Attachment 783677 Details for Bug 886262

[patch] Tests for Bug 886262: HTML <object>s do not inherit sandbox flags from their parents.

bug886262tests.patch (text/plain), 11.50 KB, created by Bob Owen (:bobowen)

(hide)

Description:

Filename:

MIME Type:

Creator: Bob Owen (:bobowen)

Size: 11.50 KB

patch

obsolete

># HG changeset patch
># User Bob Owen <bobowencode@gmail.com>
># Date 1375028852 -3600
># Node ID fb62ab7255311db979d44c4382f3f3c03d80585f
># Parent  73b69c146ca6926b4a72bb484550e5afe04b93cc
>Tests for Bug 886262:  HTML <object>s do not inherit sandbox flags from their parents.
>
>diff --git a/content/html/content/test/Makefile.in b/content/html/content/test/Makefile.in
>--- a/content/html/content/test/Makefile.in
>+++ b/content/html/content/test/Makefile.in
>@@ -283,16 +283,20 @@ MOCHITEST_FILES = \
> 		file_iframe_sandbox_a_if5.html \
> 		file_iframe_sandbox_a_if6.html \
> 		file_iframe_sandbox_a_if7.html \
> 		file_iframe_sandbox_a_if8.html \
> 		file_iframe_sandbox_a_if9.html \
> 		file_iframe_sandbox_a_if10.html \
> 		file_iframe_sandbox_a_if11.html \
> 		file_iframe_sandbox_a_if12.html \
>+		file_iframe_sandbox_a_if13.html \
>+		file_iframe_sandbox_a_if14.html \
>+		file_iframe_sandbox_a_if15.html \
>+		file_iframe_sandbox_a_if16.html \
> 		test_iframe_sandbox_same_origin.html \
> 		file_iframe_sandbox_b_if1.html \
> 		file_iframe_sandbox_b_if2.html \
> 		file_iframe_sandbox_b_if3.html \
> 		test_iframe_sandbox_general.html \
> 		file_iframe_sandbox_c_if1.html \
> 		file_iframe_sandbox_c_if2.html \
> 		file_iframe_sandbox_c_if3.html \
>diff --git a/content/html/content/test/file_iframe_sandbox_a_if10.html b/content/html/content/test/file_iframe_sandbox_a_if10.html
>--- a/content/html/content/test/file_iframe_sandbox_a_if10.html
>+++ b/content/html/content/test/file_iframe_sandbox_a_if10.html
>@@ -2,10 +2,11 @@
> <html>
> <head>
>   <meta charset="utf-8">
>   <title>Test for Bug 341604</title>
>   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
> </head>
> <frameset>
>   <frame src="file_iframe_sandbox_a_if11.html">
>+  <frame src="file_iframe_sandbox_a_if16.html">
> </frameset>
> </html>
>diff --git a/content/html/content/test/file_iframe_sandbox_a_if11.html b/content/html/content/test/file_iframe_sandbox_a_if11.html
>--- a/content/html/content/test/file_iframe_sandbox_a_if11.html
>+++ b/content/html/content/test/file_iframe_sandbox_a_if11.html
>@@ -13,11 +13,11 @@
>         window.parent.parent.postMessage({ok: true, desc: "a frame inside a sandboxed iframe is not same origin with the iframe's parent"}, "*");
>       }
>      }
>   </script>
> </head>
> <frameset>
>   <frame onload='doStuff()' src="file_iframe_sandbox_a_if12.html">
> </frameset>
>-I'm a &lt;frame&gt; inside an iframe which is sandboxed with 'allow-scripts'
>+I'm a &lt;frame&gt; inside an iframe which is sandboxed with 'allow-scripts allow-forms'
> </html>
> 
>diff --git a/content/html/content/test/file_iframe_sandbox_a_if12.html b/content/html/content/test/file_iframe_sandbox_a_if12.html
>--- a/content/html/content/test/file_iframe_sandbox_a_if12.html
>+++ b/content/html/content/test/file_iframe_sandbox_a_if12.html
>@@ -12,12 +12,12 @@ function doStuff() {
>   }
>   catch (e) {
>     dump("caught some e if12\n");
>     window.parent.parent.parent.postMessage({ok: true, desc: "a frame inside a frame inside a sandboxed iframe is not same origin with the iframe's parent"}, "*");
>   }
> }
> </script>
> <body onload='doStuff()'>
>-  I'm a &lt;frame&gt; inside a &lt;frame&gt; inside an iframe which is sandboxed with 'allow-scripts'
>+  I'm a &lt;frame&gt; inside a &lt;frame&gt; inside an iframe which is sandboxed with 'allow-scripts allow-forms'
> </body>
> </html>
> 
>diff --git a/content/html/content/test/file_iframe_sandbox_a_if13.html b/content/html/content/test/file_iframe_sandbox_a_if13.html
>new file mode 100644
>--- /dev/null
>+++ b/content/html/content/test/file_iframe_sandbox_a_if13.html
>@@ -0,0 +1,13 @@
>+<!DOCTYPE HTML>
>+<html>
>+<head>
>+  <meta charset="utf-8">
>+  <title>Test for Bug 886262</title>
