chrome/test/data/dom_checker/dom_target_page.html

   1 <html>
   2 <!--
   3
   4    DOM checker - test target page
   5    ------------------------------
   6
   7    Authors: Michal Zalewski <lcamtuf@google.com>
   8             Filipe Almeida <filipe@google.com>
   9
  10    Copyright 2008 by Google Inc. All Rights Reserved.
  11
  12    Licensed under the Apache License, Version 2.0 (the "License");
  13    you may not use this file except in compliance with the License.
  14    You may obtain a copy of the License at
  15
  16      http://www.apache.org/licenses/LICENSE-2.0
  17
  18    Unless required by applicable law or agreed to in writing, software
  19    distributed under the License is distributed on an "AS IS" BASIS,
  20    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  21    See the License for the specific language governing permissions and
  22    limitations under the License.
  23
  24 -->
  25
  26 <script src="dom_config.js"></script>
  27
  28 <script>
  29
  30 var private_var = 1;            // We'll try to set it across domains.
  31 var ipc_page;                   // IPC page location
  32 var queue_timer;                // IPC queue handling timer
  33 var idle = true;                // IPC handler state
  34 var prev_hval = 'NONE';         // Previous IPC command
  35 var idle_cycles = 0;            // Number of cycles spend in idle
  36
  37 /* Try to inject a variable to paren't namespace by defining a getter in
  38    another domain. */
  39
  40 try {
  41   top.__defineGetter__('injected_var', function() {return 1;})
  42 } catch(e) {}
  43
  44
  45 /* Update IPC frame location as needed, set timers. */
  46 function page_init() {
  47
  48   ipc_page = 'http://' + main_host + '/' + main_dir + '/dom_blank_page.html';
  49   document.getElementById('ipc_write').src = ipc_page + '#2';
  50
  51   // log('Local ipc_write initialized to ' + ipc_page);
  52
  53   queue_timer = setInterval('get_ipc_command()',250);
  54
  55 }
  56
  57
  58 /* IPC subsystem logging (debugging purposes only) */
  59 function log(x) {
  60   var e = document.createElement('li');
  61   e.innerHTML = x;
  62   document.getElementById('log').appendChild(e);
  63 }
  64
  65
  66 /* Wait for IPC state change, execute command, send results. */
  67 function get_ipc_command() {
  68
  69   var hval;
  70
  71   try { hval = top.frames['ipc_read'].location.hash; } catch (e) {
  72     // log('IPC command read failed from external ipc_read.');
  73     hval = '';
  74   }
  75
  76   if (hval == prev_hval || hval == '' || hval == undefined || hval == 'NONE') {
  77     if (!idle) {
  78       idle_cycles++;
  79
  80       if (idle_cycles == 200) {
  81         // log('Entered power saving mode.');
  82         clearInterval(queue_timer);
  83         queue_timer = setInterval('get_ipc_command()',250);
  84         idle = true;
  85       }
  86
  87     }
  88
  89     return;
  90   }
  91
  92   /* Full speed! */
  93   if (idle) {
  94     // log('Entered full speed mode.');
  95     clearInterval(queue_timer);
  96     queue_timer = setInterval('get_ipc_command()',1);
  97     idle = false;
  98     idle_cycles = 0;
  99   }
 100
 101   // log('Got IPC command ' + hval + ' (prev: ' + prev_hval + ')');
 102
 103   prev_hval = hval;
 104
 105   var res = 0;
 106
 107   hval = hval.substr(1);
 108
 109   if (hval == 'RESET') res = 2;
 110   else try {
 111     if (eval(unescape(hval))) res = 1;
 112    } catch (e) {
 113     // log('Evaluation exception! Final was: ' + unescape(hval));
 114   }
 115
 116   document.getElementById('ipc_write').src =  ipc_page + '#' + res;
 117
 118 }
 119
 120 </script>
 121 <title>DOM checker victim page</title>
 122 <body onload="page_init()">
 123
 124 <!-- Some bogus page elements to make it possible to enumerate arrays. -->
 125
 126 <style name=ns>MENU { margin: 1em }</style>
 127
 128 <img src="#bad" name=ni>
 129
 130 <form name=nf method=post action=foo>
 131 <input type=hidden name=foo value=bar>
 132 </form>
 133
 134 <h1><a href="#bad" name=nl>Hi mom!</a></h1>
 135
 136 <a name=ni2>
 137
 138 <embed name=ne></embed>
 139
 140 <object name=no></object>
 141
 142 <applet name=na></applet>
 143
 144 <!-- Log container -->
 145 <div id=log>
 146 </div>
 147
 148 <!-- Nested subframe used for about:blank tests -->
 149 <iframe id=nf name=nf src="about:blank">
 150 </iframe>
 151
 152 <!-- IPC frame -->
 153 <iframe id=ipc_write name=ipc_write></iframe>
 154