tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

commit 9e2bd6b599eab198b8d575033aca4b4843eb50b6
parent 4f1d962f0a3435ce74bfa528fa29516cc41de9b3
Author: Alexandru Marc <amarc@mozilla.com>
Date:   Fri, 24 Oct 2025 11:29:41 +0300

Revert "Bug 1982320: WPT for fullscreen permission on navigating iframe r=saschanaz" for causing wpt failures @ navigate-iframe.sub.html

This reverts commit a5055272bbfcd18670cd384fa3510b942c082a0c.

Diffstat:
Dtesting/web-platform/tests/fullscreen/api/navigate-iframe.sub.html | 70----------------------------------------------------------------------
Dtesting/web-platform/tests/fullscreen/api/resources/navigate.sub.html | 24------------------------
2 files changed, 0 insertions(+), 94 deletions(-)

diff --git a/testing/web-platform/tests/fullscreen/api/navigate-iframe.sub.html b/testing/web-platform/tests/fullscreen/api/navigate-iframe.sub.html @@ -1,69 +0,0 @@ -<!DOCTYPE html> -<html lang="en"> -<head> - <title>Document#fullscreenEnabled</title> - <meta charset="UTF-8" /> - <script src="/resources/testharness.js"></script> - <script src="/resources/testharnessreport.js"></script> -</head> -<body> - <div id="log"></div> - <script> - -/* - * According to the spec the `default origin` for an iframe is its `declared - * origin`, meaning, the src attribute: - * https://w3c.github.io/webappsec-permissions-policy/#declared-origin - * The `default allowlist` for 'fullscreen' is "'self'": - * https://fullscreen.spec.whatwg.org/#permissions-policy-integration - * And 'self' means: - * 'self' - * The feature is allowed in documents in top-level traversables by default, - * as well as those in child navigables whose document is same origin with - * its parent’s document, when allowed in that Document. It is disallowed - * by default in child navigables whose document is cross-origin with its - * parent’s document. - * (https://w3c.github.io/webappsec-permissions-policy/#default-allowlists) - * Therefore a navigated iframe must not have fullscreen permissions unless - * the new origin matches the origin in the src attribute and is same-origin - * with the embedding page. - */ -var expectations = { - "same_to_cross": {allowlist: "", iframe_src: "same", iframe_dest: "cross", target_result: false}, - "cross_to_same": {allowlist: "", iframe_src: "cross", iframe_dest: "same", target_result: false}, - "same_to_same": {allowlist: "", iframe_src: "same", iframe_dest: "same", target_result: true}, - "cross_to_cross": {allowlist: "", iframe_src: "cross", iframe_dest: "cross", target_result: false}, - "allowed_cross_to_same": {allowlist: "'self' http://{{hosts[alt][]}}:{{ports[http][0]}}", - iframe_src: "cross", iframe_dest: "same", target_result: true}, -}; - -for (const [test, {allowlist, iframe_src, iframe_dest, target_result}] of Object.entries(expectations)) { - promise_test(async () => { - let iframe = document.createElement("iframe"); - if (allowlist !== "") { - iframe.allow = `fullscreen ${allowlist}`; - } - - document.body.appendChild(iframe); - iframe.addEventListener("load", () => { - iframe.contentWindow.postMessage({dest: iframe_dest}, "*"); - }); - - let hostname = iframe_src === "same" ? "{{hosts[][]}}" : "{{hosts[alt][]}}"; - iframe.src = `https://${hostname}:{{ports[http][0]}}/fullscreen/api/resources/navigate.sub.html`; - - window.addEventListener('message', e => { - if (e.data.report?.api == "fullscreen") { - resolve(e.data.report); - } - }); - - const { promise, resolve } = Promise.withResolvers(); - const report = await promise; - assert_equals(report.enabled, target_result); - }, test); -} - - </script> -</body> -</html> -\ No newline at end of file diff --git a/testing/web-platform/tests/fullscreen/api/resources/navigate.sub.html b/testing/web-platform/tests/fullscreen/api/resources/navigate.sub.html @@ -1,24 +0,0 @@ -<!DOCTYPE HTML> -<html lang="en"> - <head> - <meta charset="UTF-8" /> - <title>This page just redirects back to same-origin!</title> - </head> - <body> - <h1>Redirect me away!</h1> - <script> - - window.addEventListener("message", async (e) => { - switch (e.data.dest) { - case "same": - window.location.replace("http://{{hosts[][]}}:{{ports[http][0]}}/fullscreen/api/resources/report-fullscreen-enabled.html") - break; - case "cross": - window.location.replace("http://{{hosts[alt][]}}:{{ports[http][0]}}/fullscreen/api/resources/report-fullscreen-enabled.html") - break; - } - }); - - </script> - </body> -</html>