The Tor Browser / file comparison
comparison: browser/components/sessionstore/test/browser_464620_b.html
browser/components/sessionstore/test/browser_464620_b.html
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:5f11b29b9761 |
|---|---|
| 1 <!-- Testcase originally by <moz_bug_r_a4@yahoo.com> --> | |
| 2 | |
| 3 <title>Test for bug 464620 (injection on DOM node insertion)</title> | |
| 4 | |
| 5 <iframe></iframe> | |
| 6 <iframe></iframe> | |
| 7 <iframe onload="setup()"></iframe> | |
| 8 | |
| 9 <script> | |
| 10 var targetUrl = "http://mochi.test:8888/browser/" + | |
| 11 "browser/components/sessionstore/test/browser_464620_xd.html"; | |
| 12 var firstPass; | |
| 13 | |
| 14 function setup() { | |
| 15 if (firstPass !== undefined) | |
| 16 return; | |
| 17 firstPass = frames[2].location.href == "about:blank"; | |
| 18 if (firstPass) { | |
| 19 frames[0].location = 'data:text/html;charset=utf-8,<body onload="parent.step()">a</body>'; | |
| 20 frames[1].location = 'data:text/html;charset=utf-8,<body onload="document.designMode=\'on\';">XXX</body>'; | |
| 21 } | |
| 22 frames[2].location = targetUrl; | |
| 23 } | |
| 24 | |
| 25 function step() { | |
| 26 frames[0].document.designMode = "on"; | |
| 27 if (firstPass) | |
| 28 return; | |
| 29 | |
| 30 var body = frames[0].document.body; | |
| 31 body.addEventListener("DOMNodeInserted", function() { | |
| 32 body.removeEventListener("DOMNodeInserted", arguments.callee, true); | |
| 33 xss(); | |
| 34 }, true); | |
| 35 } | |
| 36 | |
| 37 function xss() { | |
| 38 var documentInjected = false; | |
| 39 document.getElementsByTagName("iframe")[1].onload = | |
| 40 function() { documentInjected = true; }; | |
| 41 frames[1].location = targetUrl; | |
| 42 | |
| 43 for (var c = 0; !documentInjected && c < 20; c++) { | |
| 44 var r = new XMLHttpRequest(); | |
| 45 r.open("GET", location.href, false); | |
| 46 r.overrideMimeType("text/plain"); | |
| 47 r.send(null); | |
| 48 } | |
| 49 document.getElementById("state").textContent = "done"; | |
| 50 | |
| 51 var event = new MessageEvent('464620_b', { bubbles: true, cancelable: false, | |
| 52 data: "done", origin: location.href, | |
| 53 source: window }); | |
| 54 document.dispatchEvent(event); | |
| 55 } | |
| 56 </script> | |
| 57 | |
| 58 <p id="state">pending</p> |
