feature-policy-header-policy-declined.https.sub.html (3263B)
1 <!DOCTYPE html> 2 <body> 3 <script src=/resources/testharness.js></script> 4 <script src=/resources/testharnessreport.js></script> 5 <script src=/feature-policy/resources/featurepolicy.js></script> 6 <!-- Feature-Policy: fullscreen cross_origin https://www.example.com; --> 7 <script> 8 'use strict'; 9 var same_origin = 'https://{{domains[]}}:{{ports[https][0]}}'; 10 var cross_origin = 'https://{{domains[www]}}:{{ports[https][0]}}'; 11 var cross_origin1 = 'https://{{domains[www1]}}:{{ports[https][0]}}'; 12 var same_origin_src = '/feature-policy/resources/feature-policy-allowedfeatures.html'; 13 var cross_origin_src = cross_origin + same_origin_src; 14 var cross_origin_src1 = cross_origin1 + same_origin_src; 15 var header_policy = 'Feature-Policy: fullscreen \'self\' ' + cross_origin + 16 ' https://www.example.com;'; 17 18 // Test that fullscreen's allowlist is [same_origin, cross_origin, 'https://www.example.com'] 19 test(function() { 20 assert_array_equals( 21 document.featurePolicy.getAllowlistForFeature('fullscreen'), 22 [cross_origin, 'https://www.example.com'].sort()); 23 }, header_policy + ' -- test allowlist is [cross_origin, https://www.example.com]'); 24 25 // Test that fullscreen is disallowed everywhere. 26 test_disallowed_feature_for_subframe( 27 header_policy + ' -- test fullscreen is disallowed on same-origin subframe', 28 'fullscreen', 29 same_origin_src); 30 test_disallowed_feature_for_subframe( 31 header_policy + ' -- test fullscreen is disallowed on cross-origin ' + cross_origin_src + ' subframe', 32 'fullscreen', 33 cross_origin_src); 34 test_disallowed_feature_for_subframe( 35 header_policy + ' -- test fullscreen is disallowed on cross-origin ' + cross_origin_src1 + ' subframe', 36 'fullscreen', 37 cross_origin_src1); 38 39 // dynamically update sub frame's container policy to none 40 var disallow = "fullscreen 'none';" 41 test_disallowed_feature_for_subframe( 42 header_policy + ', iframe.allow = ' + disallow + ' -- test fullscreen is disallowed on same-origin subframe', 43 'fullscreen', 44 same_origin_src, 45 disallow); 46 test_disallowed_feature_for_subframe( 47 header_policy + 'iframe.allow = ' + disallow + ' -- test fullscreen is disallowed on specific cross-origin subframe', 48 'fullscreen', 49 cross_origin_src, 50 disallow); 51 test_disallowed_feature_for_subframe( 52 header_policy + 'iframe.allow = ' + disallow + ' -- test fullscreen is disallowed on another cross-origin subframe', 53 'fullscreen', 54 cross_origin_src1, 55 disallow); 56 57 // dynamically update sub frame's container policy to cross_origin 58 var allow = "fullscreen " + cross_origin; 59 test_disallowed_feature_for_subframe( 60 header_policy + ', iframe.allow = ' + allow + ' -- test fullscreen is disallowed on same-origin subframe', 61 'fullscreen', 62 same_origin_src, 63 allow); 64 test_disallowed_feature_for_subframe( 65 header_policy + 'iframe.allow = ' + allow + ' -- test fullscreen is disallowed on specific cross-origin subframe', 66 'fullscreen', 67 cross_origin_src, 68 allow); 69 test_disallowed_feature_for_subframe( 70 header_policy + 'iframe.allow = ' + allow + ' -- test fullscreen is disallowed on another cross-origin subframe', 71 'fullscreen', 72 cross_origin_src1, 73 allow); 74 </script> 75 </body>