chromium/src/third_party/blink/web_tests/http/tests/security/dataURL/resources/foreign-domain-data-url-accessee-opened-frame.html - manifest_repos/chromium_src - Git at Google

 <html>
 <body>
     <p>Frame on a foreign domain (opened using window.open).</p>
     <iframe id="aFrame"></iframe>
     <script>
         var url = "data:text/html,<html>"
             + "<body>"
             +     "<p id='accessMe'>PASS: Access from the main frame was denied!</p>"
             +     "<p>Inner-inner iframe. This iframe (which is data: URL and whose parent is on a foreign domain) is the frame that the"
             +     " main frame is trying to access.  It should not have access to it.</p>"
             + "</body>"
             + "</html>";

         var frame = document.getElementById('aFrame');
         frame.onload = function () { window.opener.postMessage('run test', '*'); };
         frame.src = url;
     </script>
 </body>
 </html>
	<html>
	<body>
	<p>Frame on a foreign domain (opened using window.open).</p>
	<iframe id="aFrame"></iframe>
	<script>
	var url = "data:text/html,<html>"
	+ "<body>"
	+ "<p id='accessMe'>PASS: Access from the main frame was denied!</p>"
	+ "<p>Inner-inner iframe. This iframe (which is data: URL and whose parent is on a foreign domain) is the frame that the"
	+ " main frame is trying to access. It should not have access to it.</p>"
	+ "</body>"
	+ "</html>";

	var frame = document.getElementById('aFrame');
	frame.onload = function () { window.opener.postMessage('run test', '*'); };
	frame.src = url;
	</script>
	</body>
	</html>