Check the source browsing context's CSP in Location::SetLocation prio…

…r to dispatching a navigation to a `javascript:` URL. Makes `javascript:` navigations via window.location.href compliant with https://html.spec.whatwg.org/#navigate, which states that the source browsing context must be checked (rather than the current browsing context). Bug: 909865 Change-Id: Id6aef6eef56865e164816c67eb9fe07ea1cb1b4e Reviewed-on: https://chromium-review.googlesource.com/c/1359823 Reviewed-by: Andy Paicu <[email protected]> Reviewed-by: Mike West <[email protected]> Commit-Queue: Andrew Comminos <[email protected]> Cr-Commit-Position: refs/heads/master@{#614451}
web-platform-tests · Dec 6, 2018 · ffcb833 · ffcb833
1 parent 047734d
commit ffcb833
Showing 1 changed file with 23 additions and 0 deletions.
diff --git a/content-security-policy/navigation/to-javascript-parent-initiated-parent-csp-disallow.html b/content-security-policy/navigation/to-javascript-parent-initiated-parent-csp-disallow.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<head>
+<meta http-equiv="content-security-policy" content="script-src 'self' 'nonce-abc'">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+</head>
+<body>
+<iframe src="support/frame-with-csp.sub.html?csp=script-src%20'self'%20'unsafe-inline'"></iframe>
+<script nonce='abc'>
+  var t = async_test("Should not have executed the javascript url");
+  const iframe = document.querySelector("iframe");
+  iframe.addEventListener('load', () => {
+    window.onmessage = t.step_func(function(e) {
+      if (e.data == "executed")
+        assert_true(false, "Javascript url executed");
+    });
+    window.addEventListener('securitypolicyviolation', t.step_func_done(function(e) {
+      assert_equals(e.blockedURI, 'inline');
+    }));
+    iframe.contentWindow.location.href = 'javascript:parent.postMessage(\'executed\', \'*\')'
+  });
+</script>
+</body>