tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

form-get-blank-reload.https.html (3209B)

      1 <!DOCTYPE html>
      2 <meta charset="utf-8"/>
      3 <script src="/resources/testharness.js"></script>
      4 <script src="/resources/testharnessreport.js"></script>
      5 <script src="/cookies/resources/cookie-helper.sub.js"></script>
      6 <script>
      7  // This test creates a form whose submission GETs the page postToParent.py
      8  // (on the specified origin) in a popup window. The popup sends a postMessage
      9  // event back to its opener (i.e., here) with the cookies it received, which
     10  // we verify against expectedStatus. Then, the test sends a message to the
     11  // popup, telling it to reload itself via window.location.reload(). Again,
     12  // the popup posts a message back here with the cookies it received. These
     13  // cookies are verified against expectedStatusReload.
     14  function create_test(origin, target, expectedStatus, expectedStatusReload, title) {
     15    promise_test(t => {
     16      var value = "" + Math.random();
     17      return resetSameSiteCookies(origin, value)
     18        .then(_ => {
     19          return new Promise((resolve, reject) => {
     20            var f = document.createElement('form');
     21            f.action = target + "/cookies/resources/postToParent.py";
     22            f.target = "_blank";
     23            f.method = "GET";
     24            f.rel = "opener";
     25 
     26            // If |target| contains a `redir` parameter, extract it, and add it
     27            // to the form so it doesn't get dropped in the submission.
     28            var url = new URL(f.action);
     29            if (url.pathname = "/cookies/rfc6265/resources/redirectWithCORSHeaders.py") {
     30              var i = document.createElement("input");
     31              i.name = "location";
     32              i.value = url.searchParams.get("location");
     33              i.type = "hidden";
     34              f.appendChild(i);
     35            }
     36            var reloaded = false;
     37            var msgHandler = e => {
     38              try {
     39                verifySameSiteCookieState(reloaded ? expectedStatusReload : expectedStatus, value, e.data, DomSameSiteStatus.SAME_SITE);
     40              } catch (e) {
     41                reject(e);
     42              }
     43 
     44              if (reloaded) {
     45                window.removeEventListener("message", msgHandler);
     46                e.source.close();
     47                resolve("Popup received the cookie.");
     48              } else {
     49                reloaded = true;
     50                e.source.postMessage("reload", "*");
     51              }
     52            };
     53            window.addEventListener("message", msgHandler);
     54            document.body.appendChild(f);
     55 
     56            f.submit();
     57          });
     58        });
     59    }, title);
     60  }
     61 
     62  // The reload status is always strictly same-site because this is a site-initiated reload, as opposed to a reload triggered by a user interface element.
     63  create_test(SECURE_ORIGIN, SECURE_ORIGIN, SameSiteStatus.STRICT, SameSiteStatus.STRICT, "Reloaded same-host top-level form GETs are strictly same-site");
     64  create_test(SECURE_SUBDOMAIN_ORIGIN, SECURE_SUBDOMAIN_ORIGIN, SameSiteStatus.STRICT, SameSiteStatus.STRICT, "Reloaded subdomain top-level form GETs are strictly same-site");
     65  create_test(SECURE_CROSS_SITE_ORIGIN, SECURE_CROSS_SITE_ORIGIN, SameSiteStatus.LAX, SameSiteStatus.STRICT, "Reloaded cross-site top-level form GETs are strictly same-site");
     66 </script>