permissions-policy-header-policy-allowed-for-some.https.sub.html (3318B)
1 <!DOCTYPE html> 2 <body> 3 <script src=/resources/testharness.js></script> 4 <script src=/resources/testharnessreport.js></script> 5 <script src=/permissions-policy/resources/permissions-policy.js></script> 6 <!-- Permissions-Policy: fullscreen=self cross_origin https://www.example.com; --> 7 <script> 8 'use strict'; 9 var same_origin = 'https://{{domains[]}}:{{ports[https][0]}}'; 10 var cross_origin = 'https://{{domains[www]}}:{{ports[https][0]}}'; 11 var cross_origin1 = 'https://{{domains[www1]}}:{{ports[https][0]}}'; 12 var same_origin_src = '/permissions-policy/resources/permissions-policy-allowedfeatures.html'; 13 var cross_origin_src = cross_origin + same_origin_src; 14 var cross_origin_src1 = cross_origin1 + same_origin_src; 15 var header_policy = `Permissions-Policy: fullscreen=(self "${cross_origin}" "https://www.example.com")`; 16 17 // Test that fullscreen's allowlist is [same_origin, cross_origin, 'https://www.example.com'] 18 test(function() { 19 assert_array_equals( 20 document.featurePolicy.getAllowlistForFeature('fullscreen').sort(), 21 [same_origin, cross_origin, 'https://www.example.com'].sort()); 22 }, header_policy + ' -- test allowlist is [same_origin, cross_origin, https://www.example.com]'); 23 24 // Test that fullscreen is allowed on same-origin, but disallowd on cross- 25 // origin subframes. without an allow attribute. 26 test_allowed_feature_for_subframe( 27 header_policy + ' -- test fullscreen is allowed on same-origin subframe', 28 'fullscreen', 29 same_origin_src); 30 test_disallowed_feature_for_subframe( 31 header_policy + ' -- test fullscreen is disallowed on cross-origin ' + cross_origin_src + ' subframe', 32 'fullscreen', 33 cross_origin_src); 34 test_disallowed_feature_for_subframe( 35 header_policy + ' -- test fullscreen is disallowed on cross-origin ' + cross_origin_src1 + ' subframe', 36 'fullscreen', 37 cross_origin_src1); 38 39 // dynamically update sub frame's container policy to none 40 var allow = "fullscreen 'none';" 41 test_disallowed_feature_for_subframe( 42 header_policy + ', iframe.allow = ' + allow + ' -- test fullscreen is disallowed on same-origin subframe', 43 'fullscreen', 44 same_origin_src, 45 allow); 46 test_disallowed_feature_for_subframe( 47 header_policy + 'iframe.allow = ' + allow + ' -- test fullscreen is disallowed on cross-origin subframe', 48 'fullscreen', 49 cross_origin_src, 50 allow); 51 test_disallowed_feature_for_subframe( 52 header_policy + 'iframe.allow = ' + allow + ' -- test fullscreen is disallowed on another cross-origin subframe', 53 'fullscreen', 54 cross_origin_src1, 55 allow); 56 57 // dynamically update sub frame's container policy to src 58 allow = "fullscreen 'src';" 59 test_allowed_feature_for_subframe( 60 header_policy + ', iframe.allow = ' + allow + ' -- test fullscreen is allowed on same-origin subframe', 61 'fullscreen', 62 same_origin_src, 63 allow); 64 test_allowed_feature_for_subframe( 65 header_policy + 'iframe.allow = ' + allow + ' -- test fullscreen is allowed on cross-origin subframe', 66 'fullscreen', 67 cross_origin_src, 68 allow); 69 test_disallowed_feature_for_subframe( 70 header_policy + ', iframe.allow = ' + allow + ' -- test fullscreen is disallowed on another cross-origin subframe', 71 'fullscreen', 72 cross_origin_src1, 73 allow); 74 </script> 75 </body>