wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Test for bug 750096 - Make sure nsIParserUtils::parseFragment does not dereference <embed src=javascript:...>. r=bzbarsky.

Browse Source
This commit is contained in:
Henri Sivonen 2012-09-25 10:29:23 +03:00
parent 17ba1d6f11
commit 9bc15d1691
2 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
content/base/test/chrome/Makefile.in
View File

@ -40,6 +40,7 @@ MOCHITEST_CHROME_FILES = \
test_bug599295.html \
test_bug650776.html \
test_bug650784.html \
test_bug750096.html \
test_bug752226-3.xul \
test_bug752226-4.xul \
test_bug682305.html \

45
content/base/test/chrome/test_bug750096.html Normal file
View File

@ -0,0 +1,45 @@
<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=750096
-->
<head>
<meta charset="utf-8">
<title>Test for Bug 750096</title>
<script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=750096">Mozilla Bug 750096</a>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<pre id="test">
<script type="application/javascript">
/** Test for Bug 750096 **/
SimpleTest.waitForExplicitFinish();
var u = Components.interfaces.nsIParserUtils;
var s = Components.classes["@mozilla.org/parserutils;1"]
.getService(u);
var elt = document.getElementById("content");
var embed = s.parseFragment("<embed src=\'javascript:this.fail = true;\'>", 0, false, null, elt);
var img = s.parseFragment("<img src=\'javascript:this.fail = true;\'>", 0, false, null, elt);
var video = s.parseFragment("<video src=\'javascript:this.fail = true;\'></video>", 0, false, null, elt);
var object = s.parseFragment("<object data=\'javascript:this.fail = true;\'></object>", 0, false, null, elt);
var iframe = s.parseFragment("<iframe src=\'javascript:this.fail = true;\'></iframe>", 0, false, null, elt);
setTimeout(function() {
ok(!window.fail, "Should not have failed.");
SimpleTest.finish();
}, 0);
</script>
</pre>
</body>
</html>