browser/components/sessionstore/test/browser_464620_a.html@6474c204b198 (annotated)
browser/components/sessionstore/test/browser_464620_a.html
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rw-r--r--
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
| michael@0 | 1 | <!-- Testcase originally by <moz_bug_r_a4@yahoo.com> --> |
| michael@0 | 2 | |
| michael@0 | 3 | <title>Test for bug 464620 (injection on input)</title> |
| michael@0 | 4 | |
| michael@0 | 5 | <iframe></iframe> |
| michael@0 | 6 | <iframe onload="setup()"></iframe> |
| michael@0 | 7 | |
| michael@0 | 8 | <script> |
| michael@0 | 9 | var targetUrl = "http://mochi.test:8888/browser/" + |
| michael@0 | 10 | "browser/components/sessionstore/test/browser_464620_xd.html"; |
| michael@0 | 11 | var firstPass; |
| michael@0 | 12 | |
| michael@0 | 13 | function setup() { |
| michael@0 | 14 | if (firstPass !== undefined) |
| michael@0 | 15 | return; |
| michael@0 | 16 | firstPass = frames[1].location.href == "about:blank"; |
| michael@0 | 17 | if (firstPass) { |
| michael@0 | 18 | frames[0].location = 'data:text/html;charset=utf-8,<body onload="if (parent.firstPass) parent.step();"><input id="x" oninput="parent.xss()">XXX</body>'; |
| michael@0 | 19 | } |
| michael@0 | 20 | frames[1].location = targetUrl; |
| michael@0 | 21 | } |
| michael@0 | 22 | |
| michael@0 | 23 | function step() { |
| michael@0 | 24 | var x = frames[0].document.getElementById("x"); |
| michael@0 | 25 | if (x.value == "") |
| michael@0 | 26 | x.value = "ready"; |
| michael@0 | 27 | x.style.display = "none"; |
| michael@0 | 28 | frames[0].document.designMode = "on"; |
| michael@0 | 29 | } |
| michael@0 | 30 | |
| michael@0 | 31 | function xss() { |
| michael@0 | 32 | step(); |
| michael@0 | 33 | |
| michael@0 | 34 | var documentInjected = false; |
| michael@0 | 35 | document.getElementsByTagName("iframe")[0].onload = |
| michael@0 | 36 | function() { documentInjected = true; }; |
| michael@0 | 37 | frames[0].location = targetUrl; |
| michael@0 | 38 | |
| michael@0 | 39 | for (var c = 0; !documentInjected && c < 20; c++) { |
| michael@0 | 40 | var r = new XMLHttpRequest(); |
| michael@0 | 41 | r.open("GET", location.href, false); |
| michael@0 | 42 | r.overrideMimeType("text/plain"); |
| michael@0 | 43 | r.send(null); |
| michael@0 | 44 | } |
| michael@0 | 45 | document.getElementById("state").textContent = "done"; |
| michael@0 | 46 | |
| michael@0 | 47 | var event = new MessageEvent('464620_a', { bubbles: true, cancelable: false, |
| michael@0 | 48 | data: "done", origin: location.href, |
| michael@0 | 49 | source: window }); |
| michael@0 | 50 | document.dispatchEvent(event); |
| michael@0 | 51 | } |
| michael@0 | 52 | </script> |
| michael@0 | 53 | |
| michael@0 | 54 | <p id="state">pending</p> |
