sandbox.https.html (2197B)
1 <!doctype html> 2 <meta charset=utf-8> 3 <script src="/resources/testharness.js"></script> 4 <script src="/resources/testharnessreport.js"></script> 5 <script src="/common/get-host-info.sub.js"></script> 6 <div id=log></div> 7 <script> 8 async_test(t => { 9 window.addEventListener("message", t.step_func_done(({ data }) => { 10 assert_equals(data.origin, "null"); 11 assert_true(data.sameOriginWithoutCORP, "Request to same-origin resource without CORP did not fail"); 12 assert_true(data.sameOriginWithSameOriginCORP, "Request to same-origin resource with same-origin CORP did not fail"); 13 assert_true(data.sameOriginWithCrossOriginCORP, "Request to same-origin resource with cross-origin CORP did not succeed"); 14 assert_true(data.crossOriginWithCrossOriginCORP, "Request to cross-origin resource with cross-origin CORP did not succeed"); 15 })); 16 17 const origins = get_host_info(); 18 const frame = document.createElement("iframe"); 19 const nothingCrossOriginCORP = new URL("resources/nothing-cross-origin-corp.js", window.location).pathname; 20 const nothingSameOriginCORP = new URL("resources/nothing-same-origin-corp.txt", window.location).pathname; 21 frame.sandbox = "allow-scripts"; 22 frame.srcdoc = `<script> 23 const data = { sameOriginWithoutCORP: false, 24 sameOriginWithSameOriginCORP: false, 25 sameOriginWithCrossOriginCORP: false, 26 crossOriginWithCrossOriginCORP: false, 27 origin: self.origin }; 28 function record(promise, token, expectation) { 29 return promise.then(() => data[token] = expectation, () => data[token] = !expectation); 30 } 31 Promise.all([ 32 record(fetch("/common/blank.html", { mode: "no-cors" }), "sameOriginWithoutCORP", false), 33 record(fetch("${nothingSameOriginCORP}", { mode: "no-cors" }), "sameOriginWithSameOriginCORP", false), 34 record(fetch("${nothingCrossOriginCORP}", { mode: "no-cors" }), "sameOriginWithCrossOriginCORP", true), 35 record(fetch("${origins.HTTPS_NOTSAMESITE_ORIGIN}${nothingCrossOriginCORP}", { mode: "no-cors" }), "crossOriginWithCrossOriginCORP", true) 36 ]).then(() => parent.postMessage(data, "*")); 37 <\/script>`; 38 document.body.append(frame); 39 }, "Cross-Origin-Embedder-Policy and sandbox"); 40 </script>