зеркало из https://github.com/mozilla/gecko-dev.git
Bug 341604 - tests for iframe sandbox - inheritance r=jst
This commit is contained in:
Ian Melven
Родитель
31c2f23992
Коммит
4b2cb80903
|
|
@ -266,6 +266,16 @@ MOCHITEST_FILES = \
|
|||
test_input_file_picker.html \
|
||||
test_bug763626.html \
|
||||
test_bug780993.html \
|
||||
test_iframe_sandbox_inheritance.html \
|
||||
file_iframe_sandbox_a_if1.html \
|
||||
file_iframe_sandbox_a_if2.html \
|
||||
file_iframe_sandbox_a_if3.html \
|
||||
file_iframe_sandbox_a_if4.html \
|
||||
file_iframe_sandbox_a_if5.html \
|
||||
file_iframe_sandbox_a_if6.html \
|
||||
file_iframe_sandbox_a_if7.html \
|
||||
file_iframe_sandbox_a_if8.html \
|
||||
file_iframe_sandbox_a_if9.html \
|
||||
test_iframe_sandbox_same_origin.html \
|
||||
file_iframe_sandbox_b_if1.html \
|
||||
file_iframe_sandbox_b_if2.html \
|
||||
|
|
|
|||
|
|
@ -0,0 +1,13 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Test for Bug 341604</title>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
</head>
|
||||
<body>
|
||||
I am sandboxed without any permissions
|
||||
<iframe id="if_2a" src="file_iframe_sandbox_a_if2.html" height="10" width="10"></iframe>
|
||||
<iframe id="if_2b" sandbox="allow-scripts" src="file_iframe_sandbox_a_if2.html" height="10" width="10"></iframe>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Test for Bug 341604</title>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
</head>
|
||||
|
||||
<script type="text/javascript">
|
||||
function doStuff() {
|
||||
// should NOT be able to execute scripts
|
||||
window.parent.parent.postMessage({ok: false, desc: "a document within an iframe sandboxed with sandbox='' should NOT be able to execute scripts"}, "*");
|
||||
}
|
||||
</script>
|
||||
|
||||
<body onLoad="doStuff()">
|
||||
I am NOT sandboxed or am sandboxed with "allow-scripts" but am contained within an iframe sandboxed with sandbox = ""
|
||||
or am sandboxed with sandbox='' inside an iframe sandboxed with "allow-scripts"
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Test for Bug 341604</title>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
<script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
|
||||
</head>
|
||||
|
||||
<script type="text/javascript">
|
||||
function ok_wrapper(condition, msg) {
|
||||
window.parent.ok_wrapper(condition, msg);
|
||||
}
|
||||
</script>
|
||||
|
||||
<body>
|
||||
I am sandboxed but with "allow-scripts"
|
||||
|
||||
<iframe id='if_4' src='file_iframe_sandbox_a_if4.html' height="10" width="10"></iframe>
|
||||
<iframe id='if_7' src='file_iframe_sandbox_a_if7.html' height="10" width="10"></iframe>
|
||||
<iframe id='if_2' sandbox='' src='file_iframe_sandbox_a_if2.html' height="10" width="10"></iframe>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Test for Bug 341604</title>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
<script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
|
||||
</head>
|
||||
|
||||
<script type="text/javascript">
|
||||
function doStuff() {
|
||||
try {
|
||||
window.parent.ok_wrapper(false, "a document contained within a sandboxed document without 'allow-same-origin' should NOT be same domain with its parent");
|
||||
} catch(e) {
|
||||
}
|
||||
|
||||
try {
|
||||
window.parent.parent.ok_wrapper(false, "a document contained within a sandboxed document without 'allow-same-origin' should NOT be same domain with the top level");
|
||||
} catch(e) {
|
||||
}
|
||||
}
|
||||
</script>
|
||||
|
||||
<body onLoad="doStuff()">
|
||||
I am not sandboxed but contained within a sandboxed document with 'allow-scripts'
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Test for Bug 341604</title>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
<script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
|
||||
</head>
|
||||
|
||||
<script type="text/javascript">
|
||||
function ok_wrapper(result, desc) {
|
||||
window.parent.ok_wrapper(result, desc);
|
||||
}
|
||||
</script>
|
||||
|
||||
<body>
|
||||
