-
Notifications
You must be signed in to change notification settings - Fork 54
/
document-write-iframe.html
69 lines (62 loc) · 2.82 KB
/
document-write-iframe.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
<!DOCTYPE html>
<head>
<meta http-equiv="Content-Security-Policy" content="img-src 'none'">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
</head>
<body>
<script>
var t0 = async_test("Image loaded in srcdoc iframe using document.write is blocked");
var t1 = async_test("Image loaded in normal iframe using document.write is blocked");
var t2 = async_test("Image loaded directly in simple srcdoc iframe is blocked");
window.onmessage = function(e) {
var current_test;
if (e.data.type == "spv0") {
current_test = t0;
} else if (e.data.type == "spv1") {
current_test = t1;
} else if (e.data.type == "spv2") {
current_test = t2;
} else {
t0.step(function() {assert_true(false, "Unexpected message received from child frames")});
t1.step(function() {assert_true(false, "Unexpected message received from child frames")});
t2.step(function() {assert_true(false, "Unexpected message received from child frames")});
}
current_test.step(function() {
assert_equals(e.data.violatedDirective, 'img-src');
current_test.done();
});
}
</script>
<!--As discovered thanks to crbug.com/920531, there is a bug in CSP where the
CSP is not inherited when using document.open/document.write to edit a
document's contents. -->
<iframe id="frame1" srcdoc=""></iframe>
<!-- This is speculatively correct https://github.com/whatwg/html/issues/4510 -->
<iframe id="frame2" src="/content-security-policy/common/blank.html"></iframe>
<!--<script>
window.addEventListener('securitypolicyviolation', function(e) {
window.top.postMessage({type: 'spv2', violatedDirective: e.violatedDirective}, '*');
});
</script>
<img src='/content-security-policy/support/fail.png'>
-->
<iframe srcdoc="<script>window.addEventListener('securitypolicyviolation', function(e) {window.top.postMessage({type: 'spv2', violatedDirective: e.violatedDirective}, '*');});</script><img src='/content-security-policy/support/fail.png'>"></iframe>
<script>
var frames = ['frame1', 'frame2'];
for (var i = 0; i < frames.length; i++) {
var body_text = ['<script>',
' window.addEventListener("securitypolicyviolation", function(e) {',
' window.top.postMessage({type: "spv'+ i + '", violatedDirective: e.violatedDirective}, "*");',
' });',
'</scr' + 'ipt>',
'<img src="/content-security-policy/support/fail.png">'].join('\n');
var e = document.getElementById(frames[i]);
var n = e.contentWindow.document;
n.open();
n.write("<html><body>" + body_text + "</body></html>");
n.close();
}
</script>
</body>
</html>