servo/tests/wpt/web-platform-tests/FileAPI/url/blob-url-in-sandboxed-iframe.html

66 lines
2.4 KiB
HTML

<!doctype html>
<meta charset="utf-8">
<title>FileAPI Test: Creating Blob URL with Blob</title>
<link rel="author" title="Victor Costan" href="mailto:pwnall@chromium.org">
<link rel="help" href="https://w3c.github.io/FileAPI/#originOfBlobURL">
<link rel="help" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin">
<link rel="help" href="https://url.spec.whatwg.org/#url-parsing">
<link rel="help" href="https://fetch.spec.whatwg.org/#main-fetch">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<style>
iframe { width: 10px; height: 10px; }
</style>
<iframe id="unconstrained-iframe"></iframe>
<iframe id="sandboxed-iframe" sandbox="allow-scripts"></iframe>
<script id="iframe-srcdoc" language="text/html">
<!doctype html>
<script>
'use strict';
window.onload = () => {
const blob = new Blob(['Hello world!']);
const blobUrl = URL.createObjectURL(blob);
fetch(blobUrl).then(response => response.text()).then(text => {
window.parent.postMessage({ blobUrl, text }, '*');
});
};
// The script tag is closed in readBlobFromUrl().
</script>
<script>
// Carries out the test of minting a Blob URL in an iframe, and reading it back.
//
// Returns a promise resolved with an object with properties blobUrl and text
// (the text read back from the Blob URL).
function readBlobFromUrl(t, iframeSelector) {
return new Promise((resolve, reject) => {
window.onmessage = t.step_func((message) => { resolve(message.data); });
const frame = document.querySelector(iframeSelector);
const html = document.querySelector('#iframe-srcdoc').textContent +
'<' + '/script>';
frame.setAttribute('srcdoc', html);
});
}
promise_test(t => readBlobFromUrl(t, '#unconstrained-iframe').then(data => {
assert_true(data.blobUrl.startsWith('blob:'),
"The Blob's URL should use the blob: scheme");
assert_equals(data.text, 'Hello world!',
"The result of reading the Blob's URL should be the Blob's contents");
}), 'reading a Blob URL in an unconstrained iframe');
promise_test(t => readBlobFromUrl(t, '#sandboxed-iframe').then(data => {
assert_true(data.blobUrl.startsWith('blob:'),
"The Blob's URL should use the blob: scheme");
assert_equals(data.text, 'Hello world!',
"The result of reading the Blob's URL should be the Blob's contents");
}), 'reading a Blob URL in a sandboxed iframe without the same-origin flag');
</script>