third_party/WebKit/LayoutTests/http/tests/security/xss-DENIED-getSelection-from-inactive-domwindow.html

   1 <script>
   2 if (window.testRunner) {
   3     testRunner.dumpAsText();
   4     testRunner.waitUntilDone();
   5 }
   6
   7 window.onload = function()
   8 {
   9     frame = document.body.appendChild(document.createElement("iframe"));
  10     wnd = frame.contentWindow;
  11     func = wnd.Function;
  12
  13     wnd.location = "about:blank";
  14     frame.onload = function() {
  15         selection = func("return getSelection()")();
  16
  17         wnd.location = "http://localhost:8000/security/resources/innocent-victim.html";
  18         frame.onload = function() {
  19             frame.onload = null;
  20
  21             try {
  22                 selection.baseNode.constructor.constructor.constructor("alert(document.body.innerHTML)")()
  23             } catch(ex) {
  24             }
  25
  26             if (window.testRunner)
  27                 testRunner.notifyDone();
  28         }
  29     }
  30 }
  31 </script>
  32 This tests passes if it doesn't alert the contents of innocent-victim.html.