test_iframe_sandbox_general.html (14281B)
1 <!DOCTYPE HTML> 2 <html> 3 <!-- 4 https://bugzilla.mozilla.org/show_bug.cgi?id=341604 5 Implement HTML5 sandbox attribute for IFRAMEs - general tests 6 --> 7 <head> 8 <meta charset="utf-8"> 9 <title>Tests for Bug 341604 and Bug 766282</title> 10 <script src="/tests/SimpleTest/SimpleTest.js"></script> 11 <script src="/tests/SimpleTest/EventUtils.js"></script> 12 <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/> 13 </head> 14 <script type="application/javascript"> 15 /** Test for Bug 341604 - Implement HTML5 sandbox attribute for IFRAMEs - general tests */ 16 17 SimpleTest.expectAssertions(0, 1); 18 SimpleTest.waitForExplicitFinish(); 19 SimpleTest.requestCompleteLog(); 20 21 // a postMessage handler that is used by sandboxed iframes without 22 // 'allow-same-origin' to communicate pass/fail back to this main page. 23 // it expects to be called with an object like {ok: true/false, desc: 24 // <description of the test> which it then forwards to ok() 25 window.addEventListener("message", receiveMessage); 26 27 function receiveMessage(event) 28 { 29 ok_wrapper(event.data.ok, event.data.desc); 30 } 31 32 var completedTests = 0; 33 var passedTests = 0; 34 35 function ok_wrapper(result, desc) { 36 ok(result, desc); 37 38 completedTests++; 39 40 if (result) { 41 passedTests++; 42 } 43 44 if (completedTests == 32) { 45 is(passedTests, completedTests, "There are " + completedTests + " general tests that should pass"); 46 SimpleTest.finish(); 47 } 48 } 49 50 function doTest() { 51 // passes twice if good 52 // 1) test that inline scripts (<script>) can run in an iframe sandboxed with "allow-scripts" 53 // (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts') 54 55 // passes twice if good 56 // 2) test that <script src=...> can run in an iframe sandboxed with "allow-scripts" 57 // (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts') 58 59 // passes twice if good 60 // 3) test that script in an event listener (body onload) can run in an iframe sandboxed with "allow-scripts" 61 // (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts') 62 63 // passes twice if good 64 // 4) test that script in an javascript:url can run in an iframe sandboxed with "allow-scripts" 65 // (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts') 66 67 // fails if bad 68 // 5) test that inline scripts cannot run in an iframe sandboxed without "allow-scripts" 69 // (done in file_iframe_sandbox_c_if2.html which has sandbox='') 70 71 // fails if bad 72 // 6) test that <script src=...> cannot run in an iframe sandboxed without "allow-scripts" 73 // (done in file_iframe_sandbox_c_if2.html which has sandbox='') 74 75 // fails if bad 76 // 7) test that script in an event listener (body onload) cannot run in an iframe sandboxed without "allow-scripts" 77 // (done in file_iframe_sandbox_c_if2.html which has sandbox='') 78 79 // fails if bad 80 // 8) test that script in an event listener (img onerror) cannot run in an iframe sandboxed without "allow-scripts" 81 // (done in file_iframe_sandbox_c_if2.html which has sandbox='') 82 83 // fails if bad 84 // 9) test that script in an javascript:url cannot run in an iframe sandboxed without "allow-scripts" 85 // (done in file_iframe_sandbox_c_if_5.html which has sandbox='allow-same-origin') 86 var if_w = document.getElementById('if_5').contentWindow; 87 sendMouseEvent({type:'click'}, 'a_link', if_w); 88 89 // passes if good 90 // 10) test that a new iframe has sandbox attribute 91 var ifr = document.createElement("iframe"); 92 ok_wrapper("sandbox" in ifr, "a new iframe should have a sandbox attribute"); 93 94 // passes if good 95 // 11) test that the sandbox attribute's default stringyfied value is an empty string 96 ok_wrapper(ifr.sandbox.length === 0 && ifr.sandbox == "", "default sandbox attribute should be an empty string"); 97 98 // passes if good 99 // 12) test that a sandboxed iframe with 'allow-forms' can submit forms 100 // (done in file_iframe_sandbox_c_if3.html which has 'allow-forms' and 'allow-scripts') 101 102 // fails if bad 103 // 13) test that a sandboxed iframe without 'allow-forms' can NOT submit forms 104 // (done in file_iframe_sandbox_c_if1.html which only has 'allow-scripts') 105 106 // fails if bad 107 // 14) test that a sandboxed iframe can't open a new window using the target.attribute 108 // this is done via file_iframe_sandbox_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin" 109 // the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok() 110 // function that calls window.parent.ok_wrapper 111 112 // passes if good 113 // 15) test that a sandboxed iframe can't open a new window using window.open 114 // this is done via file_iframe_sandbox_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin" 