+2011-11-16 Sergey Glazunov <serg.glazunov@gmail.com>
+
+ ScriptController::executeIfJavaScriptURL gets confused by synchronous frame loads
+ https://bugs.webkit.org/show_bug.cgi?id=69777
+
+ Reviewed by Adam Barth.
+
+ * http/tests/security/xss-DENIED-synchronous-frame-load-in-javascript-url-expected.txt: Added.
+ * http/tests/security/xss-DENIED-synchronous-frame-load-in-javascript-url.html: Added.
+
2011-11-16 Yusuke Suzuki <utatane.tea@gmail.com>
String new RegExp('\n').toString() returns is invalid RegularExpressionLiteral
--- /dev/null
+<html>
+<head>
+<script>
+if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ layoutTestController.setCanOpenWindows();
+ layoutTestController.setCloseRemainingWindowsWhenComplete(true);
+}
+
+window.onload = function()
+{
+ victim = document.body.appendChild(document.createElement("iframe"));
+ wnd = victim.contentWindow.open();
+ victim.src = "http://localhost:8080/security/resources/innocent-victim.html";
+ victim.onload = function() {
+ victim.onload = null;
+
+ wnd.eval("(" + function() {
+ location = "javascript:(" + function() {
+ a = document.createElement("a");
+ a.href = "about:blank";
+ e = document.createEvent("MouseEvent");
+ e.initMouseEvent("click");
+ a.dispatchEvent(e);
+
+ return "<script>(" + function() {
+ opener.location = "javascript:alert(document.body.innerHTML)";
+
+ if (window.layoutTestController)
+ setTimeout("layoutTestController.notifyDone()", 0);
+ } + ")()<\/script>";
+ } + ")()";
+ } + ")()");
+ }
+}
+</script>
+</head>
+<body>
+This test passes if there's no alert dialog.
+</body>
+</html>
git://git.webkit.org / WebKit-https.git / commitdiff