tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

javascript-url-referrer.window.js (1662B)


      1 // META: script=../resources/helpers.js
      2 // META: title=javascript: URL navigation to a string must create a document whose referrer is the navigation initiator
      3 
      4 const originalURL = location.href;
      5 
      6 const testCases = [
      7  ["unsafe-url", location.href],
      8  ["origin", self.origin + "/"],
      9  ["no-referrer", ""]
     10 ];
     11 
     12 for (const [referrerPolicyForStartingWindowCreation, expectedReferrer] of testCases) {
     13  promise_test(async (t) => {
     14    const meta = document.createElement("meta");
     15    meta.name = "referrer";
     16    meta.content = referrerPolicyForStartingWindowCreation;
     17    t.add_cleanup(() => meta.remove());
     18    document.head.append(meta);
     19 
     20    const w = await openWindow("/common/blank.html", t);
     21    const originalReferrer = w.document.referrer;
     22    assert_equals(originalReferrer, expectedReferrer,
     23      "Sanity check: opened window's referrer is set correctly");
     24 
     25    // Mess with the current document's URL so that the initiator URL is different. Then, if that
     26    // shows up as the javascript: URL document's referrer, we know the navigation initiator's URL is
     27    // being used as the referrer, which is incorrect.
     28    history.replaceState(undefined, "", "/incorrect-referrer.html");
     29    t.add_cleanup(() => history.replaceState(undefined, "", originalURL));
     30 
     31    w.location.href = `javascript:'a string<script>opener.postMessage(document.referrer, "*");</script>'`;
     32 
     33    const referrer = await waitForMessage(w);
     34 
     35    assert_equals(referrer, originalReferrer,
     36      "javascript: URL-created document's referrer equals the previous document's referrer");
     37  }, `${referrerPolicyForStartingWindowCreation} referrer policy used to create the starting page`);
     38 }