wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-20 23:37:33 +09:00
Code Issues Projects Releases Packages Wiki Activity

moebius#223: Consider blocking top level window data: URIs (part 1/3 without tests)

Browse source 
https://github.com/MoonchildProductions/moebius/pull/223
This commit is contained in:
janekptacijarabaci 2018-04-22 18:51:38 +02:00 • committed by Roy Tam
commit 712d19e1b7
22 changed files with 515 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

90
dom/security/test/general/test_block_toplevel_data_navigation.html Normal file
View file

@ -0,0 +1,90 @@
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>Bug 1331351 - Block top level window data: URI navigations</title>
<!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<script class="testbody" type="text/javascript">
SpecialPowers.setBoolPref("security.data_uri.block_toplevel_data_uri_navigations", true);
SimpleTest.registerCleanupFunction(() => {
SpecialPowers.clearUserPref("security.data_uri.block_toplevel_data_uri_navigations");
});
SimpleTest.waitForExplicitFinish();
SimpleTest.requestFlakyTimeout("have to test that top level data: URI navgiation is blocked");
function test1() {
// simple data: URI click navigation should be prevented
let TEST_FILE = "file_block_toplevel_data_navigation.html";
let win1 = window.open(TEST_FILE);
var readyStateCheckInterval = setInterval(function() {
let state = win1.document.readyState;
if (state === "interactive" || state === "complete") {
clearInterval(readyStateCheckInterval);
ok(win1.document.body.innerHTML.indexOf("test1:") !== -1,
"toplevel data: URI navigation through click() should be blocked");
win1.close();
test2();
}
}, 200);
}
function test2() {
// data: URI in iframe which opens data: URI in _blank should be blocked
let win2 = window.open("file_block_toplevel_data_navigation2.html");
window.addEventListener("message", receiveMessage);
function receiveMessage(event) {
window.removeEventListener("message", receiveMessage);
is(event.data, "blocked",
"data: URI navigation using _blank from data: URI should be blocked");
win2.close();
test3();
}
}
function test3() {
// navigating to a data: URI using window.location.href should be blocked
let win3 = window.open("file_block_toplevel_data_navigation3.html");
setTimeout(function () {
ok(win3.document.body.innerHTML.indexOf("test3:") !== -1,
"data: URI navigation through win.loc.href should be blocked");
win3.close();
test4();
}, 1000);
}
function test4() {
// navigating to a data: URI using window.open() should be blocked
let win4 = window.open("data:text/html,<body>toplevel data: URI navigations should be blocked</body>");
setTimeout(function () {
// Please note that the data: URI will be displayed in the URL-Bar but not
// loaded, hence we rather rely on document.body than document.location
is(win4.document.body.innerHTML, "",
"navigating to a data: URI using window.open() should be blocked");
test5();
}, 1000);
}
function test5() {
// navigating to a URI which redirects to a data: URI using window.open() should be blocked
let win5 = window.open("file_block_toplevel_data_redirect.sjs");
setTimeout(function () {
// Please note that the data: URI will be displayed in the URL-Bar but not
// loaded, hence we rather rely on document.body than document.location
is(SpecialPowers.wrap(win5).document.body.innerHTML, "",
"navigating to URI which redirects to a data: URI using window.open() should be blocked");
win5.close();
SimpleTest.finish();
}, 1000);
}
// fire up the tests
test1();
</script>
</body>
</html>