Bug 1394554: Test block data: URI toplevel navigations after redirect. r=smaug

2017-09-06 09:34:38 +02:00 · 2017-09-06 09:34:38 +02:00 · 8cc650c579
--- a/dom/security/test/general/file_block_toplevel_data_redirect.sjs
+++ b/dom/security/test/general/file_block_toplevel_data_redirect.sjs
@ -0,0 +1,14 @@
+// Custom *.sjs file specifically for the needs of Bug:
+// Bug 1394554 - Block toplevel data: URI navigations after redirect
+
+var DATA_URI =
+  "<body>toplevel data: URI navigations after redirect should be blocked</body>";
+
+function handleRequest(request, response)
+{
+  // avoid confusing cache behaviors
+  response.setHeader("Cache-Control", "no-cache", false);
+
+  response.setStatusLine("1.1", 302, "Found");
+  response.setHeader("Location", "data:text/html," + escape(DATA_URI), false);
+}
--- a/dom/security/test/general/mochitest.ini
+++ b/dom/security/test/general/mochitest.ini
@ -6,6 +6,7 @@ support-files =
  file_block_toplevel_data_navigation.html
  file_block_toplevel_data_navigation2.html
  file_block_toplevel_data_navigation3.html
+  file_block_toplevel_data_redirect.sjs

 [test_contentpolicytype_targeted_link_iframe.html]
 [test_nosniff.html]
--- a/dom/security/test/general/test_block_toplevel_data_navigation.html
+++ b/dom/security/test/general/test_block_toplevel_data_navigation.html
@ -65,7 +65,19 @@ function test4() {
    // loaded, hence we rather rely on document.body than document.location
    is(win4.document.body.innerHTML, "",
      "navigating to a data: URI using window.open() should be blocked");
-    win4.close();
+    test5();
+  }, 1000);
+}
+
+function test5() {
+  // navigating to a URI which redirects to a data: URI using window.open() should be blocked
+  let win5 = window.open("file_block_toplevel_data_redirect.sjs");
+  setTimeout(function () {
+    // Please note that the data: URI will be displayed in the URL-Bar but not
+    // loaded, hence we rather rely on document.body than document.location
+    is(SpecialPowers.wrap(win5).document.body.innerHTML, "",
+      "navigating to URI which redirects to a data: URI using window.open() should be blocked");
+    win5.close();
    SimpleTest.finish();
  }, 1000);
 }