File: sandboxing-back-parent.html

package info (click to toggle)
firefox-esr 128.14.0esr-1
  • links: PTS, VCS
  • area: main
  • in suites: forky, sid
  • size: 4,230,180 kB
  • sloc: cpp: 7,104,278; javascript: 6,088,450; ansic: 3,654,017; python: 1,212,326; xml: 594,604; asm: 420,652; java: 182,969; sh: 71,124; makefile: 20,747; perl: 13,449; objc: 12,399; yacc: 4,583; cs: 3,846; pascal: 2,973; lex: 1,720; ruby: 1,194; exp: 762; php: 436; lisp: 258; awk: 247; sql: 66; sed: 54; csh: 10
file content (38 lines) | stat: -rw-r--r-- 1,539 bytes parent folder | download | duplicates (18)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
<!doctype html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="return-value/resources/helpers.js"></script>
<iframe id="i" src="/common/blank.html?startI" sandbox="allow-scripts allow-same-origin"></iframe>

<script>
// Intended setup:
// Step 0:
// - Parent: (current URL)
// - i:     /common/blank.html?startI
// Step 1:
// - Parent: (current URL)
// - i:     resources/navigation-back.html
// Step 2:
// - Parent: (current URL)#end
// - i:     resources/navigation-back.html
//
// Then, calling navigation.back() in i will take is from step 2 to step 0, which would navigate the parent.
// That is not allowed, so the call to back() must reject.

promise_test(async t => {
  await new Promise(resolve => window.onload = resolve);

  i.contentWindow.location.href = new URL("resources/navigation-back.html", location.href);
  await new Promise(resolve => i.onload = resolve);

  location.hash = "#end";
  await new Promise(resolve => window.onhashchange = resolve);

  navigation.onnavigate = t.unreached_func("navigate must not fire");
  navigation.onnavigateerror = t.unreached_func("navigateerror must not fire");
  window.onpopstate = t.unreached_func("popstate must not fire");
  window.onhashchange = t.unreached_func("hashchange must not fire");

  await assertBothRejectDOM(t, i.contentWindow.doNavigationBack(), "SecurityError", i.contentWindow);
}, "A sandboxed iframe cannot navigate its parent via its own navigation object by using back()");
</script>