-
Notifications
You must be signed in to change notification settings - Fork 6.7k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
test sandbox flags inheritance in popups
This adds test for the popup's initial empty document sandbox flags inheritance: the document should inherit the CSP sandbox flags from the opener document even if the allow-popups-to-escape-sandbox flag is set. Bug: 114805 Change-Id: I79db2571278be9d7b50008f49212d0d1f210c5d8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3571921 Auto-Submit: Pâris Meuleman <pmeuleman@chromium.org> Commit-Queue: Pâris Meuleman <pmeuleman@chromium.org> Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org> Cr-Commit-Position: refs/heads/main@{#1002595}
- Loading branch information
1 parent
7251bf9
commit a8a4102
Showing
3 changed files
with
149 additions
and
45 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
62 changes: 62 additions & 0 deletions
62
...edded-content/the-iframe-element/sandbox-inherit-to-blank-document-unsandboxed-frame.html
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| <html> | ||
| <head> | ||
| <script src="/resources/testharness.js"></script> | ||
| <script src="/resources/testharnessreport.js"></script> | ||
| </head> | ||
| <body> | ||
| <script> | ||
| // Sandbox flags are inherited from a document toward every frame it creates, | ||
| // which then is inherited to every new document created in this frame. | ||
| // | ||
| // Using the flag 'allow-popups-to-escape-sandbox' inhibits this inheritance | ||
| // mechanism when the new frame is a popup. | ||
| // | ||
| // Sandbox flags are not inherited from the initiator/creator when loading a | ||
| // local scheme document unlike CSP (tested in | ||
| // ./sandbox-inherit-to-blank-document-unsandboxed.html) | ||
| // | ||
| // This tests in particular the initial empty document and the first | ||
| // about:blank navigation and verifies that no sandbox is applied on the | ||
| // popups. | ||
| promise_test(async test => { | ||
| const msg = await new Promise(r => window.addEventListener("message", r)); | ||
| assert_false(msg.data.access_initial_navigation_to_about_blank_throws, | ||
| "Failed to access initial about:blank popup, it is probably sandboxed" | ||
| ); | ||
| assert_false(msg.data.access_first_navigation_to_about_blank_throws, | ||
| "Failed to access navigation to about:blank, it is probably sandboxed" | ||
| ); | ||
| }, "Popup do not inherit sandbox, because of " + | ||
| "'allow-popups-to-escape-sandbox'. The document isn't sandboxed.") | ||
|
|
||
| </script> | ||
| <iframe | ||
| sandbox="allow-scripts allow-popups allow-popups-to-escape-sandbox" | ||
| srcdoc=" | ||
| <script> | ||
| let access_initial_navigation_to_about_blank_throws = false; | ||
| let access_first_navigation_to_about_blank_throws = false; | ||
| const initial_about_blank_window = | ||
| window.open('common/blank.html?pipe=status(204)'); | ||
| try { | ||
| initial_about_blank_window.origin; | ||
| } catch(e) { | ||
| access_initial_navigation_to_about_blank_throws = true; | ||
| } | ||
| const renavigated_about_blank_window = window.open('about:blank'); | ||
| try { | ||
| renavigated_about_blank_window.origin; | ||
| } catch(e) { | ||
| access_first_navigation_to_about_blank_throws = true; | ||
| } | ||
| top.postMessage({ | ||
| 'access_initial_navigation_to_about_blank_throws': | ||
| access_initial_navigation_to_about_blank_throws, | ||
| 'access_first_navigation_to_about_blank_throws': | ||
| access_first_navigation_to_about_blank_throws | ||
| }, '*'); | ||
| </script>" | ||
| > | ||
| </iframe> | ||
| </body> | ||
| </html> |