|
1 /* Any copyright is dedicated to the Public Domain. |
|
2 * http://creativecommons.org/publicdomain/zero/1.0/ */ |
|
3 |
|
4 "use strict"; |
|
5 |
|
6 const URL = ROOT + "browser_466937_sample.html"; |
|
7 |
|
8 /** |
|
9 * Bug 466937 - Prevent file stealing with sessionstore. |
|
10 */ |
|
11 add_task(function test_prevent_file_stealing() { |
|
12 // Add a tab with some file input fields. |
|
13 let tab = gBrowser.addTab(URL); |
|
14 let browser = tab.linkedBrowser; |
|
15 yield promiseBrowserLoaded(browser); |
|
16 |
|
17 // Generate a path to a 'secret' file. |
|
18 let file = Services.dirsvc.get("TmpD", Ci.nsIFile); |
|
19 file.append("466937_test.file"); |
|
20 file.createUnique(Ci.nsIFile.NORMAL_FILE_TYPE, parseInt("666", 8)); |
|
21 let testPath = file.path; |
|
22 |
|
23 // Fill in form values. |
|
24 yield setInputValue(browser, {id: "reverse_thief", value: "/home/user/secret2"}); |
|
25 yield setInputValue(browser, {id: "bystander", value: testPath}); |
|
26 |
|
27 // Duplicate and check form values. |
|
28 let tab2 = gBrowser.duplicateTab(tab); |
|
29 let browser2 = tab2.linkedBrowser; |
|
30 yield promiseTabRestored(tab2); |
|
31 |
|
32 let thief = yield getInputValue(browser2, {id: "thief"}); |
|
33 is(thief, "", "file path wasn't set to text field value"); |
|
34 let reverse_thief = yield getInputValue(browser2, {id: "reverse_thief"}); |
|
35 is(reverse_thief, "", "text field value wasn't set to full file path"); |
|
36 let bystander = yield getInputValue(browser2, {id: "bystander"}); |
|
37 is(bystander, testPath, "normal case: file path was correctly preserved"); |
|
38 |
|
39 // Cleanup. |
|
40 gBrowser.removeTab(tab); |
|
41 gBrowser.removeTab(tab2); |
|
42 }); |