http/tests/security/javascriptURL/javascriptURL-in-new-iframe.html

<body>
<p>Test that a freshly created iframe's src can be set to any javascript URL.</p>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}

function test()
{
    var ifr = document.createElement("iframe");
    ifr.setAttribute("src", "javascript:parent.success(), 'PASS'");
    document.body.appendChild(ifr);

    ifr = document.createElement("iframe");
    ifr.setAttributeNS(null, "src", "javascript:parent.success(), 'PASS'");
    document.body.appendChild(ifr);

    ifr = document.createElement("iframe");
    ifr.src = "javascript:parent.success(), 'PASS'";
    document.body.appendChild(ifr);

    ifr = document.createElement("iframe");
    var attr = document.createAttribute("src");
    attr.value = "javascript:parent.success(), 'PASS'";
    ifr.setAttributeNode(attr);
    document.body.appendChild(ifr);

    ifr = document.createElement("iframe");
    attr = document.createAttribute("src");
    ifr.setAttributeNode(attr);
    attr.value = "javascript:parent.success(), 'PASS'";
    document.body.appendChild(ifr);
}

var testsLeft = 5;

function success()
{
    if (!--testsLeft) {
        document.body.replaceChild(document.createTextNode("SUCCESS"), document.getElementsByTagName("iframe")[0]);
        while (ifr = document.getElementsByTagName("iframe")[0])
            document.body.removeChild(ifr);
        if (window.testRunner)
            testRunner.notifyDone();
    }
}

test();
</script>
<body>