зеркало из https://github.com/mozilla/gecko-dev.git
Bug 1331351: Test block toplevel window data: URI navigations. r=smaug
This commit is contained in:
Christoph Kerschbaumer
Родитель
9c97294062
Коммит
e116c4627b
|
|
@ -0,0 +1,14 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Toplevel data navigation</title>
|
||||
</head>
|
||||
<body>
|
||||
test1: clicking data: URI tries to navigate window<br/>
|
||||
<a id="testlink" href="data:text/html,<body>toplevel data: URI navigations should be blocked</body>">click me</a>
|
||||
<script>
|
||||
document.getElementById('testlink').click();
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Toplevel data navigation</title>
|
||||
</head>
|
||||
<body>
|
||||
test2: data: URI in iframe tries to window.open(data:, _blank);<br/>
|
||||
<iframe id="testFrame" src=""></iframe>
|
||||
<script>
|
||||
let DATA_URI = `data:text/html,<body><script>
|
||||
var win = window.open("data:text/html,<body>toplevel data: URI navigations should be blocked</body>", "_blank");
|
||||
setTimeout(function () {
|
||||
var result = win.document.body.innerHTML === "" ? "blocked" : "navigated";
|
||||
parent.postMessage(result, "*");
|
||||
win.close();
|
||||
}, 1000);
|
||||
<\/script></body>`;
|
||||
|
||||
window.addEventListener("message", receiveMessage);
|
||||
function receiveMessage(event) {
|
||||
window.removeEventListener("message", receiveMessage);
|
||||
// propagate the information back to the caller
|
||||
window.opener.postMessage(event.data, "*");
|
||||
}
|
||||
document.getElementById('testFrame').src = DATA_URI;
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -0,0 +1,13 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Toplevel data navigation</title>
|
||||
</head>
|
||||
<body>
|
||||
test3: performing data: URI navigation through win.loc.href<br/>
|
||||
<script>
|
||||
window.location.href = "data:text/html,<body>toplevel data: URI navigations should be blocked</body>";
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -3,7 +3,11 @@ support-files =
|
|||
file_contentpolicytype_targeted_link_iframe.sjs
|
||||
file_nosniff_testserver.sjs
|
||||
file_block_script_wrong_mime_server.sjs
|
||||
file_block_toplevel_data_navigation.html
|
||||
file_block_toplevel_data_navigation2.html
|
||||
file_block_toplevel_data_navigation3.html
|
||||
|
||||
[test_contentpolicytype_targeted_link_iframe.html]
|
||||
[test_nosniff.html]
|
||||
[test_block_script_wrong_mime.html]
|
||||
[test_block_toplevel_data_navigation.html]
|
||||
|
|
|
|||
|
|
@ -0,0 +1,78 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Bug 1331351 - Block top level window data: URI navigations</title>
|
||||
<!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
|
||||
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
|
||||
</head>
|
||||
<body>
|
||||
<script class="testbody" type="text/javascript">
|
||||
SpecialPowers.setBoolPref("security.data_uri.block_toplevel_data_uri_navigations", true);
|
||||
SimpleTest.registerCleanupFunction(() => {
|
||||
SpecialPowers.clearUserPref("security.data_uri.block_toplevel_data_uri_navigations");
|
||||
});
|
||||
|
||||
SimpleTest.waitForExplicitFinish();
|
||||
SimpleTest.requestFlakyTimeout("have to test that top level data: URI navgiation is blocked");
|
||||
|
||||
function test1() {
|
||||
// simple data: URI click navigation should be prevented
|
||||
let TEST_FILE = "file_block_toplevel_data_navigation.html";
|
||||
let win1 = window.open(TEST_FILE);
|
||||
var readyStateCheckInterval = setInterval(function() {
|
||||
let state = win1.document.readyState;
|
||||
if (state === "interactive" || state === "complete") {
|
||||
clearInterval(readyStateCheckInterval);
|
||||
ok(win1.document.body.innerHTML.indexOf("test1:") !== -1,
|
||||
"toplevel data: URI navigation through click() should be blocked");
|
||||
win1.close();
|
||||
test2();
|
||||
}
|
||||
}, 200);
|
||||
}
|
||||
|
||||
function test2() {
|
||||
// data: URI in iframe which opens data: URI in _blank should be blocked
|
||||
let win2 = window.open("file_block_toplevel_data_navigation2.html");
|
||||
window.addEventListener("message", receiveMessage);
|
||||
function receiveMessage(event) {
|
||||
window.removeEventListener("message", receiveMessage);
|
||||
is(event.data, "blocked",
|
||||
"data: URI navigation using _blank from data: URI should be blocked");
|
||||
win2.close();
|
||||
test3();
|
||||
}
|
||||
}
|
||||
|
||||
function test3() {
|
||||
// navigating to a data: URI using window.location.href should be blocked
|
||||
let win3 = window.open("file_block_toplevel_data_navigation3.html");
|
||||
setTimeout(function () {
|
||||
ok(win3.document.body.innerHTML.indexOf("test3:") !== -1,
|
||||
"data: URI navigation through win.loc.href should be blocked");
|
||||
win3.close();
|
||||
test4();
|
||||
}, 1000);
|
||||
}
|
||||
|
||||
function test4() {
|
||||
// navigating to a data: URI using window.open() should be blocked
|
||||
let win4 = window.open("data:text/html,<body>toplevel data: URI navigations should be blocked</body>");
|
||||
setTimeout(function () {
|
||||
// Please note that the data: URI will be displayed in the URL-Bar but not
|
||||
// loaded, hence we rather rely on document.body than document.location
|
||||
is(win4.document.body.innerHTML, "",
|
||||
"navigating to a data: URI using window.open() should be blocked");
|
||||
win4.close();
|
||||
SimpleTest.finish();
|
||||
}, 1000);
|
||||
}
|
||||
|
||||
// fire up the tests
|
||||
test1();
|
||||
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
Загрузка…
Ссылка в новой задаче