1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
// META: script=/common/get-host-info.sub.js
// META: script=/common/utils.js
// META: script=/common/dispatcher/dispatcher.js
// META: script=/fenced-frame/resources/utils.js
// META: script=/html/cross-origin-embedder-policy/credentialless/resources/common.js
// META: script=./resources/common.js
// META: timeout=long
setup(() => {
assert_implements(window.HTMLFencedFrameElement,
"HTMLFencedFrameElement is not supported.");
})
// 4 actors:
// A (this document)
// ┌─────────────────────┴───────┐
// ┌─┼────────────────────────┐ D (credentialless-iframe)
// │ B (fenced-frame) │
// │ │ │
// │ C (credentialless-iframe)│
// └──────────────────────────┘
//
// This test whether the two credentialless iframe can communicate and bypass the
// fencedframe boundary. This shouldn't happen.
promise_test(async test => {
const cross_origin = get_host_info().HTTPS_REMOTE_ORIGIN;
const msg_queue = token();
// Create the 3 actors.
const iframe_credentialless_1 = newIframeCredentialless(cross_origin);
const fenced_frame = await newFencedFrame(cross_origin);
send(fenced_frame, `
const importScript = ${importScript};
await importScript("/common/utils.js");
await importScript("/html/cross-origin-embedder-policy/credentialless" +
"/resources/common.js");
await importScript("/html/anonymous-iframe/resources/common.js");
const support_loading_mode_fenced_frame =
"|header(Supports-Loading-Mode,fenced-frame)";
const iframe_credentialless_2 = newIframeCredentialless("${cross_origin}",
support_loading_mode_fenced_frame);
send("${msg_queue}", iframe_credentialless_2);
`);
const iframe_credentialless_2 = await receive(msg_queue);
// Try to communicate using BroadCastChannel, in between the credentialless
// iframes.
const bc_key = token();
send(iframe_credentialless_1, `
const bc = new BroadcastChannel("${bc_key}");
bc.onmessage = event => send("${msg_queue}", event.data);
send("${msg_queue}", "BroadcastChannel registered");
`);
assert_equals(await receive(msg_queue), "BroadcastChannel registered");
await send(iframe_credentialless_2, `
const bc = new BroadcastChannel("${bc_key}");
bc.postMessage("Can communicate");
`);
test.step_timeout(() => {
send(msg_queue, "Cannot communicate");
}, 4000);
assert_equals(await receive(msg_queue), "Cannot communicate");
})
|
