| <?xml-stylesheet type="text/xsl" href="xss-DENIED-xsl-document-securityOrigin.xml"?> |
| <xsl:stylesheet version="2.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform"> |
| <xsl:template match="/"> |
| <html> |
| <head> |
| <script> |
| <![CDATA[ |
| if (window.testRunner) { |
| testRunner.dumpAsText(); |
| testRunner.waitUntilDone(); |
| } |
| |
| window.onload = function() |
| { |
| if (!opener) { |
| victim = document.body.appendChild(document.createElement("iframe")); |
| wnd = victim.contentWindow.open(); |
| victim.src = "http://localhost:8080/security/resources/innocent-victim.html"; |
| victim.onload = function() { wnd.eval("location = '" + location + "'"); } |
| } else if (!location.href.includes("parent-document-open.html")) { |
| url = location.href; |
| var parentDocOpen = document.createElement("iframe"); |
| parentDocOpen.src = "resources/parent-document-open.html"; |
| document.body.append(parentDocOpen); |
| setTimeout(() => { |
| location = "javascript:(\"\x3C?xml-stylesheet type='text/xsl' href='" + url + "'?\x3E\x3Croot/\x3E\")"; |
| }, 150); |
| } else { |
| try { |
| victim = opener; |
| open("javascript:void(0)", "_self"); |
| if (victim.eval) |
| victim.eval("alert(document.body.innerHTML)"); |
| } catch (e) { |
| console.log(e); |
| } |
| |
| if (window.testRunner) |
| testRunner.notifyDone(); |
| } |
| } |
| ]]> |
| </script> |
| </head> |
| <body> |
| This test passes if it doesn't alert the contents of innocent-victim.html. |
| </body> |
| </html> |
| </xsl:template> |
| </xsl:stylesheet> |
