tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

sandboxing-back-sibling.html (1962B)


      1 <!doctype html>
      2 <script src="/resources/testharness.js"></script>
      3 <script src="/resources/testharnessreport.js"></script>
      4 <script src="return-value/resources/helpers.js"></script>
      5 <iframe id="i" src="/common/blank.html?startI" sandbox="allow-same-origin"></iframe>
      6 <iframe id="i2" src="/common/blank.html?startI2" sandbox="allow-scripts allow-same-origin"></iframe>
      7 
      8 <script>
      9 // Intended setup:
     10 // Step 0:
     11 // - Parent: (current URL)
     12 // - i:      /common/blank.html?startI
     13 // - i2:     /common/blank.html?startI2
     14 // Step 1:
     15 // - Parent: (current URL)
     16 // - i:      /common/blank.html?startI
     17 // - i2:     resources/navigation-back.html
     18 // Step 2:
     19 // - Parent: (current URL)
     20 // - i:      /common/blank.html?endI
     21 // - i2:     resources/navigation-back.html
     22 //
     23 // Then, calling navigation.back() in i2 will take is from step 2 to step 0, which would navigate i.
     24 // That is not allowed, so the call to back() must reject.
     25 
     26 promise_test(async t => {
     27  await new Promise(resolve => window.onload = resolve);
     28 
     29  i2.contentWindow.location.href = new URL("resources/navigation-back.html", location.href);
     30  await new Promise(resolve => i2.onload = resolve);
     31 
     32  i.contentWindow.location.href = "/common/blank.html?endI";
     33  await new Promise(resolve => i.onload = resolve);
     34 
     35  i.contentWindow.navigation.onnavigate = t.unreached_func("navigate must not fire");
     36  i.contentWindow.navigation.onnavigateerror = t.unreached_func("navigateerror must not fire");
     37  i.contentWindow.onbeforeunload = t.unreached_func("beforeunload must not fire");
     38  i.contentWindow.onunload = t.unreached_func("unload must not fire");
     39  i.contentWindow.onpagehide = t.unreached_func("pagehide must not fire");
     40  i.contentWindow.onpopstate = t.unreached_func("popstate must not fire");
     41 
     42  await assertBothRejectDOM(t, i2.contentWindow.doNavigationBack(), "SecurityError", i2.contentWindow);
     43 }, "A sandboxed iframe cannot navigate its sibling via its own navigation object by using back()");
     44 </script>