feature-policy-header-policy-allowed-for-some.https.sub.html (3304B)
1 <!DOCTYPE html> 2 <body> 3 <script src=/resources/testharness.js></script> 4 <script src=/resources/testharnessreport.js></script> 5 <script src=/feature-policy/resources/featurepolicy.js></script> 6 <!-- Feature-Policy: fullscreen 'self' cross_origin https://www.example.com; --> 7 <script> 8 'use strict'; 9 var same_origin = 'https://{{domains[]}}:{{ports[https][0]}}'; 10 var cross_origin = 'https://{{domains[www]}}:{{ports[https][0]}}'; 11 var cross_origin1 = 'https://{{domains[www1]}}:{{ports[https][0]}}'; 12 var same_origin_src = '/feature-policy/resources/feature-policy-allowedfeatures.html'; 13 var cross_origin_src = cross_origin + same_origin_src; 14 var cross_origin_src1 = cross_origin1 + same_origin_src; 15 var header_policy = 'Feature-Policy: fullscreen \'self\' ' + cross_origin + 16 ' https://www.example.com;'; 17 18 // Test that fullscreen's allowlist is [same_origin, cross_origin, 'https://www.example.com'] 19 test(function() { 20 assert_array_equals( 21 document.featurePolicy.getAllowlistForFeature('fullscreen').sort(), 22 [same_origin, cross_origin, 'https://www.example.com'].sort()); 23 }, header_policy + ' -- test allowlist is [same_origin, cross_origin, https://www.example.com]'); 24 25 // Test that fullscreen is allowed on same-origin, but disallowed on cross- 26 // origin subframes, without an allow attribute. 27 test_allowed_feature_for_subframe( 28 header_policy + ' -- test fullscreen is allowed on same-origin subframe', 29 'fullscreen', 30 same_origin_src); 31 test_disallowed_feature_for_subframe( 32 header_policy + ' -- test fullscreen is disallowed on cross-origin ' + cross_origin_src + ' subframe', 33 'fullscreen', 34 cross_origin_src); 35 test_disallowed_feature_for_subframe( 36 header_policy + ' -- test fullscreen is disallowed on cross-origin ' + cross_origin_src1 + ' subframe', 37 'fullscreen', 38 cross_origin_src1); 39 40 // dynamically update sub frame's container policy to none 41 var allow = "fullscreen 'none';" 42 test_disallowed_feature_for_subframe( 43 header_policy + ', iframe.allow = ' + allow + ' -- test fullscreen is disallowed on same-origin subframe', 44 'fullscreen', 45 same_origin_src, 46 allow); 47 test_disallowed_feature_for_subframe( 48 header_policy + 'iframe.allow = ' + allow + ' -- test fullscreen is disallowed on cross-origin subframe', 49 'fullscreen', 50 cross_origin_src, 51 allow); 52 test_disallowed_feature_for_subframe( 53 header_policy + 'iframe.allow = ' + allow + ' -- test fullscreen is disallowed on another cross-origin subframe', 54 'fullscreen', 55 cross_origin_src1, 56 allow); 57 58 // dynamically update sub frame's container policy to src 59 var allow = "fullscreen 'src';" 60 test_allowed_feature_for_subframe( 61 header_policy + ', iframe.allow = ' + allow + ' -- test fullscreen is allowed on same-origin subframe', 62 'fullscreen', 63 same_origin_src, 64 allow); 65 test_allowed_feature_for_subframe( 66 header_policy + 'iframe.allow = ' + allow + ' -- test fullscreen is allowed on cross-origin subframe', 67 'fullscreen', 68 cross_origin_src, 69 allow); 70 test_disallowed_feature_for_subframe( 71 header_policy + 'iframe.allow = ' + allow + ' -- test fullscreen is disallowed on another cross-origin subframe', 72 'fullscreen', 73 cross_origin_src1, 74 allow); 75 </script> 76 </body>