tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

coop-navigate-same-origin-csp-sandbox.html (2355B)


      1 <script src=/resources/testharness.js></script>
      2 <script src=/resources/testharnessreport.js></script>
      3 <script src="/common/get-host-info.sub.js"></script>
      4 <script src="/common/utils.js"></script>
      5 <script src="/common/dispatcher/dispatcher.js"></script>
      6 <script src="./resources/common.js"></script>
      7 <script>
      8 
      9 const executor_path = '/common/dispatcher/executor.html?pipe=';
     10 
     11 const https_origin = get_host_info().HTTPS_ORIGIN;
     12 const coop_same_origin =
     13    '|header(Cross-Origin-Opener-Policy,same-origin)';
     14 const csp_sandbox =
     15    '|header(Content-Security-Policy, sandbox allow-scripts)';
     16 
     17 promise_test(async test => {
     18  const driver_token = token();
     19 
     20  // 1. Start from a COOP:same-origin document.
     21  const opener_token = token();
     22  const opener_url = https_origin + executor_path + coop_same_origin +
     23    `&uuid=${opener_token}`;
     24  const w = window.open(opener_url);
     25  add_completion_callback(() => w.close());
     26 
     27  // 2. It opens a popups, and then navigates the popup toward a same-origin
     28  // COOP:same-origin document with CSP:sandbox
     29  const openee_token = token();
     30  const openee_url = https_origin + executor_path + coop_same_origin +
     31    csp_sandbox + `&uuid=${openee_token}`;
     32  send(opener_token, `
     33    openee = window.open("${openee_url}");
     34  `);
     35  add_completion_callback(() => send(openee_token, "close()"));
     36 
     37  // Because of CSP:sandbox, the popup is not considered same-origin with
     38  // its openee. Check the openee/opener relationship is now closed.
     39  send(openee_token, `
     40    if (opener)
     41      send("${driver_token}", "Error: have opener");
     42    else
     43      send("${driver_token}", "Success: no opener");
     44  `);
     45  assert_equals(await receive(driver_token), "Success: no opener");
     46 
     47  // Technically, the opener's "openee" WindowProxy should appear as closed at
     48  // this time. The popup loaded a new document, and at least two fetch requests
     49  // were made. This is more than enough. However, in theory, there is nothing
     50  // to guarantee we can observe "openee.close". Wait a bit to ensure this will
     51  // never flake.
     52  await new Promise(r => test.step_timeout(r, 1000));
     53 
     54  send(opener_token, `
     55    if (openee.closed)
     56      send("${driver_token}", "Success: openee closed");
     57    else
     58      send("${driver_token}", "Error: can still access openee");
     59  `);
     60  assert_equals(await receive(driver_token), "Success: openee closed");
     61 });
     62 
     63 </script>