tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

about-blank-popup.https.html (2257B)


      1 <!doctype html>
      2 <script src="/resources/testharness.js"></script>
      3 <script src="/resources/testharnessreport.js"></script>
      4 <script src="resources/script-factory.js"></script>
      5 <script src="/common/get-host-info.sub.js"></script>
      6 <script src="/common/utils.js"></script>
      7 <script>
      8  const origins = get_host_info();
      9 
     10  promise_test(async t => {
     11    const popup = window.open();
     12    t.add_cleanup(() => { popup.close(); });
     13 
     14    let data_from_popup = () => new Promise(resolve =>
     15      window.addEventListener("message", (({ data }) => resolve(data))));
     16 
     17    let check_result = (data, text) => {
     18      assert_equals(data.origin, origin);
     19      assert_true(data.sameOriginNoCORPSuccess,
     20                  text + ": Same-origin without CORP did not succeed");
     21      assert_true(data.crossOriginNoCORPFailure,
     22                  text + ": Cross-origin without CORP did not fail");
     23    };
     24 
     25    // Check if COEP is inherited by the popup.
     26    let script = popup.document.createElement('script');
     27    script.innerHTML =
     28      `${createScript(window.origin, origins.HTTPS_REMOTE_ORIGIN, "opener")}`;
     29    popup.document.body.appendChild(script);
     30    check_result(await data_from_popup(), "Initial empty document");
     31 
     32    // Navigate the popup away.
     33    popup.location = origins.HTTPS_REMOTE_ORIGIN +
     34      "/html/cross-origin-embedder-policy/resources/postmessage-ready.html";
     35    assert_equals(await new Promise(resolve =>
     36      window.addEventListener("message", msg => resolve(msg.data))),
     37      "ready");
     38 
     39    // Navigate the popup to about:blank and wait for it.
     40    popup.location = "about:blank";
     41    await t.step_wait(
     42      condition = () => {
     43        try {
     44          return popup.location.href === "about:blank";
     45        } catch {}
     46        return false;
     47      },
     48      description = "Wait for the popup to navigate.",
     49      timeout=3000,
     50      interval=50);
     51 
     52    // Check again if COEP is inherited.
     53    script = popup.document.createElement('script');
     54    script.innerHTML =
     55      `${createScript(window.origin, origins.HTTPS_REMOTE_ORIGIN, "opener")}`;
     56    popup.document.body.appendChild(script);
     57    check_result(await data_from_popup(), "Non-initial about:blank document");
     58  }, `Cross-Origin-Embedder-Policy is inherited by about:blank popup.`);
     59 </script>