blob: 7e204ced823882a11f75350aebe818810c64fa2e [file] [log] [blame]
<!DOCTYPE html>
<html>
<body>
<script src="../../resources/js-test.js"></script>
<div id="editor" contenteditable></div>
<script>
description('This tests inserting content with an event handler. WebKit should never execute event handlers.');
editor.focus();
function insertHTML(markup) {
editor.textContent = '';
editor.focus();
document.execCommand('insertHTML', false, markup);
}
let didExecute = false;
debug('');
debug('Inserting with load event handler');
editor.addEventListener('beforeinput', () => {
shouldBeTrue(`event.dataTransfer.getData('text/html').includes('onload="')`);
shouldBeTrue(`event.dataTransfer.getData('text/html').includes('onmouseover="')`);
}, {once: true});
insertHTML('<iframe onload="didExecute = true" onmouseover="alert(\'FAIL\')"></iframe>');
shouldBeFalse('didExecute');
didExecute = false;
debug('');
debug('Inserting with script element');
editor.addEventListener('beforeinput', () => {
shouldBeTrue(`event.dataTransfer.getData('text/html').includes('script')`);
}, {once: true});
insertHTML(`<iframe src="data:text/html,<!DOCTYPE html><b>hi</b><script>alert("FAIL")</scr` + 'ipt>"></iframe>');
shouldBeFalse('didExecute');
didExecute = false;
debug('');
debug('Inserting iframe with a name into plaintext-only');
editor.setAttribute('contenteditable', 'plaintext-only');
let i = 0;
function insertObjectElement() {
const object = document.createElement('object');
object.data = 'about:blank';
object.onload = () => {
try {
if (window.open('about:blank', 'named-frame').frameElement.parentNode)
didExecute = true;
} catch (e) { }
if (!didExecute && i++ < 10)
insertObjectElement();
}
document.body.appendChild(object);
}
insertObjectElement();
editor.focus();
editor.addEventListener('beforeinput', () => {
shouldBeTrue(`event.dataTransfer.getData("text/html").includes("iframe name=")`);
}, {once: true});
insertHTML(`<iframe name='named-frame'></iframe>`);
shouldBeFalse('didExecute');
didExecute = true;
</script>
</body>
</html>