|
| 1 | +<!doctype html> |
| 2 | +<title>Cross-origin due to document.domain</title> |
| 3 | +<meta charset=utf-8> |
| 4 | +<script src=/resources/testharness.js></script> |
| 5 | +<script src=/resources/testharnessreport.js></script> |
| 6 | +<div id=log></div> |
| 7 | +<iframe src=resources/cross-origin-due-to-document-domain-only-helper.html></iframe> |
| 8 | +<script> |
| 9 | +async_test(t => { |
| 10 | + onload = t.step_func_done(() => { |
| 11 | + const frame = document.querySelector("iframe"); |
| 12 | + const innerSelf = self[0]; |
| 13 | + const innerLocation = innerSelf.location; |
| 14 | + const innerDocument = innerSelf.document; |
| 15 | + assert_equals(innerLocation.host, location.host); |
| 16 | + assert_true(innerSelf.expandosForever); |
| 17 | + assert_true(innerLocation.expandosForever); |
| 18 | + assert_equals(frame.contentWindow, innerSelf); |
| 19 | + assert_equals(frame.contentDocument, innerDocument); |
| 20 | + innerSelf.setDocumentDomain(); |
| 21 | + assert_throws("SecurityError", () => innerSelf.expandosForever); |
| 22 | + assert_throws("SecurityError", () => innerLocation.expandosForever); |
| 23 | + assert_throws("SecurityError", () => innerLocation.host); |
| 24 | + assert_equals(innerSelf.parent, self); |
| 25 | + assert_throws("SecurityError", () => innerSelf.frameElement); |
| 26 | + assert_throws("SecurityError", () => innerLocation.reload()); |
| 27 | + assert_equals(frame.contentWindow, innerSelf); |
| 28 | + assert_equals(frame.contentDocument, null); |
| 29 | + // Cross-origin Document object obtained before it became cross-origin has no protections |
| 30 | + assert_equals(innerDocument.URL, frame.src); |
| 31 | + }); |
| 32 | +}); |
| 33 | +</script> |
0 commit comments