gecko/content/base/test/test_x-frame-options.html

<!DOCTYPE HTML>
<html>
<head>
  <title>Test for X-Frame-Options response header</title>
  <script type="text/javascript" src="/MochiKit/packed.js"></script>
  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<p id="display"></p>
<div id="content" style="display: none">

</div>

<iframe style="width:100%;height:300px;" id="harness"></iframe>
<script class="testbody" type="text/javascript">

var path = "/tests/content/base/test/";
// contains { test_frame_id : expected_result }
var testExpectedResults = { "control1": true,
                            "control2": true,
                            "deny": false,
                            "sameorigin1": true,
                            "sameorigin2": false
                          };

var testFramesLoaded = function() {
  netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
  var harness = document.getElementById("harness");

  for (var t in testExpectedResults) {
    var frame = harness.contentDocument.getElementById(t);
    // test if frame loaded by checking for a contentDocument we can access
    test = frame.contentDocument.getElementById("test");
    is(test != null, testExpectedResults[t], "test "+t);
  }

  // call tests to check principal comparison, e.g. a document can open a window
  // to a data: or javascript: document which frames an
  // X-Frame-Options: SAMEORIGIN document and the frame should load
  testFrameInJSURI();
}

// test that a document can be framed under a javascript: URL opened by the
// same site as the frame
var testFrameInJSURI = function() {
  var html = '<iframe id="sameorigin3" src="http://mochi.test:8888/tests/content/base/test/file_x-frame-options_page.sjs?testid=sameorigin3&xfo=sameorigin"></iframe>';
  var win = window.open();
  win.onload = function() {
    var test = win.document.getElementById("sameorigin3")
              .contentDocument.getElementById("test");
    ok(test != null, "frame under javascript: URL should have loaded.");
    win.close();

    // run last test
    testFrameInDataURI();
   }
  win.location.href = "javascript:document.write('"+html+"');document.close();";
}

// test that a document can be framed under a data: URL opened by the
// same site as the frame
var testFrameInDataURI = function() {
  var html = '<iframe id="sameorigin4" src="http://mochi.test:8888/tests/content/base/test/file_x-frame-options_page.sjs?testid=sameorigin4&xfo=sameorigin"></iframe>';
  var win = window.open();
  win.onload = function() {
    var test = win.document.getElementById("sameorigin4")
              .contentDocument.getElementById("test");
    ok(test != null, "frame under data: URL should have loaded.");
    win.close();

    // finalize test
    SimpleTest.finish();
   }
  win.location.href = "data:text/html,"+html;
}

SimpleTest.waitForExplicitFinish();

// load the test harness
document.getElementById("harness").src = "file_x-frame-options_main.html";

</script>
</pre>

</body>
</html>
Bug 475530 - X-Frame-Options w/ redirect to about:blank, r=jst 2010-07-21 08:51:09 -07:00			`<!DOCTYPE HTML>`
			`<html>`
			`<head>`
			`<title>Test for X-Frame-Options response header</title>`
			`<script type="text/javascript" src="/MochiKit/packed.js"></script>`
			`<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>`
			`<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />`
			`</head>`
			`<body>`
			`<p id="display"></p>`
			`<div id="content" style="display: none">`

			`</div>`

			`<iframe style="width:100%;height:300px;" id="harness"></iframe>`
			`<script class="testbody" type="text/javascript">`

			`var path = "/tests/content/base/test/";`
			`// contains { test_frame_id : expected_result }`
			`var testExpectedResults = { "control1": true,`
			`"control2": true,`
			`"deny": false,`
			`"sameorigin1": true,`
			`"sameorigin2": false`
			`};`

			`var testFramesLoaded = function() {`
			`netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');`
			`var harness = document.getElementById("harness");`

			`for (var t in testExpectedResults) {`
			`var frame = harness.contentDocument.getElementById(t);`
			`// test if frame loaded by checking for a contentDocument we can access`
			`test = frame.contentDocument.getElementById("test");`
			`is(test != null, testExpectedResults[t], "test "+t);`
			`}`

Bug 581226 - fix assertion: DoContent returned no listener?: 'abort \|\| m_targetStreamListener', a=blocking2.0 2010-10-14 15:26:59 -07:00			`// call tests to check principal comparison, e.g. a document can open a window`
			`// to a data: or javascript: document which frames an`
			`// X-Frame-Options: SAMEORIGIN document and the frame should load`
			`testFrameInJSURI();`
			`}`

			`// test that a document can be framed under a javascript: URL opened by the`
			`// same site as the frame`
			`var testFrameInJSURI = function() {`
			`var html = '<iframe id="sameorigin3" src="http://mochi.test:8888/tests/content/base/test/file_x-frame-options_page.sjs?testid=sameorigin3&xfo=sameorigin"></iframe>';`
			`var win = window.open();`
			`win.onload = function() {`
			`var test = win.document.getElementById("sameorigin3")`
			`.contentDocument.getElementById("test");`
			`ok(test != null, "frame under javascript: URL should have loaded.");`
			`win.close();`

			`// run last test`
			`testFrameInDataURI();`
			`}`
			`win.location.href = "javascript:document.write('"+html+"');document.close();";`
			`}`

			`// test that a document can be framed under a data: URL opened by the`
			`// same site as the frame`
			`var testFrameInDataURI = function() {`
			`var html = '<iframe id="sameorigin4" src="http://mochi.test:8888/tests/content/base/test/file_x-frame-options_page.sjs?testid=sameorigin4&xfo=sameorigin"></iframe>';`
			`var win = window.open();`
			`win.onload = function() {`
			`var test = win.document.getElementById("sameorigin4")`
			`.contentDocument.getElementById("test");`
			`ok(test != null, "frame under data: URL should have loaded.");`
			`win.close();`

			`// finalize test`
			`SimpleTest.finish();`
			`}`
			`win.location.href = "data:text/html,"+html;`
Bug 475530 - X-Frame-Options w/ redirect to about:blank, r=jst 2010-07-21 08:51:09 -07:00			`}`

			`SimpleTest.waitForExplicitFinish();`

			`// load the test harness`
			`document.getElementById("harness").src = "file_x-frame-options_main.html";`

			`</script>`
			`</pre>`

			`</body>`
			`</html>`