| Index: chrome/test/data/extensions/api_test/webstore_private/noframe2.html
|
| ===================================================================
|
| --- chrome/test/data/extensions/api_test/webstore_private/noframe2.html (revision 0)
|
| +++ chrome/test/data/extensions/api_test/webstore_private/noframe2.html (revision 0)
|
| @@ -0,0 +1,47 @@
|
| +<!DOCTYPE html>
|
| +<body onload="dropFrame()">
|
| +This represents not an extension, but an HTML page within an untrusted
|
| +origin (127.0.0.1).
|
| +<script>
|
| +var interval_id = -1;
|
| +var check_count = 0;
|
| +function dropFrame() {
|
| + var s = location.href.toString();
|
| + if (s.indexOf('127.0.0.1') > 0) {
|
| + // try to frame a copy of an error page from the webstore origin, but
|
| + // not under the webstore root directory. The server does not send
|
| + // an x-frame-options header for the error page.
|
| + var f = document.createElement('iframe');
|
| + s = s.replace('127.0.0.1', 'www.example.com');
|
| + s = s.replace('/files/', '/nonesuch/');
|
| + f.src = s;
|
| + f.onload = checkFrame;
|
| + f.onerror = checkFrame;
|
| + document.body.appendChild(f);
|
| + // There's an open issue in WK where neither onload or onerror fires
|
| + // when interrupted by XFO, so use a setInterval() workaround. Remove
|
| + // this workaround when resolved, but in the mean time, mark the test
|
| + // FLAKY, because there is no reason to believe the server will respond
|
| + // within the time frame.
|
| + interval_id = setInterval("checkFrame()", 500);
|
| + }
|
| +}
|
| +
|
| +function checkFrame() {
|
| + try {
|
| + // If the frame was blocked, we instead have an about:blank frame which we
|
| + // can access.
|
| + x = window.frames[0].document.location.href;
|
| + document.title = 'PASS: ' + x;
|
| + clearInterval(interval_id);
|
| + }
|
| + catch (e) {
|
| + // Frame was not yet blocked, so we have no access.
|
| + if (++check_count > 40) {
|
| + document.title = 'FAIL';
|
| + clearInterval(interval_id);
|
| + }
|
| + }
|
| +}
|
| +</script>
|
| +</html>
|
|
|
| Property changes on: chrome/test/data/extensions/api_test/webstore_private/noframe2.html
|
| ___________________________________________________________________
|
| Added: svn:eol-style
|
| + LF
|
|
|
|
|
Chromium Code Reviews
Issue 10959032:
Protect the entire webstore origin, not just the webstore path, with XFO. Follow-up to crrev.com/1… (Closed)
Base URL: svn://svn.chromium.org/chrome/trunk/src/