I am sandboxed but with "allow-scripts allow-same-origin"
|
||||
|
||||
<iframe sandbox='allow-scripts allow-same-origin' id='if_6' src='file_iframe_sandbox_a_if6.html' height="10" width="10"></iframe>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Test for Bug 341604</title>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
<script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
|
||||
</head>
|
||||
|
||||
<script type="text/javascript">
|
||||
function doStuff() {
|
||||
window.parent.ok_wrapper(true, "a document sandboxed with 'allow-same-origin' and contained within a sandboxed document with 'allow-same-origin' should be same domain with its parent");
|
||||
window.parent.parent.ok_wrapper(true, "a document sandboxed with 'allow-same-origin' contained within a sandboxed document with 'allow-same-origin' should be same domain with the top level");
|
||||
}
|
||||
</script>
|
||||
|
||||
<body onLoad="doStuff()">
|
||||
I am sandboxed with 'allow-scripts allow-same-origin' and contained within a sandboxed document with 'allow-scripts allow-same-origin'
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Test for Bug 341604</title>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
</head>
|
||||
|
||||
<script type="text/javascript">
|
||||
function doStuff() {
|
||||
// should be able to execute scripts
|
||||
window.parent.parent.postMessage({ok: true, desc: "a document contained within an iframe contained within an iframe sandboxed with 'allow-scripts' should be able to execute scripts"}, "*");
|
||||
}
|
||||
</script>
|
||||
|
||||
<body onLoad="doStuff()">
|
||||
I am NOT sandboxed but am contained within an iframe contained within an iframe sandboxed with sandbox = "allow-scripts"
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Test for Bug 341604</title>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
<script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>
|
||||
</head>
|
||||
<script>
|
||||
function doSubload() {
|
||||
var if_9 = document.getElementById('if_9');
|
||||
if_9.src = 'file_iframe_sandbox_a_if9.html';
|
||||
}
|
||||
|
||||
window.doSubload = doSubload;
|
||||
|
||||
</script>
|
||||
<body>
|
||||
I am sandboxed but with "allow-scripts allow-same-origin". After my initial load, "allow-same-origin" is removed
|
||||
and then I load file_iframe_sandbox_a_if9.html, which attemps to call a function in window.top. This should
|
||||
succeed since the new sandbox flags shouldn't have taken affect on me until I'm reloaded.
|
||||
|
||||
<iframe id='if_9' src='about:blank' height="10" width="10"></iframe>
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Test for Bug 341604</title>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
</head>
|
||||
<script>
|
||||
function doStuff() {
|
||||
window.parent.parent.ok_wrapper(true, "a subloaded document should inherit the flags of the document, not of the docshell/sandbox attribute");
|
||||
}
|
||||
</script>
|
||||
<body onload='doStuff()'>
|
||||
I'm a subloaded document of file_iframe_sandbox_a_if8.html. I should be able to call a function in window.top
|
||||
because I should be same-origin with it.
|
||||
</body>
|
||||
</html>
|
||||
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<!--
|
||||
https://bugzilla.mozilla.org/show_bug.cgi?id=341604
|
||||
Implement HTML5 sandbox attribute for IFRAMEs - inheritance tests
|
||||
-->
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Test for Bug 341604</title>
|
||||
<script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
||||
</head>
|
||||
<script type="application/javascript">
|
||||
/** Test for Bug 341604 - Implement HTML5 sandbox attribute for IFRAMEs **/
|
||||
/** Inheritance Tests **/
|
||||
|
||||
SimpleTest.waitForExplicitFinish();
|
||||
|
||||
// A postMessage handler that is used by sandboxed iframes without
|
||||
// 'allow-same-origin' to communicate pass/fail back to this main page.
|
||||
// It expects to be called with an object like {ok: true/false, desc:
|
||||
// <description of the test> which it then forwards to ok().
