third_party/WebKit/LayoutTests/fast/frames/sandboxed-iframe-scripting-04.html

   1 <!DOCTYPE html>
   2 <html>
   3 <head>
   4     <script src="../../resources/js-test.js"></script>
   5     <script>
   6         window.jsTestIsAsync = true;
   7
   8         var allowedExecuted = 0;
   9         var disallowedExecuted = 0;
  10         window.addEventListener('message', function () {
  11           disallowedExecuted++;
  12
  13           finish();
  14         });
  15
  16         function finish() {
  17             shouldBe("disallowedExecuted", "0");
  18             shouldBe("allowedExecuted", "0");
  19
  20             finishJSTest();
  21         };
  22     </script>
  23 </head>
  24 <body>
  25     <iframe sandbox="allow-same-origin"
  26             onload="finish()"
  27             src="data:text/html,<script>alert('FAIL: Executed script without allow-scripts in data URL');window.parent.postMessage({'fail': true}, '*');</script>">
  28     </iframe>
  29     <script>
  30         description("Verify that sandboxed frames without sandbox='allow-scripts' cannot execute script from data: URLs.");
  31     </script>
  32 </body>
  33 </html>
  34
  35
  36
  37