tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

submit-crossdocument-crossorigin-sameorigindomain.sub.html (1670B)


      1 <!doctype html>
      2 <script src="/resources/testharness.js"></script>
      3 <script src="/resources/testharnessreport.js"></script>
      4 <body>
      5 
      6 <script>
      7 document.domain = "{{host}}";
      8 async_test(t => {
      9  const url = new URL("resources/document-domain-setter.sub.html?start", location.href);
     10  url.hostname = "{{domains[www1]}}";
     11  const iframe = document.createElement("iframe");
     12  iframe.name = "windowname";
     13  iframe.src = url;
     14  document.body.append(iframe);
     15 
     16  url.search = ""; // setting to "?" actually erases it anyway
     17  const form = document.createElement("form");
     18  form.action = url + "?";
     19  form.target = iframe.name;
     20  document.body.append(form);
     21 
     22  navigation.onnavigate = t.unreached_func("onnavigate must not fire in the source window");
     23  window.onload = t.step_func(() => {
     24    iframe.contentWindow.navigation.onnavigate = t.step_func_done(e => {
     25      assert_equals(e.navigationType, "push", "navigationType");
     26      assert_true(e.cancelable, "cancelable");
     27      assert_true(e.canIntercept, "canIntercept");
     28      assert_false(e.userInitiated, "userInitiated");
     29      assert_false(e.hashChange, "hashChange");
     30      assert_equals(e.formData, null, "formData");
     31      assert_equals(e.destination.url, form.action, "destination.url");
     32      assert_false(e.destination.sameDocument, "destination.sameDocument");
     33      assert_equals(e.destination.key, "", "destination.key");
     34      assert_equals(e.destination.id, "", "destination.id");
     35      assert_equals(e.destination.index, -1, "destination.index");
     36    });
     37 
     38    form.submit();
     39  });
     40 }, "submitting a <form> element that navigates cross-document targeting a same-origin-domain (but cross-origin) window");
     41 </script>