blob: 63445b421341779cb9d4e9c2052ec26d81cfe861 [file] [log] [blame]
<!DOCTYPE html>
<html>
<head>
<script src="/js-test-resources/js-test.js"></script>
<script>
if (window.internals && internals.settings)
internals.settings.setShouldRestrictBaseURLSchemes(false);
var object;
function objectLoad() {
object = document.getElementById('object');
object.onbeforeload = () => {
object.onbeforeload = null;
let base = document.head.appendChild(document.createElement('base'));
base.href = 'javascript:///%0aalert("FAIL");//';
finishJSTest();
};
object.data = 'xxxxx';
};
</script>
</head>
<body>
<script>
description("Check that forcing a navigation during an object element load is well-behaved.")
window.jsTestIsAsync = true;
</script>
<object id='object' type='text/html' data='http://127.0.0.1:8000/plugins/resources/cross-frame-object-access.html' onload='objectLoad()'>
</object>
</body>
</html>