fenced-frame-bypass.tentative.https.window.js (2637B)
1 // META: script=/common/get-host-info.sub.js 2 // META: script=/common/utils.js 3 // META: script=/common/dispatcher/dispatcher.js 4 // META: script=/fenced-frame/resources/utils.js 5 // META: script=/html/cross-origin-embedder-policy/credentialless/resources/common.js 6 // META: script=./resources/common.js 7 // META: timeout=long 8 9 setup(() => { 10 assert_implements(window.HTMLFencedFrameElement, 11 "HTMLFencedFrameElement is not supported."); 12 }) 13 14 // 4 actors: 15 // A (this document) 16 // ┌─────────────────────┴───────┐ 17 // ┌─┼────────────────────────┐ D (credentialless-iframe) 18 // │ B (fenced-frame) │ 19 // │ │ │ 20 // │ C (credentialless-iframe)│ 21 // └──────────────────────────┘ 22 // 23 // This test whether the two credentialless iframe can communicate and bypass the 24 // fencedframe boundary. This shouldn't happen. 25 promise_test(async test => { 26 const cross_origin = get_host_info().HTTPS_REMOTE_ORIGIN; 27 const msg_queue = token(); 28 29 // Create the 3 actors. 30 const iframe_credentialless_1 = newIframeCredentialless(cross_origin); 31 const fenced_frame = await newFencedFrame(cross_origin); 32 send(fenced_frame, ` 33 const importScript = ${importScript}; 34 await importScript("/common/utils.js"); 35 await importScript("/html/cross-origin-embedder-policy/credentialless" + 36 "/resources/common.js"); 37 await importScript("/html/anonymous-iframe/resources/common.js"); 38 const support_loading_mode_fenced_frame = 39 "|header(Supports-Loading-Mode,fenced-frame)"; 40 const iframe_credentialless_2 = newIframeCredentialless("${cross_origin}", 41 support_loading_mode_fenced_frame); 42 send("${msg_queue}", iframe_credentialless_2); 43 `); 44 const iframe_credentialless_2 = await receive(msg_queue); 45 46 // Try to communicate using BroadCastChannel, in between the credentialless 47 // iframes. 48 const bc_key = token(); 49 send(iframe_credentialless_1, ` 50 const bc = new BroadcastChannel("${bc_key}"); 51 bc.onmessage = event => send("${msg_queue}", event.data); 52 send("${msg_queue}", "BroadcastChannel registered"); 53 `); 54 assert_equals(await receive(msg_queue), "BroadcastChannel registered"); 55 await send(iframe_credentialless_2, ` 56 const bc = new BroadcastChannel("${bc_key}"); 57 bc.postMessage("Can communicate"); 58 `); 59 test.step_timeout(() => { 60 send(msg_queue, "Cannot communicate"); 61 }, 4000); 62 63 assert_equals(await receive(msg_queue), "Cannot communicate"); 64 })