tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

helper.sub.js (3763B)

      1 function xfo_simple_tests({ headerValue, headerValue2, cspValue, sameOriginAllowed, crossOriginAllowed }) {
      2  simpleXFOTestsInner({
      3    urlPrefix: "",
      4    allowed: sameOriginAllowed,
      5    headerValue,
      6    headerValue2,
      7    cspValue,
      8    sameOrCross: "same-origin"
      9  });
     10 
     11  simpleXFOTestsInner({
     12    urlPrefix: "http://{{domains[www]}}:{{ports[http][0]}}",
     13    allowed: crossOriginAllowed,
     14    headerValue,
     15    headerValue2,
     16    cspValue,
     17    sameOrCross: "cross-origin"
     18  });
     19 }
     20 
     21 function simpleXFOTestsInner({ urlPrefix, allowed, headerValue, headerValue2, cspValue, sameOrCross }) {
     22  const value2QueryString = headerValue2 !== undefined ? `&value2=${headerValue2}` : ``;
     23  const cspQueryString = cspValue !== undefined ? `&csp_value=${cspValue}` : ``;
     24 
     25  const valueMessageString = headerValue === "" ? "(the empty string)" : headerValue;
     26  const value2MessageString = headerValue2 === "" ? "(the empty string)" : headerValue2;
     27  const value2MaybeMessageString = headerValue2 !== undefined ? `;${headerValue2}` : ``;
     28  const cspMessageString = cspValue !== undefined ? ` with CSP ${cspValue}` : ``;
     29 
     30  // This will test the multi-header variant, if headerValue2 is not undefined.
     31  xfo_test({
     32    url: `${urlPrefix}/x-frame-options/support/xfo.py?value=${headerValue}${value2QueryString}${cspQueryString}`,
     33    check: allowed ? "loaded message" : "no message",
     34    message: `\`${valueMessageString}${value2MaybeMessageString}\` ${allowed ? "allows" : "blocks"} ${sameOrCross} framing${cspMessageString}`
     35  });
     36 
     37  if (headerValue2 !== undefined && headerValue2 !== headerValue) {
     38    // Reversed variant
     39    xfo_test({
     40      url: `${urlPrefix}/x-frame-options/support/xfo.py?value=${headerValue2}&value2=${headerValue}${cspQueryString}`,
     41      check: allowed ? "loaded message" : "no message",
     42      message: `\`${value2MessageString};${valueMessageString}\` ${allowed ? "allows" : "blocks"} ${sameOrCross} framing${cspMessageString}`
     43    });
     44 
     45    // Comma variant
     46    xfo_test({
     47      url: `${urlPrefix}/x-frame-options/support/xfo.py?value=${headerValue},${headerValue2}${cspQueryString}`,
     48      check: allowed ? "loaded message" : "no message",
     49      message: `\`${valueMessageString},${value2MessageString}\` ${allowed ? "allows" : "blocks"} ${sameOrCross} framing${cspMessageString}`
     50    });
     51 
     52    // Comma + reversed variant
     53    xfo_test({
     54      url: `${urlPrefix}/x-frame-options/support/xfo.py?value=${headerValue2},${headerValue}${cspQueryString}`,
     55      check: allowed ? "loaded message" : "no message",
     56      message: `\`${value2MessageString},${valueMessageString}\` ${allowed ? "allows" : "blocks"} ${sameOrCross} framing${cspMessageString}`
     57    });
     58  }
     59 }
     60 
     61 function xfo_test({ url, check, message }) {
     62  async_test(t => {
     63    const i = document.createElement("iframe");
     64    i.src = url;
     65 
     66    switch (check) {
     67      case "loaded message": {
     68        waitForMessageFrom(i, t).then(t.step_func_done(e => {
     69          assert_equals(e.data, "Loaded");
     70        }));
     71        break;
     72      }
     73      case "failed message": {
     74        waitForMessageFrom(i, t).then(t.step_func_done(e => {
     75          assert_equals(e.data, "Failed");
     76        }));
     77        break;
     78      }
     79      case "no message": {
     80        waitForMessageFrom(i, t).then(t.unreached_func("Frame should not have sent a message."));
     81        i.onload = t.step_func_done(() => {
     82          assert_equals(i.contentDocument, null);
     83        });
     84        break;
     85      }
     86      default: {
     87        throw new Error("Bad test");
     88      }
     89    }
     90 
     91    document.body.append(i);
     92  }, message);
     93 }
     94 
     95 function waitForMessageFrom(frame, test) {
     96  return new Promise(resolve => {
     97    window.addEventListener("message", test.step_func(e => {
     98      if (e.source == frame.contentWindow) {
     99        resolve(e);
    100      }
    101    }));
    102  });
    103 }