blob: 27f5f751321cf2403bbfff928b3687b9df9b1a60 [file] [log] [blame]
<html>
<head>
<script src="resources/cross-frame-access.js"></script>
<script>
var windowConstructorPropertiesNotAllowed = [
"Attr",
"Audio",
"CDATASection",
"CSSPrimitiveValue",
"CSSRule",
"CSSStyleDeclaration",
"CSSValue",
"CharacterData",
"Comment",
"DOMException",
"DOMImplementation",
"DOMParser",
"Document",
"DocumentFragment",
"DocumentType",
"Element",
"EvalError",
"Event",
"HTMLAnchorElement",
"HTMLAudioElement",
"HTMLAppletElement",
"HTMLAreaElement",
"HTMLBRElement",
"HTMLBaseElement",
"HTMLBodyElement",
"HTMLButtonElement",
"HTMLCanvasElement",
"HTMLDListElement",
"HTMLDirectoryElement",
"HTMLDivElement",
"HTMLDocument",
"HTMLElement",
"HTMLFieldSetElement",
"HTMLFontElement",
"HTMLFormElement",
"HTMLFrameElement",
"HTMLFrameSetElement",
"HTMLHRElement",
"HTMLHeadElement",
"HTMLHeadingElement",
"HTMLHtmlElement",
"HTMLIFrameElement",
"HTMLImageElement",
"HTMLInputElement",
"HTMLIsIndexElement",
"HTMLLIElement",
"HTMLLabelElement",
"HTMLLegendElement",
"HTMLLinkElement",
"HTMLMapElement",
"HTMLMarqueeElement",
"HTMLMediaElement",
"HTMLMenuElement",
"HTMLMetaElement",
"HTMLModElement",
"HTMLOListElement",
"HTMLOptGroupElement",
"HTMLOptionElement",
"HTMLParagraphElement",
"HTMLParamElement",
"HTMLPreElement",
"HTMLQuoteElement",
"HTMLScriptElement",
"HTMLSelectElement",
"HTMLSourceElement",
"HTMLStyleElement",
"HTMLTableCaptionElement",
"HTMLTableCellElement",
"HTMLTableColElement",
"HTMLTableElement",
"HTMLTableRowElement",
"HTMLTableSectionElement",
"HTMLTextAreaElement",
"HTMLTitleElement",
"HTMLUListElement",
"HTMLVideoElement",
"Image",
"MutationEvent",
"Node",
"NodeFilter",
"Option",
"ProcessingInstruction",
"Range",
"RangeError",
"ReferenceError",
"SyntaxError",
"Text",
"TypeError",
"URIError",
"XMLDocument",
"XMLHttpRequest",
"XMLSerializer",
"XPathEvaluator",
"XPathResult",
"XSLTProcessor"
];
var windowFunctionPropertiesNotAllowed = [
"addEventListener",
"alert",
"atob",
"btoa",
"captureEvents",
"clearInterval",
"clearTimeout",
"confirm",
"find",
"getComputedStyle",
"getMatchedCSSRules",
"getSelection",
"moveBy",
"moveTo",
"open",
"print",
"prompt",
"releaseEvents",
"removeEventListener",
"resizeBy",
"resizeTo",
"scroll",
"scrollBy",
"scrollTo",
"setInterval",
"setTimeout",
"showModalDialog",
"stop",
];
var windowAttributesPropertiesNotAllowed = [
"clientInformation",
"console",
"crypto",
"defaultStatus",
"defaultstatus",
"devicePixelRatio",
"document",
"embeds",
"eval",
"event",
"frameElement",
"images",
"innerHeight",
"innerWidth",
"locationbar",
"menubar",
"name",
"navigator",
"offscreenBuffering",
"onabort",
"onbeforeunload",
"onblur",
"onchange",
"onclick",
"ondblclick",
"onerror",
"onfocus",
"onkeydown",
"onkeypress",
"onkeyup",
"onload",
"onmousedown",
"onmousemove",
"onmouseout",
"onmouseover",
"onmouseup",
"onmousewheel",
"onreset",
"onresize",
"onscroll",
"onsearch",
"onselect",
"onsubmit",
"onunload",
"outerHeight",
"outerWidth",
"pageXOffset",
"pageYOffset",
"personalbar",
"plugins",
"prototype",
"screen",
"screenLeft",
"screenTop",
"screenX",
"screenY",
"scrollX",
"scrollY",
"scrollbars",
"status",
"statusbar",
"toolbar",
"history",
];
window.onload = function()
{
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.waitUntilDone();
}
if (window.testRunner) {
setTimeout(pollForTest, 1);
} else {
log("To run the test, click the button below when the opened window finishes loading.");
var button = document.createElement("button");
button.appendChild(document.createTextNode("Run Test"));
button.onclick = runTest;
document.body.appendChild(button);
}
}
pollForTest = function()
{
if (!testRunner.globalFlag) {
setTimeout(pollForTest, 1);
return;
}
runTest();
testRunner.notifyDone();
}
runTest = function()
{
window.targetWindow = frames[0];
log("\n----- tests for getting of not allowed properties -----\n");
log("\n----- tests for getting of not allowed Constructors -----\n");
for (var i = 0; i < windowConstructorPropertiesNotAllowed.length; i++) {
var property = windowConstructorPropertiesNotAllowed[i];
shouldBeFalse("canGetDescriptor(targetWindow, '" + property + "')");
}
log("\n----- tests for getting of not allowed Functions -----\n");
for (var i = 0; i < windowFunctionPropertiesNotAllowed.length; i++) {
var property = windowFunctionPropertiesNotAllowed[i];
shouldBeFalse("canGetDescriptor(targetWindow, '" + property + "')");
}
log("\n----- tests for getting of not allowed Attributes -----\n");
for (var i = 0; i < windowAttributesPropertiesNotAllowed.length; i++) {
var property = windowAttributesPropertiesNotAllowed[i];
if (property == "document")
log("Firefox allows access to 'document' but throws an exception when you access its properties.");
shouldBeFalse("canGetDescriptor(targetWindow, '" + property + "')");
}
log("----- tests access to cross domain location object -----");
window.targetLocation = targetWindow.location;
var locationPropertiesNotAllowed = [
"protocol", "host", "hostname", "port", "pathname", "search", "hash", "toString", "valueOf", "customProperty", "assign", "reload"
];
var locationPropertiesAllowed = [
"replace"
];
for (var i = 0; i < locationPropertiesNotAllowed.length; i++)
shouldBeFalse("canGetDescriptor(targetLocation, '" + locationPropertiesNotAllowed[i] + "')");
for (var i = 0; i < locationPropertiesAllowed.length; i++)
shouldBeTrue("canGetDescriptor(targetLocation, '" + locationPropertiesAllowed[i] + "')");
log("----- tests access to cross domain history object -----");
try {
window.targetHistory = targetWindow.history;
log("FAIL: Could access targetWindow.history");
} catch (e) {
console.log(e);
log("PASS: Could not access targetWindow.history");
}
}
</script>
</head>
<body>
<p>This test checks cross-frame access security of getOwnPropertyDescriptor (https://bugs.webkit.org/show_bug.cgi?id=32119).</p>
<iframe src="http://localhost:8000/security/resources/cross-frame-iframe-for-get-test.html" style=""></iframe>
<pre id="console"></pre>
</body>
</html>