frame-src-javascript-url.html (1252B)
1 <!DOCTYPE html> 2 <script src="/resources/testharness.js"></script> 3 <script src="/resources/testharnessreport.js"></script> 4 <meta http-equiv="Content-Security-Policy" content="frame-src 'none'"> 5 6 <script> 7 const iframe_url = new URL("./support/empty.html", location.href); 8 9 // Regression test for: https://crbug.com/1064676 10 promise_test(async (t) => { 11 await new Promise(r => window.onload = r); 12 13 let url = `javascript: 14 15 window.addEventListener('securitypolicyviolation', e => { 16 parent.postMessage({ 17 originalPolicy: e.originalPolicy, 18 blockedURI: e.blockedURI, 19 }); 20 }); 21 22 let iframe = document.createElement('iframe'); 23 iframe.src = '${iframe_url}'; 24 document.body.appendChild(iframe); 25 26 `; 27 28 let iframe = document.createElement('iframe'); 29 iframe.src = encodeURI(url.replace(/\n/g, "")); 30 31 let violation = new Promise(r => window.addEventListener("message", r)); 32 document.body.appendChild(iframe); 33 let {data} = await violation; 34 35 assert_equals(data.originalPolicy, "frame-src 'none'"); 36 assert_equals(data.blockedURI, iframe_url.toString()); 37 38 }, "<iframe src='javascript:...'>'s inherits policy (dynamically inserted <iframe> is blocked)"); 39 40 </script>