tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

policy-inherited-correctly-by-plznavigate.html (1501B)


      1 <!DOCTYPE HTML>
      2 <html>
      3 <head>
      4  <!-- This tests a bug that can occur when content layer CSP is not told
      5       about the CSP inherited from the parent document which leads to it not
      6       applying it to content layer CSP checks (such as frame-src with
      7       PlzNavigate on).
      8       Also see crbug.com/778658. -->
      9  <script src='/resources/testharness.js'></script>
     10  <script src='/resources/testharnessreport.js'></script>
     11 </head>
     12 <body>
     13  <script>
     14    var t = async_test("iframe still inherits correct CSP");
     15 
     16    window.onmessage = t.step_func_done(function(e) {
     17      assert_equals(e.data, "frame-src");
     18    });
     19 
     20    function doDocWrite() {
     21      x = document.getElementById('x');
     22      x.location = "";
     23 
     24      // While document.write is deprecated I did not find another way to reproduce
     25      // the original exploit.
     26      x.contentDocument.write(
     27        '<script>window.addEventListener("securitypolicyviolation", function(e) {' +
     28        '  window.top.postMessage(e.violatedDirective, "*");' +
     29        '});</scr' + 'ipt>' +
     30        '<iframe src="../support/fail.html"></iframe>'
     31      );
     32      x.contentDocument.close();
     33 
     34      var s = document.createElement('script');
     35      s.async = true;
     36      s.defer = true;
     37      s.src = '../support/checkReport.sub.js?reportField=violated-directive&reportValue=frame-src%20%27none%27';
     38      document.lastChild.appendChild(s);
     39    }
     40  </script>
     41  <iframe id="x" onload="doDocWrite()" srcdoc="<a href='about:blank'>123</a>"></iframe>
     42 </body>
     43 </html>