file_bug1729517.xml (1095B)
1 <?xml version="1.0"?> 2 <?xml-stylesheet type="text/xsl" href="#stylesheet"?> 3 <!DOCTYPE root [ 4 <!ATTLIST xsl:stylesheet id ID #IMPLIED> 5 ]> 6 <root> 7 <xsl:stylesheet id="stylesheet" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" version="1.0"> 8 <xsl:template match="/"> 9 <html> 10 <head> 11 <title>[]</title> 12 <script type="text/javascript"> 13 let failed = []; 14 function fail(desc) { 15 failed.push(desc); 16 document.title = JSON.stringify(failed); 17 } 18 19 function doStuff() { 20 fail("documents sandboxed without allow-scripts should NOT be able to run inline scripts"); 21 } 22 </script> 23 <script src="file_bug1729517.js" /> 24 </head> 25 <body onload="fail('documents sandboxed without allow-scripts should NOT be able to run script from event handlers'); doStuff();"> 26 <img src="about:blank" onerror="fail('documents sandboxed without allow-scripts should NOT be able to run script from event handlers');" /> 27 </body> 28 </html> 29 </xsl:template> 30 </xsl:stylesheet> 31 </root>