| <!DOCTYPE html> |
| <html> |
| <body> |
| <script src="../../resources/js-test.js"></script> |
| <div id="editor" contenteditable></div> |
| <script> |
| |
| description('This tests inserting content with an event handler. WebKit should never execute event handlers.'); |
| |
| if (window.testRunner) |
| testRunner.waitUntilDone(); |
| |
| editor.focus(); |
| |
| function insertHTML(markup) { |
| editor.textContent = ''; |
| editor.focus(); |
| document.execCommand('insertHTML', false, markup); |
| } |
| |
| let didExecute = false; |
| debug(''); |
| debug('Inserting with load event handler'); |
| editor.addEventListener('beforeinput', () => { |
| shouldBeTrue(`event.dataTransfer.getData('text/html').includes('onload="')`); |
| shouldBeTrue(`event.dataTransfer.getData('text/html').includes('onmouseover="')`); |
| }, {once: true}); |
| insertHTML('<iframe onload="didExecute = true" onmouseover="alert(\'FAIL\')"></iframe>'); |
| shouldBeFalse('didExecute'); |
| |
| didExecute = false; |
| debug(''); |
| debug('Inserting with script element'); |
| editor.addEventListener('beforeinput', () => { |
| shouldBeTrue(`event.dataTransfer.getData('text/html').includes('script')`); |
| }, {once: true}); |
| insertHTML(`<iframe src="data:text/html,<!DOCTYPE html><b>hi</b><script>alert("FAIL")</scr` + 'ipt>"></iframe>'); |
| shouldBeFalse('didExecute'); |
| |
| didExecute = false; |
| debug(''); |
| debug('Inserting iframe with a name into plaintext-only'); |
| editor.setAttribute('contenteditable', 'plaintext-only'); |
| |
| let i = 0; |
| function insertObjectElement() { |
| const object = document.createElement('object'); |
| object.data = 'about:blank'; |
| object.onload = () => { |
| try { |
| if (window.open('about:blank', 'named-frame').frameElement.parentNode) |
| didExecute = true; |
| } catch (e) { } |
| if (!didExecute && i++ < 10) |
| insertObjectElement(); |
| } |
| document.body.appendChild(object); |
| } |
| insertObjectElement(); |
| editor.focus(); |
| editor.addEventListener('beforeinput', () => { |
| shouldBeTrue(`event.dataTransfer.getData("text/html").includes("iframe name=")`); |
| }, {once: true}); |
| insertHTML(`<iframe name='named-frame'></iframe>`); |
| shouldBeFalse('didExecute'); |
| didExecute = true; |
| |
| setTimeout(() => { |
| if (window.testRunner) |
| testRunner.notifyDone(); |
| }, 0); |
| |
| </script> |
| </body> |
| </html> |
