tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

setHTMLUnsafe-runScripts.tentative.html (4858B)

      1 <!DOCTYPE html>
      2 <link rel="author" href="mailto:jarhar@chromium.org" />
      3 <link rel="help" href="https://github.com/whatwg/html/pull/9538" />
      4 <script src="/resources/testharness.js"></script>
      5 <script src="/resources/testharnessreport.js"></script>
      6 
      7 <body>
      8  <script>
      9    window.did_run = false;
     10    for (const containerType of ["Element", "ShadowRoot"]) {
     11      const createContainer = (t) => {
     12        const element = document.createElement("div");
     13        document.body.appendChild(element);
     14        t.add_cleanup(() => {
     15          element.remove();
     16        });
     17 
     18        if (containerType === "Element")
     19          return element;
     20 
     21        window.target_shadow_root = element.attachShadow({ mode: "open" });
     22        t.add_cleanup(() => {
     23          delete window.target_shadow_root;
     24        });
     25        return window.target_shadow_root;
     26      };
     27 
     28      test((t) => {
     29        const container = createContainer(t);
     30        container.setHTMLUnsafe(
     31          "<script>window.did_run = true;</" + "script>",
     32          { runScripts: true }
     33        );
     34        t.add_cleanup(() => {
     35          window.did_run = false;
     36        });
     37 
     38        assert_true(window.did_run);
     39      }, `${containerType}: setHTMLUnsafe with runScripts & no shadowdom.`);
     40 
     41      test((t) => {
     42        const container = createContainer(t);
     43        container.setHTMLUnsafe(
     44          "<script>window.did_run = true;</" + "script>",
     45          { runScripts: false }
     46        );
     47        t.add_cleanup(() => {
     48          window.did_run = false;
     49        });
     50 
     51        assert_false(window.did_run);
     52      }, `${containerType}: setHTMLUnsafe with runScripts=false & no shadowdom.`);
     53 
     54      test((t) => {
     55        const container = createContainer(t);
     56        container.setHTMLUnsafe(
     57          "<script>window.did_run = true;</" + "script>",
     58          { runScripts: false }
     59        );
     60        t.add_cleanup(() => {
     61          window.did_run = false;
     62        });
     63 
     64        assert_false(window.did_run);
     65      }, `${containerType}: setHTMLUnsafe without runScripts & no shadowdom.`);
     66 
     67      test((t) => {
     68        const container = createContainer(t);
     69        container.setHTMLUnsafe(
     70          "<div><template shadowrootmode=open><script>window.did_run = true;</" +
     71            "script></template></div>",
     72          { runScripts: true }
     73        );
     74 
     75        t.add_cleanup(() => {
     76          window.did_run = false;
     77        });
     78        assert_true(window.did_run);
     79      }, `${containerType}: setHTMLUnsafe with script inside declarative shadow DOM.`);
     80 
     81      promise_test(async (t) => {
     82        const container = createContainer(t);
     83        const { resolve, promise } = Promise.withResolvers();
     84        window.resolve = resolve;
     85        container.setHTMLUnsafe(
     86          `<script src="resources/did-run.js" onload="window.resolve()"><` +
     87            +`/script>`,
     88          { runScripts: true }
     89        );
     90 
     91        t.add_cleanup(() => {
     92          window.did_run = false;
     93          delete window.resolve;
     94        });
     95 
     96        await promise;
     97        assert_true(window.did_run);
     98      }, `${containerType}: setHTMLUnsafe with external script.`);
     99 
    100      promise_test(async (t) => {
    101        const container = createContainer(t);
    102        const { resolve, promise } = Promise.withResolvers();
    103        window.resolve = resolve;
    104        container.setHTMLUnsafe(
    105          `<script async src="resources/did-run.js" onload="window.resolve()"><` +
    106            +`/script>`,
    107          { runScripts: true }
    108        );
    109 
    110        t.add_cleanup(() => {
    111          window.did_run = false;
    112          delete window.resolve;
    113        });
    114 
    115        await promise;
    116        assert_true(window.did_run);
    117      }, `${containerType}: setHTMLUnsafe with external async script.`);
    118 
    119      promise_test(async (t) => {
    120        const container = createContainer(t);
    121        const { resolve, promise } = Promise.withResolvers();
    122        window.resolve = resolve;
    123        container.setHTMLUnsafe(
    124          `<script defer src="resources/did-run.js" onload="window.resolve()"><` +
    125            +`/script>`,
    126          { runScripts: true }
    127        );
    128 
    129        t.add_cleanup(() => {
    130          window.did_run = false;
    131          delete window.resolve;
    132        });
    133 
    134        await promise;
    135        assert_true(window.did_run);
    136      }, `${containerType}: setHTMLUnsafe with external defer script.`);
    137 
    138      promise_test(async (t) => {
    139        const container = createContainer(t);
    140        container.innerHTML = "";
    141        container.setHTMLUnsafe(
    142          `<div><script>
    143            (window.target_shadow_root || document).getElementById("after").textContent = "after";
    144            <` + `/script><div id=after></div></div>`,
    145          { runScripts: true }
    146        );
    147 
    148        assert_equals(container.querySelector("#after").textContent, "after");
    149      }, `${containerType}: setHTMLUnsafe script cannot observe intermediate state.`);
    150    }
    151  </script>
    152 </body>