http/tests/security/javascriptURL/xss-ALLOWED-to-javascript-url-window-open.html

<html>
<head>
    <script src="../resources/cross-frame-access.js"></script>
    <script>
        var openedWindow;

        window.onload = function()
        {
            if (window.testRunner) {
                testRunner.dumpAsText();
                testRunner.waitUntilDone();
                testRunner.setCanOpenWindows();
            }

            var url = "javascript:\"<html><head><scr" + "ipt>window.onload = function() { if (window.testRunner) testRunner.globalFlag = true; }</scr" + "ipt></head><body><p>Opened Frame</p><p id='accessMe'>FAIL</p></body></html>\"";
            openedWindow = window.open(url);

            if (window.testRunner) {
                setTimeout(pollForTest, 1);
            } else {
                log("To run the test, click the button below when the opened window finishes loading.");
                var button = document.createElement("button");
                button.appendChild(document.createTextNode("Run Test"));
                button.onclick = runTest;
                document.body.appendChild(button);
            }

        }

        pollForTest = function()
        {
            if (!testRunner.globalFlag) {
                setTimeout(pollForTest, 1);
                return;
            }
            runTest();
            closeWindowAndNotifyDone(openedWindow);
        }

        runTest = function()
        {
            try {
                openedWindow.document.getElementById('accessMe').innerHTML = "PASS: Access to a window opened with a javascript: URL was allowed!";
                log("PASS: Access to a window opened with a javascript: URL was allowed!");
            } catch (e) {
                log("FAIL: Access to a window opened with a javascript: URL was denied.");
            }
        }
    </script>
</head>
<body>
    <p>Opener Frame</p>
    <pre id="console"></pre>
</body>
</html>