Quelle test_iframe_sandbox_general.html Sprache: HTML

products/Sources/formale Sprachen/C/Firefox/dom/html/test/test_iframe_sandbox_general.html

<!DOCTYPE HTML>
<html>

<head>
  <meta charset="utf-8">
  <title>Tests for Bug 341604 and Bug 766282</title>
  <script src="/tests/SimpleTest/SimpleTest.js"></script>
  <script src="/tests/SimpleTest/EventUtils.js"></script>
  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
</head>
<script type="application/javascript">
/** Test for Bug 341604 - Implement HTML5 sandbox attribute for IFRAMEs - general tests **/

SimpleTest.expectAssertions(0, 1);
SimpleTest.waitForExplicitFinish();
SimpleTest.requestCompleteLog();

// a postMessage handler that is used by sandboxed iframes without
// 'allow-same-origin' to communicate pass/fail back to this main page.
// it expects to be called with an object like {ok: true/false, desc:
// <description of the test> which it then forwards to ok()
window.addEventListener("message", receiveMessage);

function receiveMessage(event)
{
  ok_wrapper(event.data.ok, event.data.desc);
}

var completedTests = 0;
var passedTests = 0;

function ok_wrapper(result, desc) {
  ok(result, desc);

  completedTests++;

  if (result) {
    passedTests++;
  }

  if (completedTests == 32) {
    is(passedTests, completedTests, "There are " + completedTests + " general tests that should pass");
    SimpleTest.finish();
  }
}

function doTest() {
  // passes twice if good
  // 1) test that inline scripts (<script>) can run in an iframe sandboxed with "allow-scripts"
  // (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts')

  // passes twice if good
  // 2) test that <script src=...> can run in an iframe sandboxed with "allow-scripts"
  // (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts')

  // passes twice if good
  // 3) test that script in an event listener (body onload) can run in an iframe sandboxed with "allow-scripts"
  // (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts')

  // passes twice if good
  // 4) test that script in an javascript:url can run in an iframe sandboxed with "allow-scripts"
  // (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts')

  // fails if bad
  // 5) test that inline scripts cannot run in an iframe sandboxed without "allow-scripts"
  // (done in file_iframe_sandbox_c_if2.html which has sandbox='')

  // fails if bad
  // 6) test that <script src=...> cannot run in an iframe sandboxed without "allow-scripts"
  // (done in file_iframe_sandbox_c_if2.html which has sandbox='')

  // fails if bad
  // 7) test that script in an event listener (body onload) cannot run in an iframe sandboxed without "allow-scripts"
  // (done in file_iframe_sandbox_c_if2.html which has sandbox='')

  // fails if bad
  // 8) test that script in an event listener (img onerror) cannot run in an iframe sandboxed without "allow-scripts"
  // (done in file_iframe_sandbox_c_if2.html which has sandbox='')

  // fails if bad
  // 9) test that script in an javascript:url cannot run in an iframe sandboxed without "allow-scripts"
  // (done in file_iframe_sandbox_c_if_5.html which has sandbox='allow-same-origin')
  var if_w = document.getElementById('if_5').contentWindow;
  sendMouseEvent({type:'click'}, 'a_link', if_w);

  // passes if good
  // 10) test that a new iframe has sandbox attribute
  var ifr = document.createElement("iframe");
  ok_wrapper("sandbox" in ifr, "a new iframe should have a sandbox attribute");

  // passes if good
  // 11) test that the sandbox attribute's default stringyfied value is an empty string
  ok_wrapper(ifr.sandbox.length === 0 && ifr.sandbox == "", "default sandbox attribute should be an empty string");

  // passes if good
  // 12) test that a sandboxed iframe with 'allow-forms' can submit forms
  // (done in file_iframe_sandbox_c_if3.html which has 'allow-forms' and 'allow-scripts')

  // fails if bad
  // 13) test that a sandboxed iframe without 'allow-forms' can NOT submit forms
  // (done in file_iframe_sandbox_c_if1.html which only has 'allow-scripts')