115 // the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok() 116 // function that calls window.parent.ok_wrapper 117 118 // passes if good 119 // 16) test that a sandboxed iframe can't open a new window using window.ShowModalDialog 120 // this is done via file_iframe_sandbox_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin" 121 // the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok() 122 // function that calls window.parent.ok_wrapper 123 124 // passes twice if good 125 // 17) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute 126 // is separated with two spaces 127 // done via file_iframe_sandbox_c_if6.html which is sandboxed with " allow-scripts allow-same-origin " 128 129 // passes twice if good 130 // 18) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute 131 // is separated with tabs 132 // done via file_iframe_sandbox_c_if6.html which is sandboxed with "	allow-scripts	allow-same-origin	" 133 134 // passes twice if good 135 // 19) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute 136 // is separated with line feeds 137 // done via file_iframe_sandbox_c_if6.html which is sandboxed with "
allow-scripts
allow-same-origin
" 138 139 // passes twice if good 140 // 20) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute 141 // is separated with form feeds 142 // done via file_iframe_sandbox_c_if6.html which is sandboxed with "allow-scriptsallow-same-origin" 143 144 // passes twice if good 145 // 21) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute 146 // is separated with carriage returns 147 // done via file_iframe_sandbox_c_if6.html which is sandboxed with "
allow-scripts
allow-same-origin
" 148 149 // fails if bad 150 // 22) test that an iframe with sandbox="" does NOT have script in a src attribute created by a javascript: 151 // URL executed 152 // done by this page, see if_7 153 154 // passes if good 155 // 23) test that an iframe with sandbox="allow-scripts" DOES have script in a src attribute created by a javascript: 156 // URL executed 157 // done by this page, see if_8 158 159 // fails if bad 160 // 24) test that an iframe with sandbox="", starting out with a document already loaded, does NOT have script in a newly 161 // set src attribute created by a javascript: URL executed 162 // done by this page, see if_9 163 164 // passes if good 165 // 25) test that an iframe with sandbox="allow-scripts", starting out with a document already loaded, DOES have script 166 // in a newly set src attribute created by a javascript: URL executed 167 // done by this page, see if_10 168 169 // passes if good or fails if bad 170 // 26) test that an sandboxed document without 'allow-same-origin' can NOT access indexedDB 171 // done via file_iframe_sandbox_c_if7.html, which has sandbox='allow-scripts' 172 173 // passes if good or fails if bad 174 // 27) test that an sandboxed document with 'allow-same-origin' can access indexedDB 175 // done via file_iframe_sandbox_c_if8.html, which has sandbox='allow-scripts allow-same-origin' 176 177 // fails if bad 178 // 28) Test that a sandboxed iframe can't open a new window using the target.attribute for a 179 // non-existing browsing context (BC341604). 180 // This is done via file_iframe_sandbox_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin" 181 // the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok() 182 // function that calls window.parent.ok_wrapper. 183 184 // passes twice if good 185 // 29-32) Test that sandboxFlagsAsString returns the set flags. 186 // see if_14 and if_15 187 188 // passes once if good 189 // 33) Test that sandboxFlagsAsString returns null if iframe does not have sandbox flag set. 190 // see if_16 191 } 192 193 addLoadEvent(doTest); 194 195 var started_if_9 = false; 196 var started_if_10 = false; 197 198 function start_if_9() { 199 if (started_if_9) 200 return; 201 202 started_if_9 = true; 203 sendMouseEvent({type:'click'}, 'a_button'); 204 } 205 206 function start_if_10() { 207 if (started_if_10) 208 return; 209 210 started_if_10 = true; 211 sendMouseEvent({type:'click'}, 'a_button2'); 212 } 213 214 function do_if_9() { 215 var if_9 = document.getElementById('if_9'); 216 if_9.src = 'javascript:"<html><script>window.parent.ok_wrapper(false, \'an iframe sandboxed without allow-scripts should not execute script in a javascript URL in a newly set src attribute\');<\/script><\/html>"'; 217 } 218 219 function do_if_10() { 220 var if_10 = document.getElementById('if_10'); 221 if_10.src = 'javascript:"<html><script>window.parent.ok_wrapper(true, \'an iframe sandboxed with allow-scripts should execute script in a javascript URL in a newly set src attribute\');<\/script><\/html>"'; 222 } 223 224 function eqFlags(a, b) { 225 // both a and b should be either null or have the array same flags 226 if (a === null && b === null) { return true; } 227 if (a === null || b === null) { return false; } 228 if (a.length !