tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

010.tentative.html (1512B)


      1 <!doctype html>
      2 <title>Link with onclick form submit to javascript url with delayed document.write and href navigation </title>
      3 <script src="/resources/testharness.js"></script>
      4 <script src="/resources/testharnessreport.js"></script>
      5 <script>
      6 var flag = false;
      7 </script>
      8 <div id="log"></div>
      9 <iframe id="test" name="test"></iframe>
     10 <form target="test" action="javascript:(function() {parent.flag = true; var x = new XMLHttpRequest(); x.open('GET', 'resources/blank.html?pipe=trickle(d2)', false); x.send(); document.write('WRITE <script>parent.postMessage(&quot;write&quot;, &quot;*&quot;)</script>'); return 'RETURN <script>parent.postMessage(&quot;click&quot;, &quot;*&quot;)</script>'})()"></form>
     11 <a target="test" onclick="document.forms[0].submit()" href="resources/href.html">Test</a>
     12 <script>
     13 var t = async_test();
     14 onload = t.step_func(function() {document.getElementsByTagName("a")[0].click()});
     15 onmessage = t.step_func(
     16  function(e) {
     17    assert_equals(flag, true);
     18    assert_equals(e.data, "write");
     19    t.done();
     20  });
     21 </script>
     22 <!--
     23 Tentative, because:
     24 * Chrome doesn't appear to execute the javascript: URL at all.
     25 * Safari seems to start the navigation to href.html to the extent
     26   that the sync XHR goes away, but then document.write() takes
     27   place so that postMessage succeeds and then the DOM for href.html
     28   replaces the DOM for the document.write().
     29 * In Firefox, the navigation to href.html makes the sync XHR go
     30   away, but then document.write() wins over the href.html parse.
     31 -->