  // fails if bad
  // 14) test that a sandboxed iframe can't open a new window using the target.attribute
  // this is done via file_iframe_sandbox_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin"
  // the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok()
  // function that calls window.parent.ok_wrapper

  // passes if good
  // 15) test that a sandboxed iframe can't open a new window using window.open
  // this is done via file_iframe_sandbox_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin"
  // the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok()
  // function that calls window.parent.ok_wrapper

  // passes if good
  // 16) test that a sandboxed iframe can't open a new window using window.ShowModalDialog
  // this is done via file_iframe_sandbox_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin"
  // the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok()
  // function that calls window.parent.ok_wrapper

  // passes twice if good
  // 17) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute
  // is separated with two spaces
  // done via file_iframe_sandbox_c_if6.html which is sandboxed with " allow-scripts allow-same-origin "

  // passes twice if good
  // 18) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute
  // is separated with tabs
  // done via file_iframe_sandbox_c_if6.html which is sandboxed with " allow-scripts allow-same-origin "

  // passes twice if good
  // 19) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute
  // is separated with line feeds
  // done via file_iframe_sandbox_c_if6.html which is sandboxed with " allow-scripts allow-same-origin "

  // passes twice if good
  // 20) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute
  // is separated with form feeds
  // done via file_iframe_sandbox_c_if6.html which is sandboxed with "allow-scriptsallow-same-origin"

  // passes twice if good
  // 21) test that a sandboxed iframe can access same-origin documents and run scripts when its sandbox attribute
  // is separated with carriage returns
  // done via file_iframe_sandbox_c_if6.html which is sandboxed with " allow-scripts allow-same-origin "

  // fails if bad
  // 22) test that an iframe with sandbox="" does NOT have script in a src attribute created by a javascript:
  // URL executed
  // done by this page, see if_7

  // passes if good
  // 23) test that an iframe with sandbox="allow-scripts" DOES have script in a src attribute created by a javascript:
  // URL executed
  // done by this page, see if_8

  // fails if bad
  // 24) test that an iframe with sandbox="", starting out with a document already loaded, does NOT have script in a newly
  // set src attribute created by a javascript: URL executed
  // done by this page, see if_9

  // passes if good
  // 25) test that an iframe with sandbox="allow-scripts", starting out with a document already loaded, DOES have script
  // in a newly set src attribute created by a javascript: URL executed
  // done by this page, see if_10

  // passes if good or fails if bad
  // 26) test that an sandboxed document without 'allow-same-origin' can NOT access indexedDB
  // done via file_iframe_sandbox_c_if7.html, which has sandbox='allow-scripts'

  // passes if good or fails if bad
  // 27) test that an sandboxed document with 'allow-same-origin' can access indexedDB
  // done via file_iframe_sandbox_c_if8.html, which has sandbox='allow-scripts allow-same-origin'

  // fails if bad
  // 28) Test that a sandboxed iframe can't open a new window using the target.attribute for a
  // non-existing browsing context (BC341604).
  // This is done via file_iframe_sandbox_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin"
  // the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok()
  // function that calls window.parent.ok_wrapper.

  // passes twice if good
  // 29-32) Test that sandboxFlagsAsString returns the set flags.
  // see if_14 and if_15

  // passes once if good
  // 33) Test that sandboxFlagsAsString returns null if iframe does not have sandbox flag set.
  // see if_16
}

addLoadEvent(doTest);

var started_if_9 = false;
var started_if_10 = false;

function start_if_9() {
  if (started_if_9)
    return;

  started_if_9 = true;
  sendMouseEvent({type:'click'}, 'a_button');
}

function start_if_10() {
  if (started_if_10)
    return;

  started_if_10 = true;
  sendMouseEvent({type:'click'}, 'a_button2');
}

function do_if_9() {
  var if_9 = document.getElementById('if_9');
  if_9.src = 'javascript:"