blob: 6d0efd779509ca737d1e8e4e3b36730c61a12a6b [file] [log] [blame]
<script>
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.waitUntilDone();
testRunner.setCanOpenWindows();
testRunner.setCloseRemainingWindowsWhenComplete(true);
}
</script>
<body>
This passes if it doesn't alert the contents of innocent-victim.
<script>
window.onload = function()
{
frame = document.body.appendChild(document.createElement("iframe"));
frame.src = "http://localhost:8080/security/resources/innocent-victim-with-iframe.html";
frame.onload = function() {
frame.onload = null;
frame.contentWindow[0].location = "data:text/html,<script>(" + function() {
try {
window.name = "valueOf";
obj = window.open();
obj.__proto__.__proto__ = parent;
alert(obj.valueOf.constructor("return document.body.innerHTML")());
} catch(ex) {
console.log("Threw exception: " + ex)
}
if (window.testRunner)
testRunner.notifyDone();
} + ")()</scr" + "ipt>";
}
}
</script>