| <!DOCTYPE html> |
| <html> |
| <body> |
| <script src="/resources/js-test-pre.js"></script> |
| <div id="container"> |
| <style> |
| #container { position: relative; } |
| #container > div { position: relative; border: solid 1px black; width: 200px; height: 200px; } |
| </style> |
| <div id="source" contenteditable> |
| Drag this, <meta content="some secret"><!-- secret --> |
| <img onclick="dangerousCode()" src="resources/apple.gif"><br> |
| <iframe src="http://localhost:8000/security/clipboard/resources/content-to-copy.html" width=100 height=100></iframe> |
| </div> |
| <div id="destination" style="position: absolute; top: 0px; left: 220px; border-color: blue;" ondrop="doDrop(event)" contenteditable></div> |
| </div> |
| <p id="description"></p> |
| <div id="console"></div> |
| <script> |
| |
| description('This tests draggin and dropping HTML by the default action. WebKit should not sanitize the HTML in the same document.<br>' |
| + 'To manually test, drag & drop the content in the block above to the blue box on the right.'); |
| jsTestIsAsync = true; |
| |
| let loadCount = 0; |
| window.onmessage = (event) => { |
| if (!loadCount++) |
| runTest() |
| else |
| checkFrameAccess(); |
| } |
| |
| function runTest() { |
| document.getElementById('source').focus(); |
| document.execCommand('selectAll'); |
| if (window.testRunner) { |
| internals.settings.setCustomPasteboardDataEnabled(true); |
| const sourceRect = source.getBoundingClientRect(); |
| const destinationRect = destination.getBoundingClientRect(); |
| eventSender.mouseMoveTo(sourceRect.x + 10, sourceRect.y + 10); |
| eventSender.mouseDown(); |
| eventSender.leapForward(500); |
| eventSender.mouseMoveTo(destinationRect.x + 10, destinationRect.y + 10); |
| eventSender.mouseUp(); |
| } |
| } |
| |
| function doDrop(event) { |
| shouldBeTrue('html = event.dataTransfer.getData("text/html"); html.includes("Drag this,")'); |
| shouldBeTrue('destination.innerHTML = html; img = destination.querySelector("img"); !!img'); |
| shouldBeEqualToString('new URL(img.src).protocol', 'http:'); |
| shouldBeTrue('html.includes("http://localhost:8000/security/clipboard/resources/content-to-copy.html")'); |
| shouldBeFalse('html.includes("secret")'); |
| evalAndLog('destination.innerHTML = ""'); |
| |
| const observer = new MutationObserver((recordList) => { |
| for (const record of recordList) { |
| for (const node of record.addedNodes) { |
| if (node.nodeValue === null) |
| continue; |
| if (node.nodeValue.includes('secret')) |
| testFailed(`Saw secret in a node ${node}`); |
| if (node.nodeValue.includes('dangerousCode')) |
| testFailed(`Saw dangerous code in a node ${node}`); |
| } |
| } |
| }); |
| observer.observe(destination, {childList: true, subtree: true}); |
| } |
| |
| function checkFrameAccess() { |
| shouldBeEqualToString('source.innerHTML', ''); |
| shouldBeTrue('destination.textContent.includes("Drag this,")'); |
| shouldBeFalse('destination.innerHTML.includes("secret")'); |
| shouldBeFalse('destination.innerHTML.includes("dangerousCode")'); |
| shouldBeTrue('destination.querySelector("img"); !!img'); |
| shouldBeEqualToString('new URL(img.src).protocol', 'http:'); |
| shouldBeNull('destination.querySelector("iframe").contentDocument'); |
| |
| if (window.testRunner) |
| container.remove(); |
| finishJSTest(); |
| } |
| |
| var successfullyParsed = true; |
| |
| </script> |
| <script src="/resources/js-test-post.js"></script> |
| </body> |
| </html> |