>+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
>+</head>
>+
>+<body>
>+  <object data="file_iframe_sandbox_a_if14.html"></object>
>+</body>
>+
>+</html>
>diff --git a/content/html/content/test/file_iframe_sandbox_a_if14.html b/content/html/content/test/file_iframe_sandbox_a_if14.html
>new file mode 100644
>--- /dev/null
>+++ b/content/html/content/test/file_iframe_sandbox_a_if14.html
>@@ -0,0 +1,34 @@
>+<!DOCTYPE HTML>
>+<html>
>+<head>
>+  <meta charset="utf-8">
>+  <title>Test for Bug 886262</title>
>+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
>+</head>
>+
>+<script>
>+  window.addEventListener("message", receiveMessage, false);
>+
>+  function receiveMessage(event)
>+  {
>+    window.parent.parent.postMessage({ok: event.data.ok, desc: "objects containing " + event.data.desc}, "*");
>+  }
>+
>+  function doStuff() {
>+    try {
>+      window.parent.parent.ok_wrapper(false, "an object inside a sandboxed iframe should NOT be same origin with the iframe's parent");
>+    }
>+    catch (e) {
>+      window.parent.parent.postMessage({ok: true, desc: "an object inside a sandboxed iframe is not same origin with the iframe's parent"}, "*");
>+    }
>+  }
>+</script>
>+
>+<body onload='doStuff()'>
>+I'm a &lt;object&gt; inside an iframe which is sandboxed with 'allow-scripts allow-forms'
>+
>+  <object data="file_iframe_sandbox_a_if15.html"></object>
>+</body>
>+
>+</html>
>+
>diff --git a/content/html/content/test/file_iframe_sandbox_a_if15.html b/content/html/content/test/file_iframe_sandbox_a_if15.html
>new file mode 100644
>--- /dev/null
>+++ b/content/html/content/test/file_iframe_sandbox_a_if15.html
>@@ -0,0 +1,38 @@
>+<!DOCTYPE HTML>
>+<html>
>+<head>
>+  <meta charset="utf-8">
>+  <title>Test for Bug 886262</title>
>+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
>+</head>
>+
>+<script>
>+function doStuff() {
>+  try {
>+    window.parent.parent.parent.ok_wrapper(false, "an object inside a frame or object inside a sandboxed iframe should NOT be same origin with the iframe's parent");
>+  }
>+  catch (e) {
>+    window.parent.parent.parent.postMessage({ok: true, desc: "an object inside a frame or object inside a sandboxed iframe is not same origin with the iframe's parent"}, "*");
>+  }
>+
>+  // Check that sandboxed forms browsing context flag NOT set by attempting to submit a form.
>+  try {
>+    document.getElementById('a_form').submit();
>+  }
>+  catch (e) {
>+    window.parent.parent.parent.postMessage({ok: false, desc: "an object inside a frame or object inside a sandboxed iframe with allow-forms should be allowed to submit forms"}, "*");
>+  }
>+}
>+</script>
>+
>+<body onload='doStuff()'>
>+  I'm a &lt;object&gt; inside a &lt;frame&gt; or &lt;object&gt; inside an iframe which is sandboxed with 'allow-scripts allow-forms'
>+
>+  <form method="get" action="file_iframe_sandbox_form_pass.html" id="a_form">
>+    First name: <input type="text" name="firstname">
>+    Last name: <input type="text" name="lastname">
>+    <input type="submit" id="a_button">
>+  </form>
>+</body>
>+</html>
>+
>diff --git a/content/html/content/test/file_iframe_sandbox_a_if16.html b/content/html/content/test/file_iframe_sandbox_a_if16.html
>new file mode 100644
>--- /dev/null
>+++ b/content/html/content/test/file_iframe_sandbox_a_if16.html
>@@ -0,0 +1,25 @@
>+<!DOCTYPE HTML>
>+<html>
>+<head>
>+  <meta charset="utf-8">
>+  <title>Test for Bug 886262</title>
>+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
>+</head>
>+
>+<script>
>+  window.addEventListener("message", receiveMessage, false);
>+
>+  function receiveMessage(event)
>+  {
>+    window.parent.parent.postMessage({ok: event.data.ok, desc: "objects containing " + event.data.desc}, "*");
>+  }
>+</script>
>+
>+<body>
>+I'm a &lt;frame&gt; inside an iframe which is sandboxed with 'allow-scripts allow-forms'
>+
>+  <object data="file_iframe_sandbox_a_if15.html"></object>
>+</body>
>+
>+</html>
>+
>diff --git a/content/html/content/test/test_iframe_sandbox_inheritance.html b/content/html/content/test/test_iframe_sandbox_inheritance.html
>--- a/content/html/content/test/test_iframe_sandbox_inheritance.html
