LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-javascript-url-expected.txt - Issue 19932002: Throw exceptions on all failed cross-origin access checks.

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-javascript-url-expected.txt

Issue 19932002: Throw exceptions on all failed cross-origin access checks. (Closed) Base URL: svn://svn.chromium.org/blink/trunk

Patch Set: test. Created 7 years, 5 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

« no previous file with comments | « LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-document-write-expected.txt ('k') | LayoutTests/http/tests/security/aboutBlank/xss-DENIED-set-opener-expected.txt » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
1 CONSOLE MESSAGE: Blocked a frame with origin "http://127.0.0.1:8000" from access ing a frame with origin "http://localhost:8000". Protocols, domains, and ports m ust match.	1 CONSOLE MESSAGE: line 1: Uncaught SecurityError: Blocked a frame with origin "ht tp://127.0.0.1:8000" from accessing a frame with origin "http://localhost:8000". Protocols, domains, and ports must match.

2 CONSOLE MESSAGE: line 1: Uncaught TypeError: Cannot read property 'body' of unde fined

3 This page opens a window to "", injects malicious code, and then navigates its o pener to the victim. The opened window then tries to scripts its opener after re loading itself as a javascript URL.	2 This page opens a window to "", injects malicious code, and then navigates its o pener to the victim. The opened window then tries to scripts its opener after re loading itself as a javascript URL.

4 Code injected into window:	3 Code injected into window:

5 <script>window.location = 'javascript:\'<script>function write(target, message) { target.document.body.innerHTML = message; }setTimeout(function() {write(window .opener, \\\'FAIL: XSS was allowed.\\\');}, 100);setTimeout(function() {write(wi ndow.opener.top.frames[1], \\\'SUCCESS: Window remained in original SecurityOrig in.\\\');}, 200);setTimeout(function() { if (window.testRunner) testRunner.globa lFlag = true; }, 300);<\\\/script>\''</script>	4 <script>window.location = 'javascript:\'<script>function write(target, message) { target.document.body.innerHTML = message; }setTimeout(function() {write(window .opener, \\\'FAIL: XSS was allowed.\\\');}, 100);setTimeout(function() {write(wi ndow.opener.top.frames[1], \\\'SUCCESS: Window remained in original SecurityOrig in.\\\');}, 200);setTimeout(function() { if (window.testRunner) testRunner.globa lFlag = true; }, 300);<\\\/script>\''</script>

6	5

7	6

8 --------	7 --------

9 Frame: '<!--framePath //<!--frame0-->-->'	8 Frame: '<!--framePath //<!--frame0-->-->'

10 --------	9 --------

11 This page doesn't do anything special (except signal that it has finished loadin g).	10 This page doesn't do anything special (except signal that it has finished loadin g).

12	11

13 --------	12 --------

14 Frame: '<!--framePath //<!--frame1-->-->'	13 Frame: '<!--framePath //<!--frame1-->-->'

15 --------	14 --------

16 SUCCESS: Window remained in original SecurityOrigin.	15 SUCCESS: Window remained in original SecurityOrigin.

OLD	NEW