| <html> |
| <script> |
| |
| function didReadFile() |
| { |
| document.getElementById('result').innerHTML = 'FAILURE: ' + req.responseText; |
| if (window.testRunner) |
| testRunner.notifyDone(); |
| } |
| |
| function log(message) |
| { |
| var logElement = document.getElementById('log'); |
| logElement.appendChild(document.createTextNode(message)); |
| logElement.appendChild(document.createElement("p")); |
| } |
| |
| function onReqreadystatechange() |
| { |
| log('readyState change ' + req.readyState); |
| } |
| |
| function onReqAbort() |
| { |
| log('Abort event.'); |
| } |
| |
| function onSyncReqError() |
| { |
| log('Error event.'); |
| } |
| |
| function onReqError(e) |
| { |
| document.getElementById('result').innerHTML = 'SUCCESS: Error handler was called with readyState ' + req.readyState; |
| if (window.testRunner) |
| testRunner.notifyDone(); |
| } |
| |
| function runTest() { |
| if (window.testRunner) { |
| testRunner.dumpAsText(); |
| testRunner.waitUntilDone(); |
| } |
| |
| // First, make a sync request. |
| log ('Sync XHR started.'); |
| req = new XMLHttpRequest(); |
| req.onreadystatechange = onReqreadystatechange; |
| req.onerror = onSyncReqError; |
| req.onabort = onReqAbort; |
| req.open('GET', '/resources/redirect.py?url=http://localhost:8080/xmlhttprequest/resources/forbidden.txt', false); |
| try { |
| req.send(null); |
| } catch (e) { |
| log('Exception: ' + (e.description ? e.description : e)); |
| } |
| |
| if (req.responseText != '') { |
| didReadFile(); |
| return; |
| } |
| |
| log ('Async XHR started.'); |
| req = new XMLHttpRequest(); |
| req.onreadystatechange = onReqreadystatechange; |
| req.onload = didReadFile; |
| req.onerror = onReqError; |
| req.onabort = onReqAbort; |
| req.open('GET', '/resources/redirect.py?url=http://localhost:8080/xmlhttprequest/resources/forbidden.txt'); |
| req.send(null); |
| } |
| </script> |
| <body onload="runTest()"> |
| <div>This tests that unsafe redirects won't be allowed when making an XMLHttpRequest.</div> |
| <div id="log"></div> |
| <div id="result">FAILURE</div> |
| </body> |
| </html> |
