navigate-iframe.sub.html (2762B)
1 <!DOCTYPE html> 2 <html lang="en"> 3 <head> 4 <title>Document#fullscreenEnabled</title> 5 <meta charset="UTF-8" /> 6 <script src="/resources/testharness.js"></script> 7 <script src="/resources/testharnessreport.js"></script> 8 </head> 9 <body> 10 <div id="log"></div> 11 <script> 12 13 /* 14 * According to the spec the `default origin` for an iframe is its `declared 15 * origin`, meaning, the src attribute: 16 * https://w3c.github.io/webappsec-permissions-policy/#declared-origin 17 * The `default allowlist` for 'fullscreen' is "'self'": 18 * https://fullscreen.spec.whatwg.org/#permissions-policy-integration 19 * And 'self' means: 20 * 'self' 21 * The feature is allowed in documents in top-level traversables by default, 22 * as well as those in child navigables whose document is same origin with 23 * its parent’s document, when allowed in that Document. It is disallowed 24 * by default in child navigables whose document is cross-origin with its 25 * parent’s document. 26 * (https://w3c.github.io/webappsec-permissions-policy/#default-allowlists) 27 * Therefore a navigated iframe must not have fullscreen permissions unless 28 * the new origin matches the origin in the src attribute and is same-origin 29 * with the embedding page. 30 */ 31 var expectations = { 32 "same_to_cross": {allowlist: "", iframe_src: "same", iframe_dest: "cross", target_result: false}, 33 "cross_to_same": {allowlist: "", iframe_src: "cross", iframe_dest: "same", target_result: false}, 34 "same_to_same": {allowlist: "", iframe_src: "same", iframe_dest: "same", target_result: true}, 35 "cross_to_cross": {allowlist: "", iframe_src: "cross", iframe_dest: "cross", target_result: false}, 36 "allowed_cross_to_same": {allowlist: "'self' http://{{hosts[alt][]}}:{{ports[http][0]}}", 37 iframe_src: "cross", iframe_dest: "same", target_result: true}, 38 }; 39 40 for (const [test, {allowlist, iframe_src, iframe_dest, target_result}] of Object.entries(expectations)) { 41 promise_test(async () => { 42 let iframe = document.createElement("iframe"); 43 if (allowlist !== "") { 44 iframe.allow = `fullscreen ${allowlist}`; 45 } 46 47 document.body.appendChild(iframe); 48 iframe.addEventListener("load", () => { 49 iframe.contentWindow.postMessage({dest: iframe_dest}, "*"); 50 }); 51 52 let hostname = iframe_src === "same" ? "{{hosts[][]}}" : "{{hosts[alt][]}}"; 53 iframe.src = `http://${hostname}:{{ports[http][0]}}/fullscreen/api/resources/navigate.sub.html`; 54 55 window.addEventListener('message', e => { 56 if (e.data.report?.api == "fullscreen") { 57 resolve(e.data.report); 58 } 59 }); 60 61 const { promise, resolve } = Promise.withResolvers(); 62 const report = await promise; 63 assert_equals(report.enabled, target_result); 64 }, test); 65 } 66 67 </script> 68 </body> 69 </html>