|
||||
window.addEventListener("message", receiveMessage, false);
|
||||
|
||||
var completedTests = 0;
|
||||
var passedTests = 0;
|
||||
|
||||
function receiveMessage(event)
|
||||
{
|
||||
ok_wrapper(event.data.ok, event.data.desc);
|
||||
}
|
||||
|
||||
function ok_wrapper(result, desc) {
|
||||
ok(result, desc);
|
||||
|
||||
completedTests++;
|
||||
|
||||
if (result) {
|
||||
passedTests++;
|
||||
}
|
||||
|
||||
if (completedTests == 4) {
|
||||
is(passedTests, 4, "there should be 3 passed inheritance tests");
|
||||
SimpleTest.finish();
|
||||
}
|
||||
}
|
||||
|
||||
function doTest() {
|
||||
// fails if bad
|
||||
// 1) an iframe with no sandbox attribute inside an iframe that has sandbox = ""
|
||||
// should not be able to execute scripts (cannot ever loosen permissions)
|
||||
// (done by file_iframe_sandbox_a_if2.html contained within file_iframe_sandbox_a_if1.html)
|
||||
|
||||
// fails if bad
|
||||
// 2) an iframe with sandbox = "allow-scripts" inside an iframe that has sandbox = ""
|
||||
// should not be able to execute scripts (cannot ever loosen permissions)
|
||||
// (done by file_iframe_sandbox_a_if2.html contained within file_iframe_sandbox_a_if1.html)
|
||||
|
||||
// fails if bad
|
||||
// 3) an iframe with no sandbox attribute inside an iframe that has sandbox = "allow-scripts"
|
||||
// should not be same origin with the top window
|
||||
// (done by file_iframe_sandbox_a_if4.html contained within file_iframe_sandbox_a_if3.html)
|
||||
|
||||
// fails if bad
|
||||
// 4) an iframe with no sandbox attribute inside an iframe that has sandbox = "allow-scripts"
|
||||
// should not be same origin with its parent
|
||||
// (done by file_iframe_sandbox_a_if4.html contained within file_iframe_sandbox_a_if3.html)
|
||||
|
||||
// passes if good
|
||||
// 5) an iframe with 'allow-same-origin' and 'allow-scripts' inside an iframe with 'allow-same-origin'
|
||||
// and 'allow-scripts' should be same origin with the top window
|
||||
// (done by file_iframe_sandbox_a_if6.html contained within file_iframe_sandbox_a_if5.html)
|
||||
|
||||
// passes if good
|
||||
// 6) an iframe with 'allow-same-origin' and 'allow-scripts' inside an iframe with 'allow-same-origin'
|
||||
// and 'allow-scripts' should be same origin with its parent
|
||||
// (done by file_iframe_sandbox_a_if6.html contained within file_iframe_sandbox_a_if5.html)
|
||||
|
||||
// passes if good
|
||||
// 7) an iframe with no sandbox attribute inside an iframe that has sandbox = "allow-scripts"
|
||||
// should be able to execute scripts
|
||||
// (done by file_iframe_sandbox_a_if7.html contained within file_iframe_sandbox_a_if3.html)
|
||||
|
||||
// fails if bad
|
||||
// 8) an iframe with sandbox="" inside an iframe that has allow-scripts should not be able
|
||||
// to execute scripts
|
||||
// (done by file_iframe_sandbox_a_if2.html contained within file_iframe_sandbox_a_if3.html)
|
||||
|
||||
// passes if good
|
||||
// 9) make sure that changing the sandbox flags on an iframe (if_8) doesn't affect
|
||||
// the sandboxing of subloads of content within that iframe
|
||||
var if_8 = document.getElementById('if_8');
|
||||
if_8.sandbox = 'allow-scripts';
|
||||
if_8.contentWindow.doSubload();
|
||||
}
|
||||
|
||||
addLoadEvent(doTest);
|
||||
</script>
|
||||
<body>
|
||||
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=341604">Mozilla Bug 341604</a> - Implement HTML5 sandbox attribute for IFRAMEs
|
||||
<p id="display"></p>
|
||||
<div id="content">
|
||||
<iframe sandbox="" id="if_1" src="file_iframe_sandbox_a_if1.html" height="10" width="10"></iframe>
|
||||
<iframe sandbox="allow-scripts" id="if_3" src="file_iframe_sandbox_a_if3.html" height="10" width="10"></iframe>
|
||||
<iframe sandbox="allow-scripts allow-same-origin" id="if_5" src="file_iframe_sandbox_a_if5.html" height="10" width="10"></iframe>
|
||||
<iframe sandbox="allow-scripts allow-same-origin" id="if_8" src="file_iframe_sandbox_a_if8.html" height="10" width="10"></iframe>
|
||||
</div>
|
||||
Загрузка…
Ссылка в новой задаче