allow-attribute-src.https.html (2944B)
1 <!DOCTYPE html> 2 <title>Test the 'src' attribute set in fenced frames.</title> 3 <meta name=variant content="?type=fencedframe"> 4 <meta name=variant content="?type=iframe"> 5 <script src="/resources/testharness.js"></script> 6 <script src="/resources/testharnessreport.js"></script> 7 <script src="/common/utils.js"></script> 8 <script src="/common/dispatcher/dispatcher.js"></script> 9 <script src="resources/utils.js"></script> 10 <script src="/common/media.js"></script> 11 <script src="/common/get-host-info.sub.js"></script> 12 13 <body></body> 14 <script> 15 frame_builder = () => { 16 const params = new URLSearchParams(location.search); 17 if (params.get('type') === "fencedframe") { 18 return attachFencedFrameContext({ 19 attributes: [["allow", "shared-storage"]] 20 }); 21 } else { 22 return attachIFrameContext({ 23 generator_api: "fledge", 24 attributes: [["allow", "shared-storage"]] 25 }); 26 } 27 } 28 29 promise_test(async () => { 30 // Not specifying an allowlist for a permissions policy will default the 31 // allowlist to 'src', which is an allowlist unique to iframes/fencedframes 32 // that matches either the URL of the 'src' attribute, the mapped URL of the 33 // URN in the 'src' attribute, or the mapped URL of the config in the 'config' 34 // attribute. 35 const frame = await frame_builder(); 36 await frame.execute(async () => { 37 assert_true(document.featurePolicy.allowsFeature("shared-storage")); 38 }); 39 }, 'Src permissions policy in allow attribute.'); 40 41 promise_test(async () => { 42 const frame = await frame_builder(); 43 await navigateFrameContext(frame, { 44 origin: get_host_info().HTTPS_ORIGIN, 45 }); 46 // When the fenced frame navigates itself to a same-origin page, the resulting 47 // document should still allow "shared-storage" since it is still same-origin to the 48 // original mapped URL (i.e. what 'src' is considered to be). 49 await frame.execute(async () => { 50 assert_true(document.featurePolicy.allowsFeature("shared-storage")); 51 }); 52 }, 'Src permissions policy after same-origin navigation.'); 53 54 promise_test(async () => { 55 const frame = await frame_builder(); 56 await navigateFrameContext(frame, { 57 origin: get_host_info().HTTPS_REMOTE_ORIGIN, 58 }); 59 // When the fenced frame navigates itself to a cross-origin page, the 60 // resulting document should not allow "shared-storage" since it is now cross-origin 61 // to the original mapped URL (i.e. what 'src' is considered to be). 62 await frame.execute(async () => { 63 assert_false(document.featurePolicy.allowsFeature("shared-storage")); 64 }); 65 }, 'Src permissions policy after cross-origin navigation.'); 66 67 promise_test(async () => { 68 const frame = await frame_builder(); 69 await frame.execute(async () => { 70 const child_frame = await attachIFrameContext(); 71 await child_frame.execute(() => { 72 assert_true(document.featurePolicy.allowsFeature("shared-storage")); 73 }) 74 }); 75 }, 'Src permissions policy in child iframe inheritance works properly.'); 76 </script>