wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-20 07:17:32 +09:00
Code Issues Projects Releases Packages Wiki Activity

moebius#223: Consider blocking top level window data: URIs (part 1/3 without tests)

Browse source 
https://github.com/MoonchildProductions/moebius/pull/223
This commit is contained in:
janekptacijarabaci 2018-04-22 18:51:38 +02:00 • committed by Roy Tam
commit 712d19e1b7
22 changed files with 515 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

29
dom/security/test/general/file_block_toplevel_data_navigation2.html Normal file
View file

@ -0,0 +1,29 @@
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>Toplevel data navigation</title>
</head>
<body>
test2: data: URI in iframe tries to window.open(data:, _blank);<br/>
<iframe id="testFrame" src=""></iframe>
<script>
let DATA_URI = `data:text/html,<body><script>
var win = window.open("data:text/html,<body>toplevel data: URI navigations should be blocked</body>", "_blank");
setTimeout(function () {
var result = win.document.body.innerHTML === "" ? "blocked" : "navigated";
parent.postMessage(result, "*");
win.close();
}, 1000);
<\/script></body>`;
window.addEventListener("message", receiveMessage);
function receiveMessage(event) {
window.removeEventListener("message", receiveMessage);
// propagate the information back to the caller
window.opener.postMessage(event.data, "*");
}
document.getElementById('testFrame').src = DATA_URI;
</script>
</body>
</html>