Bug 1381755: Test that data: URIs can't activate plugins. r=bsmedberg

2017-07-24 20:34:44 +02:00 · 2017-07-24 20:34:44 +02:00 · 3e70ba6667
--- a/dom/plugins/test/mochitest/browser.ini
+++ b/dom/plugins/test/mochitest/browser.ini
@ -1,6 +1,7 @@
 [DEFAULT]
 support-files =
  head.js
+  plugin_data_url_test.html
  plugin_test.html
  plugin_subframe_test.html
  plugin_no_scroll_div.html
@ -14,3 +15,4 @@ skip-if = (!e10s || os != "win")
 [browser_pluginscroll.js]
 skip-if = (true || !e10s || os != "win") # Bug 1213631
 [browser_bug1335475.js]
+[browser_data_url_plugin.js]
--- a/dom/plugins/test/mochitest/browser_data_url_plugin.js
+++ b/dom/plugins/test/mochitest/browser_data_url_plugin.js
@ -0,0 +1,20 @@
+var rootDir = getRootDirectory(gTestPath);
+const gTestRoot = rootDir.replace("chrome://mochitests/content/", "http://127.0.0.1:8888/");
+
+add_task(async function() {
+  await SpecialPowers.pushPrefEnv({
+    "set": [["security.data_uri.unique_opaque_origin", true]],
+  });
+  is(navigator.plugins.length, 0,
+     "plugins should not be available to chrome-privilege pages");
+
+  await BrowserTestUtils.withNewTab({ gBrowser, url: gTestRoot + "plugin_data_url_test.html" }, async function(browser) {
+    await ContentTask.spawn(browser, null, async function() {
+      ok(content.window.navigator.plugins.length > 0,
+         "plugins should be available to HTTP-loaded pages");
+      let dataFrameWin = content.document.getElementById("dataFrame").contentWindow;
+      is(dataFrameWin.navigator.plugins.length, 0,
+         "plugins should not be available to data: URI in iframe on a site");
+    });
+  });
+});
--- a/dom/plugins/test/mochitest/plugin_data_url_test.html
+++ b/dom/plugins/test/mochitest/plugin_data_url_test.html
@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+</head>
+<body>
+  <embed id="testplugin" type="application/x-test" drawmode="solid" color="ff00ff00" wmode="window"
+         style="position:absolute; top:50px; left:50px; width:500px; height:250px">
+<div style="display:block; height:3000px;"></div>
+
+<iframe id="dataFrame" src="data:text/html,foo" width="300" height="300"></iframe>
+
+</body>
+</html>