Bugzilla

		test_iframe_sandbox_general.html \

		file_iframe_sandbox_c_if1.html \

		file_iframe_sandbox_c_if2.html \

		file_iframe_sandbox_c_if3.html \

		file_iframe_sandbox_c_if4.html \

		file_iframe_sandbox_form_fail.html \

		file_iframe_sandbox_form_pass.html \

		file_iframe_sandbox_open_window_fail.html \

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 341604</title>

  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>     

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<script type="text/javascript">

  function ok(result, desc) { 

    window.top.postMessage({ok: result, desc: desc}, "*");

  }

  function doSubmit() {

    document.getElementById('a_form').submit();

  }

  function doStuff() {

    ok(true, "documents sandboxed with allow-scripts should be able to run scripts"); 

    // should not be allowed - don't have allow-forms

    sendMouseEvent({type:'click'}, 'a_button');

  }

</script>

<body onLoad="doStuff()">

  I am sandboxed but with "allow-scripts"

  <form method="get" action="file_iframe_sandbox_form_pass.html" id="a_form">

    First name: <input type="text" name="firstname">

    Last name: <input type="text" name="lastname">

    <input type="submit" onclick="doSubmit()" id="a_button">

  </form>

</body>

</html>

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 341604</title>   

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<script type="text/javascript">

  function ok(result, desc) { 

    window.top.postMessage({ok: result, desc: message}, "*");

  }

  function doStuff() {

    ok(false, "documents sandboxed WITHOUT allow-scripts should NOT be able to run scripts"); 

  }

</script>

<body onLoad="doStuff()">

  I am sandboxed with no permissions

</body>

</html>

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 341604</title>

  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>     

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<script type="text/javascript">

  function doSubmit() {

    document.getElementById('a_form').submit();

  }

  function doStuff() {    

    // try and submit the form - this should succeed

    sendMouseEvent({type:'click'}, 'a_button');

  }

</script>

<body onLoad="doStuff()">

  I am sandboxed but with "allow-scripts allow-forms"

  <form method="get" action="file_iframe_sandbox_form_pass.html" id="a_form">

    First name: <input type="text" name="firstname">

    Last name: <input type="text" name="lastname">

    <input type="submit" onclick="doSubmit()" id="a_button">

  </form>

</body>

</html>

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 341604</title>

  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>     

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<script type="text/javascript">

  function ok(result, desc) { 

    window.parent.ok_wrapper(result, desc);

  }

  function doStuff() {

    // try to open a new window via target="_blank", window.open(), and showModalDialog()

    // the window we try to open closes itself once it opens

    sendMouseEvent({type:'click'}, 'target_blank');

    // REVIEW : window.open in a sandboxed document throws an exception : 

    // should it ?

    try { 

      window.open("file_iframe_sandbox_open_window_fail.html");

    } catch (error) {

      ok(true, "window.open threw a JS exception and was not allowed");

    }

    // REVIEW : window.showModalDialog in a sandboxed document throws an exception : 

    // should it ?

    try {

      window.showModalDialog("file_iframe_sandbox_open_window_fail.html"); 

    } catch(error) {

      ok(true, "window.showModalDialog threw a JS exception and was not allowed");

    }

  }    

</script>

<body onLoad="doStuff()">

  I am sandboxed but with "allow-scripts allow-same-origin"

  <a href="file_iframe_sandbox_open_window_fail.html" target="_blank" id="target_blank">open window</a>

</body>

</html>

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 341604</title>

  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<body onLoad="doStuff()">

  I should NOT be loaded by a form submit from a sandbox without 'allow-forms'

</body>

</html>

<script>

  function doStuff() {

    window.top.postMessage({ok: false, desc: "documents sandboxed without allow-forms should NOT be able to submit forms"}, "*");

  }

</script>

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 341604</title>

  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<body onLoad="doStuff()">

  I should be loaded by a form submit from a sandbox with 'allow-forms'

</body>

</html>

<script>

  function doStuff() {

    window.top.postMessage({ok: true, desc: "documents sandboxed with allow-forms should be able to submit forms"}, "*");

  }

</script>

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 341604</title>

  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<body onLoad="doStuff()">

  I should NOT be opened by a sandboxed iframe via any method

</body>

</html>

<script>

  function doStuff() {

    console.log("file_iframe_sandbox_window_open_fail.html");

    window.opener.ok(false, "sandboxed documents should NOT be able to open windows");

    self.close();

  }

</script>

<!DOCTYPE HTML>

<html>

<!--

https://bugzilla.mozilla.org/show_bug.cgi?id=341604

Implement HTML5 sandbox attribute for IFRAMEs - general tests

-->

<head>

  <meta charset="utf-8">

  <title>Test for Bug 341604</title>

  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<script type="application/javascript">

/** Test for Bug 341604 - Implement HTML5 sandbox attribute for IFRAMEs - general tests **/

// a postMessage handler that is used by sandboxed iframes without

// 'allow-same-origin' to communicate pass/fail back to this main page.

