browser/components/sessionstore/test/browser_464620_b.html@6474c204b198
browser/components/sessionstore/test/browser_464620_b.html
Wed, 31 Dec 2014 06:09:35 +0100
- author
- Michael Schloh von Bennewitz <michael@schloh.com>
- date
- Wed, 31 Dec 2014 06:09:35 +0100
- changeset 0
- 6474c204b198
- permissions
- -rw-r--r--
Cloned upstream origin tor-browser at tor-browser-31.3.0esr-4.5-1-build1
revision ID fc1c9ff7c1b2defdbc039f12214767608f46423f for hacking purpose.
1 <!-- Testcase originally by <moz_bug_r_a4@yahoo.com> -->
3 <title>Test for bug 464620 (injection on DOM node insertion)</title>
5 <iframe></iframe>
6 <iframe></iframe>
7 <iframe onload="setup()"></iframe>
9 <script>
10 var targetUrl = "http://mochi.test:8888/browser/" +
11 "browser/components/sessionstore/test/browser_464620_xd.html";
12 var firstPass;
14 function setup() {
15 if (firstPass !== undefined)
16 return;
17 firstPass = frames[2].location.href == "about:blank";
18 if (firstPass) {
19 frames[0].location = 'data:text/html;charset=utf-8,<body onload="parent.step()">a</body>';
20 frames[1].location = 'data:text/html;charset=utf-8,<body onload="document.designMode=\'on\';">XXX</body>';
21 }
22 frames[2].location = targetUrl;
23 }
25 function step() {
26 frames[0].document.designMode = "on";
27 if (firstPass)
28 return;
30 var body = frames[0].document.body;
31 body.addEventListener("DOMNodeInserted", function() {
32 body.removeEventListener("DOMNodeInserted", arguments.callee, true);
33 xss();
34 }, true);
35 }
37 function xss() {
38 var documentInjected = false;
39 document.getElementsByTagName("iframe")[1].onload =
40 function() { documentInjected = true; };
41 frames[1].location = targetUrl;
43 for (var c = 0; !documentInjected && c < 20; c++) {
44 var r = new XMLHttpRequest();
45 r.open("GET", location.href, false);
46 r.overrideMimeType("text/plain");
47 r.send(null);
48 }
49 document.getElementById("state").textContent = "done";
51 var event = new MessageEvent('464620_b', { bubbles: true, cancelable: false,
52 data: "done", origin: location.href,
53 source: window });
54 document.dispatchEvent(event);
55 }
56 </script>
58 <p id="state">pending</p>
