1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
import random
import time
"""
This script serves
"""
def main(request, response):
inlineOrExternal = request.GET.first("inlineOrExternal", "null")
hasBlockingStylesheet = request.GET.first("hasBlockingStylesheet", "true") == "true"
result = request.GET.first("result", "success")
type = "text/javascript" if request.GET.first("type", "classic") == "classic" else "module"
response.headers.set("Content-Type", "text/html; charset=utf-8")
response.headers.set("Transfer-Encoding", "chunked")
response.write_status_headers()
# Step 1: Start parsing.
body = """<!DOCTYPE html>
<head>
<script>
parent.postMessage("fox", "*");
</script>
"""
if hasBlockingStylesheet:
body += """
<link rel="stylesheet" href="slow-flag-setter.py?result=css&cache=%f">
""" % random.random()
body += """
</head>
<body>
"""
if inlineOrExternal == "inline" or inlineOrExternal == "external":
body += """
<streaming-element>
"""
# Trigger DOM processing
body += "A" * 100000
response.writer.write("%x\r\n" % len(body))
response.writer.write(body)
response.writer.write("\r\n")
response.writer.flush()
body = ""
if inlineOrExternal == "inline":
time.sleep(1)
body += """
<script id="s1" type="%s"
onload="tScriptLoadEvent.unreached_func('onload')"
onerror="scriptOnError(event)">
if (!window.readyToEvaluate) {
window.didExecute = "executed too early";
} else {
window.didExecute = "executed";
}
""" % (type)
if result == "parse-error":
body += "1=2 parse error\n"
body += """
</script>
</streaming-element>
"""
elif inlineOrExternal == "external":
time.sleep(1)
body += """
<script id="s1" type="%s"
src="slow-flag-setter.py?result=%s&cache=%s"
onload="tScriptLoadEvent.unreached_func('onload')"
onerror="scriptOnError(event)"></script>
</streaming-element>
""" % (type, result, random.random())
# // if readyToEvaluate is false, the script is probably
# // wasn't blocked by stylesheets as expected.
# Trigger DOM processing
body += "B" * 100000
response.writer.write("%x\r\n" % len(body))
response.writer.write(body)
response.writer.write("\r\n")
response.writer.write("0\r\n")
response.writer.write("\r\n")
response.writer.flush()
|
