browser/components/sessionstore/test/browser_461743_sample.html@6474c204b198 (annotated)
browser/components/sessionstore/test/browser_461743_sample.html
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rw-r--r--
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
| michael@0 | 1 | <!-- Testcase originally by <moz_bug_r_a4@yahoo.com> --> |
| michael@0 | 2 | |
| michael@0 | 3 | <!DOCTYPE html> |
| michael@0 | 4 | <title>Test for bug 461743</title> |
| michael@0 | 5 | |
| michael@0 | 6 | <body> |
| michael@0 | 7 | <iframe src="data:text/html;charset=utf-8,empty"></iframe> |
| michael@0 | 8 | <iframe></iframe> |
| michael@0 | 9 | |
| michael@0 | 10 | <script type="application/javascript"> |
| michael@0 | 11 | var chromeUrl = "chrome://global/content/mozilla.xhtml"; |
| michael@0 | 12 | var exploitUrl = "javascript:try { document.body.innerHTML = Components.utils.reportError; } catch (ex) { }"; |
| michael@0 | 13 | |
| michael@0 | 14 | var loadCount = 0; |
| michael@0 | 15 | frames[0].addEventListener("DOMContentLoaded", handleLoad, false); |
| michael@0 | 16 | frames[1].addEventListener("DOMContentLoaded", handleLoad, false); |
| michael@0 | 17 | function handleLoad() { |
| michael@0 | 18 | if (++loadCount < 2) |
| michael@0 | 19 | return; |
| michael@0 | 20 | frames[0].removeEventListener("DOMContentLoaded", handleLoad, false); |
| michael@0 | 21 | frames[1].removeEventListener("DOMContentLoaded", handleLoad, false); |
| michael@0 | 22 | |
| michael@0 | 23 | var flip = 0; |
| michael@0 | 24 | MutationEvent.prototype.toString = function() { |
| michael@0 | 25 | return flip++ == 0 ? chromeUrl : exploitUrl; |
| michael@0 | 26 | }; |
| michael@0 | 27 | |
| michael@0 | 28 | var href = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(frames[1].location), "href").get; |
| michael@0 | 29 | var loadChrome = { handleEvent: href }; |
| michael@0 | 30 | var loadExploit = { handleEvent: href }; |
| michael@0 | 31 | |
| michael@0 | 32 | function delay() { |
| michael@0 | 33 | var xhr = new XMLHttpRequest(); |
| michael@0 | 34 | xhr.open("GET", location.href, false); |
| michael@0 | 35 | xhr.send(null); |
| michael@0 | 36 | } |
| michael@0 | 37 | function done() { |
| michael@0 | 38 | var event = new MessageEvent('461743', { bubbles: true, cancelable: false, |
| michael@0 | 39 | data: "done", origin: location.href, |
| michael@0 | 40 | source: window }); |
| michael@0 | 41 | document.dispatchEvent(event); |
| michael@0 | 42 | frames[0].document.removeEventListener("DOMNodeInserted", loadChrome, true); |
| michael@0 | 43 | frames[0].document.removeEventListener("DOMNodeInserted", delay, true); |
| michael@0 | 44 | frames[0].document.removeEventListener("DOMNodeInserted", loadExploit, true); |
| michael@0 | 45 | frames[0].document.removeEventListener("DOMNodeInserted", done, true); |
| michael@0 | 46 | } |
| michael@0 | 47 | |
| michael@0 | 48 | frames[0].document.addEventListener("DOMNodeInserted", loadChrome, true); |
| michael@0 | 49 | frames[0].document.addEventListener("DOMNodeInserted", delay, true); |
| michael@0 | 50 | frames[0].document.addEventListener("DOMNodeInserted", loadExploit, true); |
| michael@0 | 51 | frames[0].document.addEventListener("DOMNodeInserted", done, true); |
| michael@0 | 52 | |
| michael@0 | 53 | frames[0].document.designMode = "on"; |
| michael@0 | 54 | }; |
| michael@0 | 55 | </script> |
| michael@0 | 56 | </body> |