// it expects to be called with an object like {ok: true/false, desc: 

// <description of the test> which it then forwards to ok()

window.addEventListener("message", receiveMessage, false);  

function receiveMessage(event)  

{ 

  ok_wrapper(event.data.ok, event.data.desc);

}  

var completedTests = 0;

var passedTests = 0;

function ok_wrapper(result, desc) {

  ok(result, desc);

  completedTests++;

  if (result) {

    passedTests++;

  }

  // REVIEW : if one of these tests fails and this isn't called

  // this means this test will hang until the time out happens :(

  // advice on better ways to synchronize things appreciated !

  if (completedTests == 6) {

    ok(passedTests == 6, "There are 6 general tests that should pass");

    SimpleTest.finish();

  }

}

function doTest() { 

  SimpleTest.waitForExplicitFinish();

  // passes if good

  // 1) test that scripts can run in an iframe sandboxed with "allow-scripts"

  // (done in file_iframe_sandbox_c_if1.html which has 'allow-scripts')

  // fails if bad 

  // 2) test that allow scripts cannot run in an iframe sandboxed without "allow-scripts"

  // (done in file_iframe_sandbox_c_if2.html which has sandbox='')

  // passes if good

  // 3) test that a new iframe has sandbox attribute

  var ifr = document.createElement("iframe");

  ok_wrapper("sandbox" in ifr, "a new iframe should have a sandbox attribute");

  // passes if good

  // 4) test that the sandbox attribute is a DOMSettableTokenList

  ok_wrapper(ifr.sandbox instanceof DOMSettableTokenList, "sandbox attribute should be a DOMSettable Token List");

  // passes if good

  // 5) test that a sandboxed iframe with 'allow-forms' can submit forms

  // (done in file_iframe_sandbox_c_if3.html which has 'allow-forms' and 'allow-scripts')

  // fails if bad

  // 6) test that a sandboxed iframe without 'allow-forms' can NOT submit forms 

  // (done in file_iframe_sandbox_c_if1.html which only has 'allow-scripts')

  // REVIEW : are there other ways of opening new windows that the 3 below that are mentioned in the HTML5

  // spec ? 

  // fails if bad

  // 7) test that a sandboxed iframe can't open a new window using the target.attribute

  // this is done via file_iframe_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin"

  // the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok()

  // function that calls window.parent.ok_wrapper 

  // passes if good

  // 8) test that a sandboxed iframe can't open a new window using window.open

  // this is done via file_iframe_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin"

  // the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok()

  // function that calls window.parent.ok_wrapper

  // passes if good

  // 9) test that a sandboxed iframe can't open a new window using window.ShowModalDialog

  // this is done via file_iframe_c_if4.html which is sandboxed with "allow-scripts" and "allow-same-origin"

  // the window it attempts to open calls window.opener.ok(false, ...) and file_iframe_c_if4.html has an ok()

  // function that calls window.parent.ok_wrapper

}

</script>

<body onload="doTest()">

<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=341604">Mozilla Bug 341604</a> - Implement HTML5 sandbox attribute for IFRAMEs

<p id="display"></p>

<div id="content">

<iframe sandbox="allow-scripts" id="if_1" src="file_iframe_sandbox_c_if1.html" height="10" width="10"></iframe>

<iframe sandbox="" id="if_2" src="file_iframe_sandbox_c_if2.html" height="10" width="10"></iframe>

<iframe sandbox="allow-forms allow-scripts" id="if_3" src="file_iframe_sandbox_c_if3.html" height="10" width="10"></iframe>

<iframe sandbox="allow-same-origin allow-scripts" id="if_4" src="file_iframe_sandbox_c_if4.html" height="10" width="10"></iframe>

</div>

</body>

</html>