| <!DOCTYPE html> |
| <html> |
| <head> |
| <script src="../../resources/js-test-pre.js"></script> |
| </head> |
| <body onload="runTest()"> |
| <iframe src="http://localhost:8000/security/resources/blank.html"></iframe> |
| <script> |
| description("Tests that using another window's property getter does not bypass cross-origin checks."); |
| jsTestIsAsync = true; |
| |
| function callingFunctionShouldRejectPromiseWithErrorName(functionName, errorName) |
| { |
| return Object.getOwnPropertyDescriptor(window, functionName).value.call(crossOriginWindow).then(() => { |
| testFailed("Calling " + functionName + " did not reject the promise"); |
| }, (e) => { |
| if (e.name == errorName) |
| testPassed("Calling " + functionName + " rejected promise with exception " + errorName + "."); |
| else |
| testFailed("Calling " + functionName + " should reject promise with exception " + errorName + ". Rejected with exception " + e.name + " instead."); |
| }); |
| } |
| |
| async function runTest() |
| { |
| crossOriginWindow = frames[0]; |
| shouldThrowErrorName('Object.getOwnPropertyDescriptor(window, "document").get.call(crossOriginWindow)', 'SecurityError'); |
| shouldThrowErrorName('Object.getOwnPropertyDescriptor(window, "name").get.call(crossOriginWindow)', 'SecurityError'); |
| shouldThrowErrorName('Object.getOwnPropertyDescriptor(window, "menubar").get.call(crossOriginWindow)', 'SecurityError'); |
| shouldThrowErrorName('Object.getOwnPropertyDescriptor(window, "scrollbars").get.call(crossOriginWindow)', 'SecurityError'); |
| shouldThrowErrorName('Object.getOwnPropertyDescriptor(window, "navigator").get.call(crossOriginWindow)', 'SecurityError'); |
| shouldThrowErrorName('Object.getOwnPropertyDescriptor(window, "screenX").get.call(crossOriginWindow)', 'SecurityError'); |
| await callingFunctionShouldRejectPromiseWithErrorName('createImageBitmap', 'SecurityError'); |
| await callingFunctionShouldRejectPromiseWithErrorName('fetch', 'SecurityError'); |
| shouldThrowErrorName('Object.getOwnPropertyDescriptor(window.__proto__, "constructor").get.call(crossOriginWindow)', 'TypeError'); |
| shouldThrowErrorName('Object.getOwnPropertyDescriptor(window.__proto__, "constructor").get.call(crossOriginWindow.__proto__)', 'TypeError'); |
| shouldThrowErrorName('crossOriginWindow.constructor', 'SecurityError'); |
| shouldThrowErrorName('Object.getOwnPropertyDescriptor(crossOriginWindow.__proto__, "constructor").value', 'SecurityError'); |
| shouldBeTrue('Object.getOwnPropertyDescriptor(window, "location").get.call(crossOriginWindow) === crossOriginWindow.location'); |
| finishJSTest(); |
| } |
| </script> |
| </body> |
| <script src="../../resources/js-test-post.js"></script> |
| </html> |
