| <!DOCTYPE html> |
| <html> |
| <body> |
| <script src="../../../resources/js-test-pre.js"></script> |
| <iframe src="http://localhost:8000/security/resources/iframe-with-element.html"></iframe> |
| <script> |
| description("Test security checking for access to Location."); |
| jsTestIsAsync = true; |
| |
| onload = function() { |
| shouldThrowErrorName("frames[0].location.protocol", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.host", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.hostname", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.port", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.pathname", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.search", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.hash", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.origin", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.ancestorOrigins", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.toString()", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.reload()", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.assign('about:blank')", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.href", "SecurityError"); |
| |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'protocol').get.call(frames[0].location)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'host').get.call(frames[0].location)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'hostname').get.call(frames[0].location)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'port').get.call(frames[0].location)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'pathname').get.call(frames[0].location)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'search').get.call(frames[0].location)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'hash').get.call(frames[0].location)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'origin').get.call(frames[0].location)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'ancestorOrigins').get.call(frames[0].location)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'toString').value.call(frames[0].location)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'href').get.call(frames[0].location)", "SecurityError"); |
| |
| shouldThrowErrorName("frames[0].location.protocol = 1", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.host = 1", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.hostname = 1", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.port = 1", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.pathname = 1", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.search = 1", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.hash = 1", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.origin = 1", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.ancestorOrigins = 1", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.toString = 1", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.reload = 1", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.replace = 1", "SecurityError"); |
| shouldThrowErrorName("frames[0].location.assign = 1", "SecurityError"); |
| |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'protocol').set.call(frames[0].location, 1)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'host').set.call(frames[0].location, 1)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'hostname').set.call(frames[0].location, 1)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'port').set.call(frames[0].location, 1)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'pathname').set.call(frames[0].location, 1)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'search').set.call(frames[0].location, 1)", "SecurityError"); |
| shouldThrowErrorName("Object.getOwnPropertyDescriptor(window.location, 'hash').set.call(frames[0].location, 1)", "SecurityError"); |
| |
| shouldThrowErrorName("Object.defineProperty(frames[0].location, 'foo', { value: 1 })", "SecurityError"); |
| |
| // Setting 'href' cross origin should be allowed. |
| shouldNotThrow("frames[0].location.href = 'about:blank'"); |
| handle = setInterval(function() { |
| try { |
| frames[0].location.href; // Should throw if still cross-origin. |
| |
| shouldBeEqualToString("frames[0].location.href", "about:blank"); |
| clearInterval(handle); |
| finishJSTest(); |
| } catch (e) { } |
| }, 5); |
| }; |
| </script> |
| <script src="../../../resources/js-test-post.js"></script> |
| </body> |
| </html> |
