testing/web-platform/tests/html/browsers/sandboxing/sandbox-window-open-srcdoc.html

   1 <!DOCTYPE html>
   2 <meta charset=utf-8>
   3 <title>window.open("about:srcdoc") from a sandboxed iframe</title>
   4 <script src="/resources/testharness.js"></script>
   5 <script src="/resources/testharnessreport.js"></script>
   6 <body>
   7 <script>
   8 // Check what happens when executing window.open("about:srcdoc") from a
   9 // sandboxed iframe. Srcdoc can't be loaded in the main frame. It should
  10 // result in an error page. The error page should be cross-origin with the
  11 // opener.
  12 //
  13 // This test covers an interesting edge case. A main frame should inherit
  14 // sandbox flags. However the document loaded is an internal error page. This
  15 // might trigger some assertions, especially if the implementation wrongly
  16 // applies the sandbox flags of the opener to the internal error page document.
  17 //
  18 // This test is mainly a coverage test. It passes if it doesn't crash.
  19 async_test(test => {
  20   let iframe = document.createElement("iframe");
  21   iframe.sandbox = "allow-scripts allow-popups allow-same-origin";
  22   iframe.srcdoc = `
  23     <script>
  24       let w = window.open();
  25       onunload = () => w.close();
  26
  27       let notify = () => {
  28         try {
  29           w.origin; // Will fail after navigating to about:srcdoc.
  30           parent.postMessage("pending", "*");
  31         } catch (e) {
  32           parent.postMessage("done", "*");
  33         };
  34       };
  35
  36       addEventListener("message", notify);
  37       notify();
  38
  39       w.location = "about:srcdoc"; // Error page.
  40     </scr`+`ipt>
  41   `;
  42
  43   let closed = false;
  44   addEventListener("message", event => {
  45     closed = (event.data === "done");
  46     iframe.contentWindow.postMessage("ping","*");
  47   });
  48
  49   document.body.appendChild(iframe);
  50   test.step_wait_func_done(()=>closed);
  51 }, "window.open('about:srcdoc') from sandboxed srcdoc doesn't crash.");
  52 </script>