blob: 30a1e043dc3ca18ad2cd9d6a247dca2432e75de9 [file] [log] [blame]
<script>
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.waitUntilDone();
}
</script>
<body>
This passes if it doesn't alert the contents of innocent-victim.
<script>
window.onload = function()
{
frame = document.body.appendChild(document.createElement("iframe"));
frame.src = "http://localhost:8080/security/resources/innocent-victim-with-iframe.html";
frame.onload = function() {
frame.onload = null;
frame.contentWindow[0].location = "data:text/html,<script>(" + function() {
try {
window.name = "valueOf";
obj = window.open();
obj.__proto__.__proto__ = parent;
alert(obj.valueOf.constructor("return document.body.innerHTML")());
} catch(ex) {
console.log("Threw exception: " + ex)
}
if (window.testRunner)
testRunner.notifyDone();
} + ")()</scr" + "ipt>";
}
}
</script>