sandboxing-back-sibling.html (1962B)
1 <!doctype html> 2 <script src="/resources/testharness.js"></script> 3 <script src="/resources/testharnessreport.js"></script> 4 <script src="return-value/resources/helpers.js"></script> 5 <iframe id="i" src="/common/blank.html?startI" sandbox="allow-same-origin"></iframe> 6 <iframe id="i2" src="/common/blank.html?startI2" sandbox="allow-scripts allow-same-origin"></iframe> 7 8 <script> 9 // Intended setup: 10 // Step 0: 11 // - Parent: (current URL) 12 // - i: /common/blank.html?startI 13 // - i2: /common/blank.html?startI2 14 // Step 1: 15 // - Parent: (current URL) 16 // - i: /common/blank.html?startI 17 // - i2: resources/navigation-back.html 18 // Step 2: 19 // - Parent: (current URL) 20 // - i: /common/blank.html?endI 21 // - i2: resources/navigation-back.html 22 // 23 // Then, calling navigation.back() in i2 will take is from step 2 to step 0, which would navigate i. 24 // That is not allowed, so the call to back() must reject. 25 26 promise_test(async t => { 27 await new Promise(resolve => window.onload = resolve); 28 29 i2.contentWindow.location.href = new URL("resources/navigation-back.html", location.href); 30 await new Promise(resolve => i2.onload = resolve); 31 32 i.contentWindow.location.href = "/common/blank.html?endI"; 33 await new Promise(resolve => i.onload = resolve); 34 35 i.contentWindow.navigation.onnavigate = t.unreached_func("navigate must not fire"); 36 i.contentWindow.navigation.onnavigateerror = t.unreached_func("navigateerror must not fire"); 37 i.contentWindow.onbeforeunload = t.unreached_func("beforeunload must not fire"); 38 i.contentWindow.onunload = t.unreached_func("unload must not fire"); 39 i.contentWindow.onpagehide = t.unreached_func("pagehide must not fire"); 40 i.contentWindow.onpopstate = t.unreached_func("popstate must not fire"); 41 42 await assertBothRejectDOM(t, i2.contentWindow.doNavigationBack(), "SecurityError", i2.contentWindow); 43 }, "A sandboxed iframe cannot navigate its sibling via its own navigation object by using back()"); 44 </script>