browser/components/sessionstore/test/browser_464620_b.html@6474c204b198 (annotated)
browser/components/sessionstore/test/browser_464620_b.html
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rw-r--r--
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
| michael@0 | 1 | <!-- Testcase originally by <moz_bug_r_a4@yahoo.com> --> |
| michael@0 | 2 | |
| michael@0 | 3 | <title>Test for bug 464620 (injection on DOM node insertion)</title> |
| michael@0 | 4 | |
| michael@0 | 5 | <iframe></iframe> |
| michael@0 | 6 | <iframe></iframe> |
| michael@0 | 7 | <iframe onload="setup()"></iframe> |
| michael@0 | 8 | |
| michael@0 | 9 | <script> |
| michael@0 | 10 | var targetUrl = "http://mochi.test:8888/browser/" + |
| michael@0 | 11 | "browser/components/sessionstore/test/browser_464620_xd.html"; |
| michael@0 | 12 | var firstPass; |
| michael@0 | 13 | |
| michael@0 | 14 | function setup() { |
| michael@0 | 15 | if (firstPass !== undefined) |
| michael@0 | 16 | return; |
| michael@0 | 17 | firstPass = frames[2].location.href == "about:blank"; |
| michael@0 | 18 | if (firstPass) { |
| michael@0 | 19 | frames[0].location = 'data:text/html;charset=utf-8,<body onload="parent.step()">a</body>'; |
| michael@0 | 20 | frames[1].location = 'data:text/html;charset=utf-8,<body onload="document.designMode=\'on\';">XXX</body>'; |
| michael@0 | 21 | } |
| michael@0 | 22 | frames[2].location = targetUrl; |
| michael@0 | 23 | } |
| michael@0 | 24 | |
| michael@0 | 25 | function step() { |
| michael@0 | 26 | frames[0].document.designMode = "on"; |
| michael@0 | 27 | if (firstPass) |
| michael@0 | 28 | return; |
| michael@0 | 29 | |
| michael@0 | 30 | var body = frames[0].document.body; |
| michael@0 | 31 | body.addEventListener("DOMNodeInserted", function() { |
| michael@0 | 32 | body.removeEventListener("DOMNodeInserted", arguments.callee, true); |
| michael@0 | 33 | xss(); |
| michael@0 | 34 | }, true); |
| michael@0 | 35 | } |
| michael@0 | 36 | |
| michael@0 | 37 | function xss() { |
| michael@0 | 38 | var documentInjected = false; |
| michael@0 | 39 | document.getElementsByTagName("iframe")[1].onload = |
| michael@0 | 40 | function() { documentInjected = true; }; |
| michael@0 | 41 | frames[1].location = targetUrl; |
| michael@0 | 42 | |
| michael@0 | 43 | for (var c = 0; !documentInjected && c < 20; c++) { |
| michael@0 | 44 | var r = new XMLHttpRequest(); |
| michael@0 | 45 | r.open("GET", location.href, false); |
| michael@0 | 46 | r.overrideMimeType("text/plain"); |
| michael@0 | 47 | r.send(null); |
| michael@0 | 48 | } |
| michael@0 | 49 | document.getElementById("state").textContent = "done"; |
| michael@0 | 50 | |
| michael@0 | 51 | var event = new MessageEvent('464620_b', { bubbles: true, cancelable: false, |
| michael@0 | 52 | data: "done", origin: location.href, |
| michael@0 | 53 | source: window }); |
| michael@0 | 54 | document.dispatchEvent(event); |
| michael@0 | 55 | } |
| michael@0 | 56 | </script> |
| michael@0 | 57 | |
| michael@0 | 58 | <p id="state">pending</p> |