== b.length) { return false; } 229 var a_sorted = a.sort(); 230 var b_sorted = b.sort(); 231 for (var i in a_sorted) { 232 if (a_sorted[i] !== b_sorted[i]) { return false; } 233 } 234 return true; 235 } 236 237 function getSandboxFlags(doc) { 238 var flags = doc.sandboxFlagsAsString; 239 if (flags === null) { return null; } 240 return flags? flags.split(" "):[]; 241 } 242 243 function test_sandboxFlagsAsString(name, expected) { 244 var ifr = document.getElementById(name); 245 try { 246 var flags = getSandboxFlags(SpecialPowers.wrap(ifr).contentDocument); 247 ok_wrapper(eqFlags(flags, expected), name + ' expected: "' + expected + '", got: "' + flags + '"'); 248 } catch (e) { 249 ok_wrapper(false, name + ' expected "' + expected + ', but failed with ' + e); 250 } 251 } 252 253 </script> 254 <body> 255 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=341604">Mozilla Bug 341604</a> - Implement HTML5 sandbox attribute for IFRAMEs 256 <p id="display"></p> 257 <div id="content"> 258 <iframe sandbox="allow-same-origin allow-scripts" id="if_1" src="file_iframe_sandbox_c_if1.html" height="10" width="10"></iframe> 259 <iframe sandbox="aLlOw-SAME-oRiGin ALLOW-sCrIpTs" id="if_1_case_insensitive" src="file_iframe_sandbox_c_if1.html" height="10" width="10"></iframe> 260 <iframe sandbox="" id="if_2" src="file_iframe_sandbox_c_if2.html" height="10" width="10"></iframe> 261 <iframe sandbox="allow-forms allow-scripts" id="if_3" src="file_iframe_sandbox_c_if3.html" height="10" width="10"></iframe> 262 <iframe sandbox="allow-same-origin allow-scripts" id="if_4" src="file_iframe_sandbox_c_if4.html" height="10" width="10"></iframe> 263 <iframe sandbox="allow-same-origin" id="if_5" src="file_iframe_sandbox_c_if5.html" height="10" width="10"></iframe> 264 <iframe sandbox=" allow-same-origin allow-scripts " id="if_6_a" src="file_iframe_sandbox_c_if6.html" height="10" width="10"></iframe> 265 <iframe sandbox="	allow-same-origin	allow-scripts	" id="if_6_b" src="file_iframe_sandbox_c_if6.html" height="10" width="10"></iframe> 266 <iframe sandbox="
allow-same-origin
allow-scripts
" id="if_6_c" src="file_iframe_sandbox_c_if6.html" height="10" width="10"></iframe> 267 <iframe sandbox="allow-same-originallow-scripts" id="if_6_d" src="file_iframe_sandbox_c_if6.html" height="10" width="10"></iframe> 268 <iframe sandbox="
allow-same-origin
allow-scripts
" id="if_6_e" src="file_iframe_sandbox_c_if6.html" height="10" width="10"></iframe> 269 <iframe sandbox="allow-same-origin" id='if_7' src="javascript:'<html><script>window.parent.ok_wrapper(false, \'an iframe sandboxed without allow-scripts should not execute script in a javascript URL in its src attribute\');<\/script><\/html>';" height="10" width="10"></iframe> 270 <iframe sandbox="allow-same-origin allow-scripts" id='if_8' src="javascript:'<html><script>window.parent.ok_wrapper(true, \'an iframe sandboxed without allow-scripts should execute script in a javascript URL in its src attribute\');<\/script><\/html>';" height="10" width="10"></iframe> 271 <iframe sandbox="allow-same-origin" onload='start_if_9()' id='if_9' src="about:blank" height="10" width="10"></iframe> 272 <iframe sandbox="allow-same-origin allow-scripts" onload='start_if_10()' id='if_10' src="about:blank" height="10" width="10"></iframe> 273 <iframe sandbox="allow-scripts" id='if_11' src="file_iframe_sandbox_c_if7.html" height="10" width="10"></iframe> 274 <iframe sandbox="allow-same-origin allow-scripts" id='if_12' src="file_iframe_sandbox_c_if8.html" height="10" width="10"></iframe> 275 <iframe sandbox="allow-forms allow-pointer-lock allow-popups allow-same-origin allow-scripts allow-top-navigation " id='if_13' src="file_iframe_sandbox_c_if9.html" height="10" width="10" onload='test_sandboxFlagsAsString("if_13",["allow-forms", "allow-pointer-lock", "allow-popups", "allow-same-origin", "allow-scripts", "allow-top-navigation"])'></iframe> 276 <iframe sandbox="	allow-same-origin	allow-scripts	" id="if_14" src="file_iframe_sandbox_c_if6.html" height="10" width="10" onload='test_sandboxFlagsAsString("if_14",["allow-same-origin","allow-scripts"])'></iframe> 277 <iframe sandbox="" id="if_15" src="file_iframe_sandbox_c_if9.html" height="10" width="10" onload='test_sandboxFlagsAsString("if_15",[])'></iframe> 278 <iframe id="if_16" src="file_iframe_sandbox_c_if9.html" height="10" width="10" onload='test_sandboxFlagsAsString("if_16",null)'></iframe> 279 <input type='button' id="a_button" onclick='do_if_9()'> 280 <input type='button' id="a_button2" onclick='do_if_10()'> 281 </div> 282 </body> 283 </html>