Bugzilla

		file_iframe_sandbox_a_if13.html \

		file_iframe_sandbox_a_if14.html \

		file_iframe_sandbox_a_if15.html \

		file_iframe_sandbox_a_if16.html \

		file_iframe_sandbox_a_if17.html \

		file_iframe_sandbox_a_if18.html \

		file_iframe_sandbox_a_if19.html \

  <frame src="file_iframe_sandbox_a_if16.html">

I'm a <frame> inside an iframe which is sandboxed with 'allow-scripts allow-forms'

  I'm a <frame> inside a <frame> inside an iframe which is sandboxed with 'allow-scripts allow-forms'

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 886262</title>

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<body>

  <object data="file_iframe_sandbox_a_if14.html"></object>

</body>

</html>

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 886262</title>

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<script>

  window.addEventListener("message", receiveMessage, false);

  function receiveMessage(event)

  {

    window.parent.parent.postMessage({ok: event.data.ok, desc: "objects containing " + event.data.desc}, "*");

  }

  function doStuff() {

    try {

      window.parent.parent.ok_wrapper(false, "an object inside a sandboxed iframe should NOT be same origin with the iframe's parent");

    }

    catch (e) {

      window.parent.parent.postMessage({ok: true, desc: "an object inside a sandboxed iframe is not same origin with the iframe's parent"}, "*");

    }

  }

</script>

<body onload='doStuff()'>

I'm a <object> inside an iframe which is sandboxed with 'allow-scripts allow-forms'

  <object data="file_iframe_sandbox_a_if15.html"></object>

</body>

</html>

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 886262</title>

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<script>

function doStuff() {

  try {

    window.parent.parent.parent.ok_wrapper(false, "an object inside a frame or object inside a sandboxed iframe should NOT be same origin with the iframe's parent");

  }

  catch (e) {

    window.parent.parent.parent.postMessage({ok: true, desc: "an object inside a frame or object inside a sandboxed iframe is not same origin with the iframe's parent"}, "*");

  }

  // Check that sandboxed forms browsing context flag NOT set by attempting to submit a form.

  document.getElementById('a_form').submit();

}

</script>

<body onload='doStuff()'>

  I'm a <object> inside a <frame> or <object> inside an iframe which is sandboxed with 'allow-scripts allow-forms'

  <form method="get" action="file_iframe_sandbox_form_pass.html" id="a_form">

    First name: <input type="text" name="firstname">

    Last name: <input type="text" name="lastname">

    <input type="submit" id="a_button">

  </form>

</body>

</html>

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 886262</title>

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<script>

  window.addEventListener("message", receiveMessage, false);

  function receiveMessage(event)

  {

    window.parent.parent.postMessage({ok: event.data.ok, desc: "objects containing " + event.data.desc}, "*");

  }

</script>

<body>

I'm a <frame> inside an iframe which is sandboxed with 'allow-scripts allow-forms'

  <object data="file_iframe_sandbox_a_if15.html"></object>

</body>

</html>

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 886262</title>

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<script>

  function doTest() {

    var if_18_19 = document.getElementById('if_18_19');

    if_18_19.sandbox = "allow-scripts allow-same-origin";

    if_18_19.contentWindow.postMessage("go", "*");

  }

</script>

<body onload="doTest()">

  I am sandboxed but with "allow-scripts". I change the sandbox flags on if_18_19 to

  "allow-scripts allow-same-origin" then get it to re-navigate itself to

  file_iframe_sandbox_a_if18.html, which attemps to call a function in my parent.

  This should fail since my sandbox flags should be copied to it when the sandbox

  flags are changed.

  <iframe sandbox="allow-scripts" id="if_18_19" src="file_iframe_sandbox_a_if19.html" height="10" width="10"></iframe>

</body>

</html>

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 886262</title>

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

</head>

<script>

  function doTest() {

    try {

      window.parent.parent.ok_wrapper(false, "an iframe in an iframe SHOULD copy its parent's sandbox flags when its sandbox flags are changed");

    }

    catch (e) {

      window.parent.parent.postMessage({ok: true, desc: "an iframe in an iframe copies its parent's sandbox flags when its sandbox flags are changed"}, "*");

    }

  }

</script>

<body onload="doTest()">

  I'm an iframe whose sandbox flags have been changed to include allow-same-origin.

  I should not be able to call a function in my parent's parent because my parent's

  iframe does not have allow-same-origin set.

