" and verify
// that it loads, since the top context is chrome
var deferred = {};
deferred.promise = new Promise((resolve) => {
deferred.resolve = resolve;
});
var frame = newBrowser.contentDocument.createElement("iframe");
frame.src = "http://mochi.test:8888/tests/dom/base/test/file_x-frame-options_page.sjs?testid=deny&xfo=deny";
frame.addEventListener("load", function loaded() {
frame.removeEventListener("load", loaded, true);
// Test that the frame loaded
var test = this.contentDocument.getElementById("test");
is(test.tagName, "H1", "wrong element type");
is(test.textContent, "deny", "wrong textContent");
deferred.resolve();
}, true);
newBrowser.contentDocument.body.appendChild(frame);
return deferred.promise;
}
function testXFOFrameInContent(newBrowser) {
// Insert an iframe that specifies "X-Frame-Options: DENY" and verify that it
// is blocked from loading since the top browsing context is another site
var deferred = {};
deferred.promise = new Promise((resolve) => {
deferred.resolve = resolve;
});
var frame = content.document.createElement("iframe");
frame.src = "http://mochi.test:8888/tests/dom/base/test/file_x-frame-options_page.sjs?testid=deny&xfo=deny";
frame.addEventListener("load", function loaded() {
frame.removeEventListener("load", loaded, true);
// Test that the frame DID NOT load
var test = this.contentDocument.getElementById("test");
Assert.equal(test, null, "should be about:blank");
deferred.resolve();
}, true);
content.document.body.appendChild(frame);
return deferred.promise;
}
|
