1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
<!doctype html>
<body>
<script src=/resources/testharness.js></script>
<script src=/resources/testharnessreport.js></script>
<script src=/common/utils.js></script>
<script src=/fenced-frame/resources/utils.js></script>
<script src=/shared-storage/resources/util.js></script>
<script>
'use strict';
const origin = window.location.origin;
const rawSetHeader = 'set;key=hello;value=world';
const setHeader = encodeURIComponent(rawSetHeader);
promise_test(async t => {
let frame = document.createElement('iframe');
const promise = new Promise((resolve, reject) => {
window.addEventListener('message', async function handler(evt) {
if (evt.source === frame.contentWindow &&
evt.data.sharedStorageFetchStatus) {
document.body.removeChild(frame);
window.removeEventListener('message', handler);
resolve(evt.data.sharedStorageFetchStatus);
}
});
window.addEventListener('error', (error) => {
reject(error);
});
});
const fetchUrl =
`${origin}\\/shared-storage\\/resources\\/shared-storage-write.py`
+ `?write=${setHeader}`;
const fetchCode = `
let parentOrOpener = window.opener || window.parent;
let innerFrame = document.createElement('iframe');
window.addEventListener('message', async (evt) => {
if (evt.source === innerFrame.contentWindow) {
parentOrOpener.postMessage({sharedStorageFetchStatus: "success"}, '*');
}
});
window.addEventListener('error', (error) => {
parentOrOpener.postMessage({sharedStorageFetchStatus: error.message}, '*');
});
fetch('${fetchUrl}', {sharedStorageWritable: true})
.then(response => response.text())
.then(htmlContent => {
innerFrame.srcdoc = htmlContent;
document.body.appendChild(innerFrame);
})
.catch(error => {
parentOrOpener.postMessage({sharedStorageFetchStatus: error.name},
"*");
});
`;
const dataURL = 'data:text/html;base64,'
+ btoa(unescape('%3Chtml%3E%3Cbody%3E%3Cscript%3E'
+ encodeURIComponent(fetchCode) +
'%3C%2Fscript%3E%3C%2Fbody%3E%3C%2Fhtml%3E'));
frame.src = dataURL;
document.body.appendChild(frame);
const result = await promise;
assert_equals(result, "TypeError");
await verifyKeyNotFoundForOrigin('hello', origin);
}, 'shared storage fetch request disallowed in opaque origin from data URL');
</script>
</body>
|
