| <!DOCTYPE html> |
| <meta charset="utf-8"> |
| <title>Meta refresh is blocked by the allow-scripts sandbox flag at its creation time, not when refresh comes due</title> |
| <script src="/resources/testharness.js"></script> |
| <script src="/resources/testharnessreport.js"></script> |
| <link rel="help" href="https://html.spec.whatwg.org/multipage/semantics.html#attr-meta-http-equiv-refresh"> |
| |
| <div id="log"></div> |
| |
| <script> |
| "use strict"; |
| setup({ single_test: true }); |
| |
| const sourceIFrame = document.createElement("iframe"); |
| sourceIFrame.setAttribute("sandbox", "allow-same-origin"); |
| |
| const destIFrame = document.createElement("iframe"); |
| |
| let sourceLoadCount = 0; |
| let destLoadCount = 0; |
| |
| sourceIFrame.onload = () => { |
| ++sourceLoadCount; |
| |
| if (sourceLoadCount === 2) { |
| assert_unreached("The iframe from which the meta came from must not refresh"); |
| } |
| |
| maybeStartTest(); |
| }; |
| |
| destIFrame.onload = () => { |
| ++destLoadCount; |
| |
| if (destLoadCount === 2) { |
| // destIFrame doesn't have the sandboxed automatic features browsing context |
| // flag sets, thus navigated. |
| assert_equals(destIFrame.contentDocument.body.textContent.trim(), "foo"); |
| done(); |
| } |
| |
| maybeStartTest(); |
| }; |
| |
| function maybeStartTest() { |
| if (sourceLoadCount === 1 && destLoadCount === 1) { |
| const meta = sourceIFrame.contentDocument.querySelector("meta"); |
| destIFrame.contentDocument.body.appendChild(meta); |
| } |
| } |
| |
| sourceIFrame.src = "support/refresh.sub.html?input=" + encodeURIComponent("1; url=foo"); |
| destIFrame.src = "support/ufoo"; |
| |
| document.body.appendChild(sourceIFrame); |
| document.body.appendChild(destIFrame); |
| </script> |
