mirror of
https://github.com/servo/servo.git
synced 2025-07-12 09:53:40 +01:00
47 lines
2.4 KiB
HTML
47 lines
2.4 KiB
HTML
<!doctype html>
|
|
<title>Tests that portals respect the frame-src</title>
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
<body>
|
|
</body>
|
|
<script>
|
|
async_test(function(t) {
|
|
var w = window.open("resources/frame-src.sub.html?frame_src_policy=%27none%27");
|
|
w.onload = function() {
|
|
w.document.addEventListener("securitypolicyviolation",
|
|
t.step_func_done(function(e) {
|
|
assert_equals("frame-src", e.violatedDirective);
|
|
}));
|
|
var portal = w.document.createElement("portal");
|
|
portal.src = new URL("/portals/resources/simple-portal.html", location.href);
|
|
portal.onmessage = t.unreached_func("Portal should not load.");
|
|
w.document.body.appendChild(portal);
|
|
}
|
|
}, "Tests that a portal can't be loaded when it violates frame-src");
|
|
|
|
async_test(function(t) {
|
|
var w = window.open(`resources/frame-src.sub.html?frame_src_policy=http://{{hosts[][www]}}:{{ports[http][0]}}`);
|
|
w.onload = function() {
|
|
w.document.onsecuritypolicyviolation = t.unreached_func("Portal should load.");
|
|
var portal = w.document.createElement("portal");
|
|
portal.src = new URL("http://{{hosts[][www]}}:{{ports[http][0]}}/portals/resources/simple-portal.html", location.href);
|
|
portal.onmessage = t.step_func_done();
|
|
w.document.body.appendChild(portal);
|
|
}
|
|
}, "Tests that a portal can be loaded when the origin matches the frame-src CSP header.");
|
|
async_test(function(t) {
|
|
|
|
var w = window.open(`resources/frame-src.sub.html?frame_src_policy=http://{{hosts[][www]}}:{{ports[http][0]}}`);
|
|
w.onload = function() {
|
|
var portal = w.document.createElement("portal");
|
|
portal.src = new URL("http://{{hosts[alt][www]}}:{{ports[http][0]}}/portals/resources/simple-portal.html", location.href);
|
|
w.document.onsecuritypolicyviolation = t.step_func(function(e) {
|
|
w.document.onsecuritypolicyviolation = null;
|
|
assert_equals("frame-src", e.violatedDirective);
|
|
portal.src = new URL("http://{{hosts[][www]}}:{{ports[http][0]}}/portals/resources/simple-portal.html", location.href);
|
|
portal.onmessage = t.step_func_done();
|
|
});
|
|
w.document.body.appendChild(portal);
|
|
}
|
|
}, "Tests that a portal will fail to load on an origin different than the one specified in the frame-src CSP, but that it can be loaded when the origin matches the frame-src CSP.");
|
|
</script>
|