<html>
<!--

   DOM checker - test target page
   ------------------------------

   Authors: Michal Zalewski <lcamtuf@google.com>
            Filipe Almeida <filipe@google.com>

   Copyright 2008 by Google Inc. All Rights Reserved.

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.

-->

<script src="dom_config.js"></script>

<script>

var private_var = 1;		// We'll try to set it across domains.
var ipc_page;			// IPC page location
var queue_timer;		// IPC queue handling timer
var idle = true;		// IPC handler state
var prev_hval = 'NONE';		// Previous IPC command
var idle_cycles = 0;		// Number of cycles spend in idle

/* Try to inject a variable to paren't namespace by defining a getter in
   another domain. */

try {
  top.__defineGetter__('injected_var', function() {return 1;})
} catch(e) {}


/* Update IPC frame location as needed, set timers. */
function page_init() {

  ipc_page = 'http://' + main_host + '/' + main_dir + '/dom_blank_page.html';
  document.getElementById('ipc_write').src = ipc_page + '#2';

  // log('Local ipc_write initialized to ' + ipc_page);

  queue_timer = setInterval('get_ipc_command()',250);

}


/* IPC subsystem logging (debugging purposes only) */
function log(x) {
  var e = document.createElement('li');
  e.innerHTML = x;
  document.getElementById('log').appendChild(e);
}


/* Wait for IPC state change, execute command, send results. */
function get_ipc_command() {

  var hval;

  try { hval = top.frames['ipc_read'].location.hash; } catch (e) {
    // log('IPC command read failed from external ipc_read.');
    hval = '';
  }

  if (hval == prev_hval || hval == '' || hval == undefined || hval == 'NONE') {
    if (!idle) {
      idle_cycles++;

      if (idle_cycles == 200) {
        // log('Entered power saving mode.');
        clearInterval(queue_timer);
        queue_timer = setInterval('get_ipc_command()',250);
        idle = true;
      }

    }

    return;
  }

  /* Full speed! */
  if (idle) {
    // log('Entered full speed mode.');
    clearInterval(queue_timer);
    queue_timer = setInterval('get_ipc_command()',1);
    idle = false;
    idle_cycles = 0;
  }

  // log('Got IPC command ' + hval + ' (prev: ' + prev_hval + ')');

  prev_hval = hval;

  var res = 0;

  hval = hval.substr(1);

  if (hval == 'RESET') res = 2;
  else try {
    if (eval(unescape(hval))) res = 1;
   } catch (e) {
    // log('Evaluation exception! Final was: ' + unescape(hval));
  }

  document.getElementById('ipc_write').src =  ipc_page + '#' + res;

}

</script>
<title>DOM checker victim page</title>
<body onload="page_init()">

<!-- Some bogus page elements to make it possible to enumerate arrays. -->

<style name=ns>MENU { margin: 1em }</style>

<img src="#bad" name=ni>

<form name=nf method=post action=foo>
<input type=hidden name=foo value=bar>
</form>

<h1><a href="#bad" name=nl>Hi mom!</a></h1>

<a name=ni2>

<embed name=ne></embed>

<object name=no></object>

<applet name=na></applet>

<!-- Log container -->
<div id=log>
</div>

<!-- Nested subframe used for about:blank tests -->
<iframe id=nf name=nf src="about:blank">
</iframe>

<!-- IPC frame -->
<iframe id=ipc_write name=ipc_write></iframe>