michael@0: /* Any copyright is dedicated to the public domain.
michael@0:    http://creativecommons.org/publicdomain/zero/1.0/ */
michael@0: 
michael@0: // Bug 770239 - Test that X-Frame-Options will correctly block a page inside a
michael@0: // subframe of <iframe mozbrowser>.
michael@0: "use strict";
michael@0: 
michael@0: SimpleTest.waitForExplicitFinish();
michael@0: browserElementTestHelpers.setEnabledPref(true);
michael@0: browserElementTestHelpers.addPermission();
michael@0: 
michael@0: var initialScreenshotArrayBuffer;
michael@0: 
michael@0: function arrayBuffersEqual(a, b) {
michael@0:   var x = new Int8Array(a);
michael@0:   var y = new Int8Array(b);
michael@0:   if (x.length != y.length) {
michael@0:     return false;
michael@0:   }
michael@0: 
michael@0:   for (var i = 0; i < x.length; i++) {
michael@0:     if (x[i] != y[i]) {
michael@0:       return false;
michael@0:     }
michael@0:   }
michael@0: 
michael@0:   return true;
michael@0: }
michael@0: 
michael@0: function runTest() {
michael@0:   var iframe = document.createElement('iframe');
michael@0:   SpecialPowers.wrap(iframe).mozbrowser = true;
michael@0: 
michael@0:   // Our child will create two iframes, so make sure this iframe is big enough
michael@0:   // to show both of them without scrolling, so taking a screenshot gets both
michael@0:   // frames.
michael@0:   iframe.height = '1000px';
michael@0: 
michael@0:   iframe.addEventListener('mozbrowsershowmodalprompt', function(e) {
michael@0:     switch (e.detail.message) {
michael@0:     case 'step 1':
michael@0:       // Make the page wait for us to unblock it (which we do after we finish
michael@0:       // taking the screenshot).
michael@0:       e.preventDefault();
michael@0: 
michael@0:       iframe.getScreenshot(1000, 1000).onsuccess = function(sshot) {
michael@0:         var fr = new FileReader();
michael@0:         fr.onloadend = function() {
michael@0:           initialScreenshotArrayBuffer = fr.result;
michael@0:           e.detail.unblock();
michael@0:         }
michael@0:         fr.readAsArrayBuffer(sshot.target.result);
michael@0:       };
michael@0:       break;
michael@0:     case 'step 2':
michael@0:       // The page has now attempted to load the X-Frame-Options page; take
michael@0:       // another screenshot.
michael@0:       iframe.getScreenshot(1000, 1000).onsuccess = function(sshot) {
michael@0:         var fr = new FileReader();
michael@0:         fr.onloadend = function() {
michael@0:           ok(arrayBuffersEqual(fr.result, initialScreenshotArrayBuffer),
michael@0:              "Screenshots should be identical");
michael@0:           SimpleTest.finish();
michael@0:         }
michael@0:         fr.readAsArrayBuffer(sshot.target.result);
michael@0:       };
michael@0:       break;
michael@0:     }
michael@0:   });
michael@0: 
michael@0:   document.body.appendChild(iframe);
michael@0: 
michael@0:   // Load this page from a different origin than ourselves.  This page will, in
michael@0:   // turn, load a child from mochi.test:8888, our origin, with X-Frame-Options:
michael@0:   // SAMEORIGIN.  That load should be denied.
michael@0:   iframe.src = 'http://example.com/tests/dom/browser-element/mochitest/file_browserElement_XFrameOptionsDeny.html';
michael@0: }
michael@0: 
michael@0: addEventListener('testready', runTest);