>+++ b/content/html/content/test/test_iframe_sandbox_inheritance.html
>@@ -34,18 +34,18 @@ function ok_wrapper(result, desc) {
>   ok(result, desc);
> 
>   completedTests++;
> 
>   if (result) {
> 	  passedTests++;
>   } 
> 
>-  if (completedTests == 6) {
>-    is(passedTests, 6, "there should be 6 passed inheritance tests");
>+  if (completedTests == 11) {
>+    is(passedTests, completedTests, "there should be " + completedTests + " passed inheritance tests");
>     SimpleTest.finish();
>   }
> }
> 
> function doTest() {
>   // fails if bad
>   // 1) an iframe with no sandbox attribute inside an iframe that has sandbox = ""
>   // should not be able to execute scripts (cannot ever loosen permissions)
>@@ -97,22 +97,50 @@ function doTest() {
>   // 10) a <frame> inside an <iframe> sandboxed with 'allow-scripts' should not be same
>   // origin with this document
>   // done by file_iframe_sandbox_a_if11.html which is contained with file_iframe_sandbox_a_if10.html
> 
>   // passes if good
>   // 11) a <frame> inside a <frame> inside an <iframe> sandboxed with 'allow-scripts' should not be same
>   // origin with its parent frame or this document
>   // done by file_iframe_sandbox_a_if12.html which is contained with file_iframe_sandbox_a_if11.html
>+
>+  // passes if good, fails if bad
>+  // 12) an <object> inside an <iframe> sandboxed with 'allow-scripts' should not be same
>+  // origin with this document
>+  // done by file_iframe_sandbox_a_if14.html which is contained within file_iframe_sandbox_a_if13.html
>+
>+  // passes if good, fails if bad
>+  // 13) an <object> inside an <object> inside an <iframe> sandboxed with 'allow-scripts' should not be same
>+  // origin with its parent frame or this document
>+  // done by file_iframe_sandbox_a_if15.html which is contained within file_iframe_sandbox_a_if14.html
>+
>+  // passes if good, fails if bad
>+  // 14) an <object> inside an <frame> inside an <iframe> sandboxed with 'allow-scripts' should not be same
>+  // origin with its parent frame or this document
>+  // done by file_iframe_sandbox_a_if15.html which is contained within file_iframe_sandbox_a_if16.html
>+  // which is contained within file_iframe_sandbox_a_if10.html
>+
>+  // passes if good, fails if bad
>+  // 15) an <object> inside an <object> inside an <iframe> sandboxed with 'allow-scripts allow-forms'
>+  // should be able to submit forms.
>+  // done by file_iframe_sandbox_a_if15.html which is contained within file_iframe_sandbox_a_if14.html
>+
>+  // passes if good, fails if bad
>+  // 16) an <object> inside an <frame> inside an <iframe> sandboxed with 'allow-scripts allow-forms'
>+  // should be able to submit forms.
>+  // done by file_iframe_sandbox_a_if15.html which is contained within file_iframe_sandbox_a_if16.html
>+  // which is contained within file_iframe_sandbox_a_if10.html
> }
> 
> addLoadEvent(doTest);
> </script>
> <body>
> <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=341604">Mozilla Bug 341604</a> - Implement HTML5 sandbox attribute for IFRAMEs
> <p id="display"></p>
> <div id="content">
> <iframe sandbox="" id="if_1" src="file_iframe_sandbox_a_if1.html" height="10" width="10"></iframe>
> <iframe sandbox="allow-scripts" id="if_3" src="file_iframe_sandbox_a_if3.html" height="10" width="10"></iframe>
> <iframe sandbox="allow-scripts allow-same-origin" id="if_5" src="file_iframe_sandbox_a_if5.html" height="10" width="10"></iframe>
> <iframe sandbox="allow-scripts allow-same-origin" id="if_8" src="file_iframe_sandbox_a_if8.html" height="10" width="10"></iframe>
>-<iframe sandbox="allow-scripts" id="if_10" src="file_iframe_sandbox_a_if10.html" height="10" width="10"></iframe>
>+<iframe sandbox="allow-scripts allow-forms" id="if_10" src="file_iframe_sandbox_a_if10.html" height="10" width="10"></iframe>
>+<iframe sandbox="allow-scripts allow-forms" id="if_13" src="file_iframe_sandbox_a_if13.html" height="10" width="10"></iframe>
> </div>

Actions: View | Diff | Review

Attachments on bug 886262: 783470 | 783677 | 783678 | 785657 | 785658 | 785922 | 786299 | 786305