tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

propagation-same-and-cross-origin.sub.html (5239B)


      1 <!DOCTYPE html>
      2 <html>
      3  <head>
      4    <script src="/resources/testharness.js"></script>
      5    <script src="/resources/testharnessreport.js"></script>
      6    <script src="/resources/testdriver.js"></script>
      7    <script src="/resources/testdriver-vendor.js"></script>
      8    <script src="resources/utils.js"></script>
      9  </head>
     10  <body>
     11    <h1>Check that cross origin iframes don't get activated</h1>
     12    <p>
     13      Tests that activating a same-origin navigable doesn't activate a cross
     14      origin navigable.
     15    </p>
     16    <ol id="instructions">
     17      <li>Click inside the yellow area.</li>
     18    </ol>
     19    <h1>Same origin</h1>
     20    <iframe id="so-child" width="200" height="50"></iframe>
     21    <h1>Cross origin</h1>
     22    <iframe id="xo-child" width="200" height="50"></iframe>
     23  </body>
     24  <script>
     25    const soChild = document.getElementById("so-child");
     26    const xoChild = document.getElementById("xo-child");
     27 
     28    function requestXOReport() {
     29      xoChild.contentWindow.postMessage(
     30        JSON.stringify({ type: "report" }),
     31        "*"
     32      );
     33      return receiveMessage(`child-two-report`);
     34    }
     35 
     36    promise_setup(() => {
     37      soChild.src = "./resources/child-one.html";
     38      xoChild.src =
     39        "http://{{hosts[alt][]}}:{{ports[http][0]}}/html/user-activation/resources/child-two.html";
     40      return Promise.all([
     41        receiveMessage("child-one-loaded"),
     42        receiveMessage("child-two-loaded"),
     43      ]);
     44    });
     45 
     46    promise_test(async (t) => {
     47      const unclickedCrossOrigin = await requestXOReport();
     48      const soActivation = soChild.contentWindow.navigator.userActivation;
     49      assert_false(
     50        navigator.userActivation.isActive,
     51        "top-frame navigator.userActivation.isActive must be false"
     52      );
     53      assert_false(
     54        navigator.userActivation.hasBeenActive,
     55        "top-frame navigator.userActivation.hasBeenActive must be false"
     56      );
     57 
     58      assert_false(soActivation.isActive, "child-one isActive must be false");
     59      assert_false(
     60        soActivation.hasBeenActive,
     61        "child-one hasBeenActive must be false"
     62      );
     63      assert_false(
     64        unclickedCrossOrigin.isActive,
     65        "child-two isActive must be false"
     66      );
     67      assert_false(
     68        unclickedCrossOrigin.hasBeenActive,
     69        "child-two hasBeenActive must be false"
     70      );
     71    }, "Check Initial states of user activation are all false");
     72 
     73    promise_test(async (t) => {
     74      await test_driver.click(soChild);
     75      const xoActivation = await requestXOReport();
     76      const soActivation = soChild.contentWindow.navigator.userActivation;
     77      assert_true(
     78        navigator.userActivation.isActive,
     79        "top-frame navigator.userActivation.isActive must be true"
     80      );
     81      assert_true(
     82        navigator.userActivation.hasBeenActive,
     83        "top-frame navigator.userActivation.hasBeenActive must be true"
     84      );
     85      assert_true(soActivation.isActive, "child-one isActive must be true");
     86      assert_true(
     87        soActivation.hasBeenActive,
     88        "child-one hasBeenActive must be true"
     89      );
     90      assert_false(xoActivation.isActive, "child-two isActive must be false");
     91      assert_false(
     92        xoActivation.hasBeenActive,
     93        "child-two hasBeenActive must be false"
     94      );
     95    }, "Check that activating a same-origin navigable doesn't activate a cross origin navigable");
     96 
     97    promise_test(async (t) => {
     98      await consumeTransientActivation();
     99      const soActivation = soChild.contentWindow.navigator.userActivation;
    100      // Before click...
    101      assert_false(
    102        navigator.userActivation.isActive,
    103        "top-frame navigator.userActivation.isActive must be false"
    104      );
    105      assert_true(
    106        navigator.userActivation.hasBeenActive,
    107        "top-frame navigator.userActivation.hasBeenActive must be true"
    108      );
    109      assert_false(soActivation.isActive, "child-one isActive must be false");
    110      assert_true(
    111        soActivation.hasBeenActive,
    112        "child-one hasBeenActive must be true"
    113      );
    114      const xoActivation = await requestXOReport();
    115      assert_false(xoActivation.isActive, "child-two isActive must be false");
    116      assert_false(
    117        xoActivation.hasBeenActive,
    118        "child-two hasBeenActive must be false"
    119      );
    120 
    121      // Click!
    122      const [, xoActivationAfterClick] = await Promise.all([
    123        test_driver.click(xoChild),
    124        receiveMessage("child-two-clicked"),
    125      ]);
    126 
    127      // After click...
    128      assert_true(
    129        navigator.userActivation.isActive,
    130        "top-frame navigator.userActivation.isActive must be true"
    131      );
    132      assert_true(
    133        navigator.userActivation.hasBeenActive,
    134        "top-frame navigator.userActivation.hasBeenActive must remain true"
    135      );
    136      assert_true(
    137        xoActivationAfterClick.isActive,
    138        "child-two isActive must be true"
    139      );
    140      assert_true(
    141        xoActivationAfterClick.hasBeenActive,
    142        "child-two hasBeenActive must be true"
    143      );
    144      assert_false(soActivation.isActive, "child-one isActive must be false");
    145      assert_true(
    146        soActivation.hasBeenActive,
    147        "child-one hasBeenActive must remain true"
    148      );
    149    }, "Clicking on the cross-origin navigable activates parent navigable.");
    150  </script>
    151 </html>