| <!DOCTYPE html> |
| <script src="/resources/testharness.js"></script> |
| <script src="/resources/testharnessreport.js"></script> |
| <meta http-equiv="Content-Security-Policy" content="frame-src 'none'"> |
| |
| <script> |
| const iframe_url = new URL("./support/empty.html", location.href); |
| |
| // Regression test for: https://crbug.com/1064676 |
| promise_test(async (t) => { |
| await new Promise(r => window.onload = r); |
| |
| let url = `javascript: |
| |
| window.addEventListener('securitypolicyviolation', e => { |
| parent.postMessage({ |
| originalPolicy: e.originalPolicy, |
| blockedURI: e.blockedURI, |
| }); |
| }); |
| |
| let iframe = document.createElement('iframe'); |
| iframe.src = '${iframe_url}'; |
| document.body.appendChild(iframe); |
| |
| `; |
| |
| let iframe = document.createElement('iframe'); |
| iframe.src = encodeURI(url.replace(/\n/g, "")); |
| |
| let violation = new Promise(r => window.addEventListener("message", r)); |
| document.body.appendChild(iframe); |
| let {data} = await violation; |
| |
| assert_equals(data.originalPolicy, "frame-src 'none'"); |
| assert_equals(data.blockedURI, iframe_url.toString()); |
| |
| }, "<iframe src='javascript:...'>'s inherits policy (dynamically inserted <iframe> is blocked)"); |
| |
| </script> |