| <!DOCTYPE html> |
| <html> |
| <body> |
| <script src="/resources/js-test-pre.js"></script> |
| <p id="description"></p> |
| <div id="console"></div> |
| <div id="container"> |
| <button onclick="runTest()">Copy</button> |
| <div><br></div> |
| <div id="source" contenteditable> |
| hello, <meta content="some secret"><!-- secret --> |
| <img onclick="dangerousCode()" src="resources/apple.gif"><br> |
| <iframe class="same-origin-frame" src="resources/content-to-copy.html" width=80 height=80></iframe> |
| <iframe class="cross-origin-frame" src="http://localhost:8080/security/clipboard/resources/content-to-copy.html" width="100" height="100"></iframe> |
| <iframe class="same-origin-frame-with-data-url" src="resources/data-url-content-to-copy.html" width=80 height=80></iframe> |
| <iframe class="cross-origin-frame-with-data-url" src="http://localhost:8080/security/clipboard/resources/data-url-content-to-copy.html" width=80 height=80></iframe> |
| </div> |
| <iframe id="destinationFrame" src="http://localhost:8000/security/clipboard/resources/subdirectory/paste-html.html"></iframe> |
| </div> |
| <script> |
| |
| description('This tests copying and pasting HTML by the default action. WebKit should sanitize the HTML across origin.'); |
| jsTestIsAsync = true; |
| |
| if (window.internals) |
| internals.settings.setCustomPasteboardDataEnabled(true); |
| |
| function runTest() { |
| document.getElementById('source').focus(); |
| document.execCommand('selectAll'); |
| document.execCommand('copy'); |
| getSelection().removeAllRanges(); |
| setTimeout(() => { |
| destinationFrame.contentWindow.postMessage({type: 'paste'}, '*'); |
| }, 0); |
| } |
| |
| window.onmessage = function (event) { |
| if (event.data.type == 'pasted') { |
| html = event.data.html; |
| debug('html in DataTransfer'); |
| shouldBeTrue('html.includes("hello")'); |
| shouldBeTrue('fragment = (new DOMParser).parseFromString(html, "text/html"); img = fragment.querySelector("img"); !!img'); |
| shouldBeEqualToString('new URL(img.src).protocol', 'http:'); |
| shouldBeEqualToString('new URL(fragment.querySelector(".same-origin-frame").src).protocol', 'http:'); |
| shouldBeEqualToString('new URL(fragment.querySelector(".cross-origin-frame").src).protocol', 'http:'); |
| shouldBeEqualToString('new URL(fragment.querySelector(".same-origin-frame-with-data-url").src).protocol', 'http:'); |
| shouldBeEqualToString('new URL(fragment.querySelector(".cross-origin-frame-with-data-url").src).protocol', 'http:'); |
| } else if (event.data.type == 'checkedState') { |
| frames = event.data.frames; |
| shouldBe('frames.length', '4'); |
| shouldBeEqualToString('new URL(frames[0].src).protocol', 'http:'); |
| shouldBeFalse('frames[0].canAccessContentDocument'); |
| shouldBeEqualToString('new URL(frames[0].imageSrc).protocol', 'http:'); |
| shouldBe('frames[0].imageWidth', '80'); |
| shouldBeEqualToString('new URL(frames[1].src).protocol', 'http:'); |
| shouldBeFalse('frames[1].canAccessContentDocument'); |
| shouldBeEqualToString('new URL(frames[1].imageSrc).protocol', 'http:'); |
| shouldBe('frames[1].imageWidth', '80'); |
| shouldBeEqualToString('new URL(frames[2].src).protocol', 'http:'); |
| shouldBeFalse('frames[2].canAccessContentDocument'); |
| shouldBeEqualToString('new URL(frames[2].imageSrc).protocol', 'data:'); |
| shouldBe('frames[2].imageWidth', '10'); |
| shouldBeEqualToString('new URL(frames[3].src).protocol', 'http:'); |
| shouldBeFalse('frames[3].canAccessContentDocument'); |
| shouldBeEqualToString('new URL(frames[3].imageSrc).protocol', 'data:'); |
| shouldBe('frames[3].imageWidth', '10'); |
| if (window.testRunner) |
| container.remove(); |
| finishJSTest(); |
| } |
| } |
| |
| if (window.testRunner) |
| window.onload = runTest; |
| |
| </script> |
| <script src="/resources/js-test-post.js"></script> |
| </body> |
| </html> |