</body>

</html>

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

  <title>Test for Bug 341604</title>

  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>

  <script type="text/javascript" src="/tests/SimpleTest/EventUtils.js"></script>

</head>

<script>

  window.addEventListener("message", function(e){

     window.open("file_iframe_sandbox_a_if18.html", "_self");

  }, false);

</script>

<body>

  I'm just here to navigate to file_iframe_sandbox_a_if18.html after my owning

  iframe has had allow-same-origin added.

</body>

</html>

SimpleTest.expectAssertions(1, 1);

  if (completedTests == 13) {

    is(passedTests, completedTests, "there should be " + completedTests + " passed inheritance tests");

  // passes if good, fails if bad

  // 12) An <object> inside an <iframe> sandboxed with 'allow-scripts' should not be same

  // origin with this document

  // Done by file_iframe_sandbox_a_if14.html which is contained within file_iframe_sandbox_a_if13.html

  // passes if good, fails if bad

  // 13) An <object> inside an <object> inside an <iframe> sandboxed with 'allow-scripts' should not be same

  // origin with its parent frame or this document

  // Done by file_iframe_sandbox_a_if15.html which is contained within file_iframe_sandbox_a_if14.html

  // passes if good, fails if bad

  // 14) An <object> inside a <frame> inside an <iframe> sandboxed with 'allow-scripts' should not be same

  // origin with its parent frame or this document

  // Done by file_iframe_sandbox_a_if15.html which is contained within file_iframe_sandbox_a_if16.html

  // which is contained within file_iframe_sandbox_a_if10.html

  // passes if good

  // 15) An <object> inside an <object> inside an <iframe> sandboxed with 'allow-scripts allow-forms'

  // should be able to submit forms.

  // Done by file_iframe_sandbox_a_if15.html which is contained within file_iframe_sandbox_a_if14.html

  // passes if good

  // 16) An <object> inside a <frame> inside an <iframe> sandboxed with 'allow-scripts allow-forms'

  // should be able to submit forms.

  // Done by file_iframe_sandbox_a_if15.html which is contained within file_iframe_sandbox_a_if16.html

  // which is contained within file_iframe_sandbox_a_if10.html

  // fails if bad

  // 17) An <object> inside an <iframe> sandboxed with 'allow-same-origin'

  // should not be able to run scripts.

  // Done by iframe "if_no_scripts" using a data: load.

  // passes if good

  // 18) An <object> inside an <iframe> sandboxed with 'allow-scripts allow-same-origin'

  // should be able to run scripts and be same origin with this document.

  // Done by iframe "if_scripts" using a data: load.

  // passes if good, fails if bad

  // 19) Make sure that the parent's document's sandboxing flags are copied when

  // changing the sandbox flags on an iframe inside an iframe.

  // Done in file_iframe_sandbox_a_if17.html and file_iframe_sandbox_a_if18.html

<iframe sandbox="allow-scripts allow-forms" id="if_10" src="file_iframe_sandbox_a_if10.html" height="10" width="10"></iframe>

<iframe sandbox="allow-scripts allow-forms" id="if_13" src="file_iframe_sandbox_a_if13.html" height="10" width="10"></iframe>

<iframe sandbox="allow-same-origin" id="if_no_scripts" src="data:text/html,<object%20data='data:text/html,<script>parent.parent.ok_wrapper(false, &quot;an object inside an iframe sandboxed with only allow-same-origin should not be able to run scripts&quot;)</script>'></object>" height="10" width="10"></iframe>

<iframe sandbox="allow-scripts allow-same-origin" id="if_scripts" src="data:text/html,<object%20data='data:text/html,<script>parent.parent.ok_wrapper(true, &quot;an object inside an iframe sandboxed with allow-scripts allow-same-origin should be able to run scripts and call functions in the parent of the iframe&quot;)</script>'></object>" height="10" width="10"></iframe>

<iframe sandbox="allow-same-origin" id="if_19" src="data:text/html,<iframe%20data='data:text/html,<script>parent.parent.ok_wrapper(true, &quot;an object inside an iframe sandboxed with allow-scripts allow-same-origin should be able to run scripts and call functions in the parent of the iframe&quot;)</script>'></object>" height="10" width="10"></iframe>

<iframe sandbox="allow-scripts" id="if_17" src="file_iframe_sandbox_a_if17.html" height="10" width="10"></iframe>