[CORS-RFC1918] Initial addressSpace Web Platform Tests.

These tests might not live very long, depending on the outcome of the related issue: #26166. In the meantime, they serve to document the existing spec intent, and hopefully undergird discussions around address space inheritance. Bug: chromium:1138905, chromium:1138906, chromium:1134601 Change-Id: I7d8d0e7cf8e70cfdf3bdc044e748ee384f3418dd Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2475875 Commit-Queue: Titouan Rigoudy <titouan@chromium.org> Reviewed-by: Mike West <mkwst@chromium.org> Cr-Commit-Position: refs/heads/master@{#818444}
web-platform-tests · Oct 19, 2020 · 6c6f4de · 6c6f4de
1 parent f728f07
commit 6c6f4de
Show file tree

Hide file tree

Showing 8 changed files with 163 additions and 0 deletions.
diff --git a/cors-rfc1918/address-space.https.window.js b/cors-rfc1918/address-space.https.window.js
@@ -0,0 +1,27 @@
+// META: script=resources/support.js
+//
+// Spec: https://wicg.github.io/cors-rfc1918/#integration-html
+//
+// This file covers only those tests that must execute in a secure context.
+// Other tests are defined in: address-space.window.js
+'use strict';
+
+setup(() => {
+  // No sense running tests if `document.addressSpace` is not implemented.
+  assert_implements(document.addressSpace);
+
+  // The tests below assume that the root document is loaded from the `local`
+  // address space. This might fail depending on how the tests are run/served.
+  // See https://github.com/web-platform-tests/wpt/issues/26166.
+  assert_implements_optional(document.addressSpace == "local");
+});
+
+promise_test(t => {
+  return append_child_frame(t, document, "resources/treat-as-public-address.https.html")
+      .then(child => {
+        return append_child_frame(t, child.contentDocument, "/common/blank.html");
+      })
+      .then(grandchild => {
+        assert_equals(grandchild.contentDocument.addressSpace, "local");
+      });
+}, "Public-local grandchild iframe's addressSpace is local");
diff --git a/cors-rfc1918/address-space.window.js b/cors-rfc1918/address-space.window.js
@@ -0,0 +1,98 @@
+// META: script=resources/support.js
+//
+// Spec: https://wicg.github.io/cors-rfc1918/#integration-html
+//
+// See also: address-space.https.window.js
+'use strict';
+
+const kMinimalDoc = [
+    "<!doctype html>",
+    "<meta charset=utf-8>",
+    "<title>Loaded</title>",
+].join("");
+
+setup(() => {
+  // No sense running tests if `document.addressSpace` is not implemented.
+  assert_implements(document.addressSpace);
+
+  // The tests below assume that the root document is loaded from the `local`
+  // address space. This might fail depending on how the tests are run/served.
+  // See https://github.com/web-platform-tests/wpt/issues/26166.
+  assert_implements_optional(document.addressSpace == "local");
+});
+
+promise_test(t => {
+  return append_child_frame_with(t, document, () => {
+        // Do nothing with the child frame's `src` attribute.
+      })
+      .then(child => {
+        assert_equals(child.contentDocument.addressSpace, "local");
+      });
+}, "About:blank iframe's addressSpace is inherited from the root.");
+
+promise_test(t => {
+  return append_child_frame_with(t, document, child => {
+        child.srcdoc = kMinimalDoc;
+      })
+      .then(child => {
+        assert_equals(child.contentDocument.title, "Loaded");
+        assert_equals(child.contentDocument.addressSpace, "local");
+      });
+}, "About:srcdoc iframe's addressSpace is inherited from the root.");
+
+promise_test(t => {
+  // Register an event listener that will resolve this promise when this window
+  // receives a message posted to it.
+  const event_received = new Promise(resolve => {
+    window.addEventListener("message", resolve);
+  });
+
+  const script = "window.parent.postMessage(document.addressSpace, '*');";
+  const url = "data:text/html,<script>" + script + "</script>";
+  return append_child_frame(t, document, url)
