tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

about-srcdoc-navigation-blocked.window.js (1869B)


      1 // META: title=Navigation to about:srcdoc, not via srcdoc="", must be blocked
      2 // META: script=../resources/helpers.js
      3 
      4 promise_test(async t => {
      5  const iframe = await addSrcdocIframe();
      6 
      7  iframe.contentWindow.location = "/common/blank.html";
      8  await waitForIframeLoad(iframe);
      9 
     10  iframe.contentWindow.location = "about:srcdoc";
     11 
     12  // Fetching "about:srcdoc" should result in a network error, and navigating
     13  // to a network error should produce an opaque-origin page. In particular,
     14  // since the error page should end up being cross-origin to the parent
     15  // frame, `contentDocument` should return `null`.
     16  //
     17  // If instead this results in a message because we re-loaded a srcdoc document
     18  // from the contents of the srcdoc="" attribute, immediately fail.
     19  await Promise.race([
     20    t.step_wait(() => iframe.contentDocument === null),
     21    failOnMessage(iframe.contentWindow)
     22  ]);
     23 }, "Navigations to about:srcdoc via window.location must be blocked");
     24 
     25 promise_test(async t => {
     26  const iframe = await addSrcdocIframe();
     27 
     28  iframe.contentWindow.location = "about:srcdoc?query";
     29 
     30  // See the documentation in the above test.
     31  await Promise.race([
     32    t.step_wait(() => iframe.contentDocument === null),
     33    failOnMessage(iframe.contentWindow)
     34  ]);
     35 }, "Navigations to about:srcdoc?query via window.location within an " +
     36   "about:srcdoc document must be blocked");
     37 
     38 promise_test(async t => {
     39  const iframe = await addSrcdocIframe();
     40  iframe.contentWindow.name = "test_frame";
     41 
     42  iframe.contentWindow.location = "/common/blank.html";
     43  await waitForIframeLoad(iframe);
     44 
     45  window.open("about:srcdoc", "test_frame");
     46 
     47  // See the documentation in the above test.
     48  await Promise.race([
     49    t.step_wait(() => iframe.contentDocument === null),
     50    failOnMessage(iframe.contentWindow)
     51  ]);
     52 }, "Navigations to about:srcdoc via window.open() must be blocked");