| CONSOLE MESSAGE: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/innocent-victim.html from frame with URL http://127.0.0.1:8000/security/aboutBlank/xss-DENIED-set-opener.html. Domains, protocols and ports must match. |
| |
| CONSOLE MESSAGE: Unsafe JavaScript attempt to access frame with URL http://localhost:8000/security/resources/innocent-victim.html from frame with URL about:blank. Domains, protocols and ports must match. |
| |
| CONSOLE MESSAGE: TypeError: 'undefined' is not an object |
| This page opens a window to "", injects malicious code, and then uses window.open.call to set its opener to the victim. The opened window then tries to scripts its opener. |
| Code injected into window: |
| <script>function write(target, message) { target.document.body.innerHTML = message; } |
| setTimeout(function() {write(window.opener.top.frames[0], 'FAIL: XSS was allowed.');}, 100); |
| setTimeout(function() {write(window.opener.top.frames[1], 'SUCCESS: Window remained in original SecurityOrigin.');}, 200); |
| setTimeout(function() { if (window.layoutTestController) layoutTestController.globalFlag = true; }, 300);</script> |
| |
| |
| -------- |
| Frame: '<!--framePath //<!--frame0-->-->' |
| -------- |
| This page doesn't do anything special. |
| |
| -------- |
| Frame: '<!--framePath //<!--frame1-->-->' |
| -------- |
| SUCCESS: Window remained in original SecurityOrigin. |
