tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

shared-storage-writable-fetch-request-in-data-url.tentative.https.sub.html (2524B)

      1 <!doctype html>
      2 <body>
      3  <script src=/resources/testharness.js></script>
      4  <script src=/resources/testharnessreport.js></script>
      5  <script src=/common/utils.js></script>
      6  <script src=/fenced-frame/resources/utils.js></script>
      7  <script src=/shared-storage/resources/util.js></script>
      8  <script>
      9    'use strict';
     10    const origin = window.location.origin;
     11    const rawSetHeader = 'set;key=hello;value=world';
     12    const setHeader = encodeURIComponent(rawSetHeader);
     13 
     14    promise_test(async t => {
     15      let frame = document.createElement('iframe');
     16      const promise = new Promise((resolve, reject) => {
     17        window.addEventListener('message', async function handler(evt) {
     18          if (evt.source === frame.contentWindow &&
     19              evt.data.sharedStorageFetchStatus) {
     20            document.body.removeChild(frame);
     21            window.removeEventListener('message', handler);
     22            resolve(evt.data.sharedStorageFetchStatus);
     23          }
     24        });
     25        window.addEventListener('error', (error) => {
     26          reject(error);
     27        });
     28      });
     29 
     30      const fetchUrl =
     31        `${origin}\\/shared-storage\\/resources\\/shared-storage-write.py`
     32        + `?write=${setHeader}`;
     33      const fetchCode = `
     34 let parentOrOpener = window.opener || window.parent;
     35 let innerFrame = document.createElement('iframe');
     36 window.addEventListener('message', async (evt) => {
     37  if (evt.source === innerFrame.contentWindow) {
     38    parentOrOpener.postMessage({sharedStorageFetchStatus: "success"}, '*');
     39  }
     40 });
     41 window.addEventListener('error', (error) => {
     42  parentOrOpener.postMessage({sharedStorageFetchStatus: error.message}, '*');
     43 });
     44 fetch('${fetchUrl}', {sharedStorageWritable: true})
     45  .then(response => response.text())
     46  .then(htmlContent => {
     47    innerFrame.srcdoc = htmlContent;
     48    document.body.appendChild(innerFrame);
     49  })
     50  .catch(error => {
     51    parentOrOpener.postMessage({sharedStorageFetchStatus: error.name},
     52                                "*");
     53  });
     54 `;
     55 
     56      const dataURL = 'data:text/html;base64,'
     57        + btoa(unescape('%3Chtml%3E%3Cbody%3E%3Cscript%3E'
     58                        + encodeURIComponent(fetchCode) +
     59                        '%3C%2Fscript%3E%3C%2Fbody%3E%3C%2Fhtml%3E'));
     60      frame.src = dataURL;
     61      document.body.appendChild(frame);
     62 
     63      const result = await promise;
     64      assert_equals(result, "TypeError");
     65      await verifyKeyNotFoundForOrigin('hello', origin);
     66 
     67    }, 'shared storage fetch request disallowed in opaque origin from data URL');
     68  </script>
     69 </body>