+      // Wait for the iframe to be loaded, then wait for an event.
+      .then(() => event_received)
+      .then(evt => {
+        assert_equals(evt.data, "local");
+      });
+}, "Data: iframe's addressSpace is inherited from the root.");
+
+promise_test(t => {
+  const blob = new Blob([kMinimalDoc], {type: "text/html"});
+  return append_child_frame(t, document, URL.createObjectURL(blob))
+      .then(child => {
+        assert_equals(child.contentDocument.title, "Loaded");
+        assert_equals(child.contentDocument.addressSpace, "local");
+      });
+}, "Blob: iframe's addressSpace is inherited from the root.");
+
+promise_test(t => {
+  return append_child_frame(t, document, "resources/title.html")
+      .then(child => {
+        assert_equals(child.contentDocument.title, "Loaded");
+        assert_equals(child.contentDocument.addressSpace, "local");
+      });
+}, "Local iframe's addressSpace is local.");
+
+promise_test(t => {
+  return append_child_frame(t, document, "resources/treat-as-public-address.html")
+      .then(child => {
+        assert_equals(child.contentDocument.title, "Loaded");
+        assert_equals(child.contentDocument.addressSpace, "public");
+      });
+}, "Treat-as-public-address iframe's addressSpace is public.");
+
+promise_test(t => {
+  return append_child_frame(t, document, "resources/title.html")
+      .then(child => {
+        const doc = child.contentDocument;
+        assert_equals(doc.title, "Loaded", "child");
+        assert_equals(doc.addressSpace, "local", "child");
+        return append_child_frame(t, doc, "resources/treat-as-public-address.html");
+      })
+      .then(grandchild => {
+        const doc = grandchild.contentDocument;
+        assert_equals(doc.title, "Loaded", "grandchild");
+        assert_equals(doc.addressSpace, "local", "grandchild");
+      });
+}, "Local-local grandchild iframe's addressSpace is local.");
diff --git a/cors-rfc1918/resources/support.js b/cors-rfc1918/resources/support.js
@@ -0,0 +1,27 @@
+'use strict';
+
+// Creates a new iframe in |doc|, calls |func| on it and appends it as a child
+// of |doc|.
+// Returns a promise that resolves to the iframe once loaded (successfully or
+// not).
+// The iframe is removed from |doc| once test |t| is done running.
+//
+// NOTE: Because iframe elements always invoke the onload event handler, even
+// in case of error, we cannot wire onerror to a promise rejection. The Promise
+// constructor requires users to resolve XOR reject the promise.
+function append_child_frame_with(t, doc, func) {
+  return new Promise(resolve => {
+      const child = doc.createElement("iframe");
+      func(child);
+      child.onload = () => { resolve(child); };
+      doc.body.appendChild(child);
+      t.add_cleanup(() => { doc.body.removeChild(child); });
+    });
+}
+
+// Appends a child iframe to |doc| sourced from |src|.
+//
+// See append_child_frame_with() for more details.
+function append_child_frame(t, doc, src) {
+  return append_child_frame_with(t, doc, child => { child.src = src; });
+}
diff --git a/cors-rfc1918/resources/title.html b/cors-rfc1918/resources/title.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Loaded</title>
diff --git a/cors-rfc1918/resources/treat-as-public-address.html b/cors-rfc1918/resources/treat-as-public-address.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Loaded</title>
diff --git a/cors-rfc1918/resources/treat-as-public-address.html.headers b/cors-rfc1918/resources/treat-as-public-address.html.headers
@@ -0,0 +1 @@
+Content-Security-Policy: treat-as-public-address;
diff --git a/cors-rfc1918/resources/treat-as-public-address.https.html b/cors-rfc1918/resources/treat-as-public-address.https.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Loaded</title>
diff --git a/cors-rfc1918/resources/treat-as-public-address.https.html.headers b/cors-rfc1918/resources/treat-as-public-address.https.html.headers
@@ -0,0 +1 @@
+Content-Security-Policy: treat-as-public-address;