| <!DOCTYPE html> |
| <meta charset="utf-8"> |
| <title>The initial about:blank respects origin isolation</title> |
| <script src="/resources/testharness.js"></script> |
| <script src="/resources/testharnessreport.js"></script> |
| |
| <div id="log"></div> |
| |
| <script type="module"> |
| import { |
| insertIframe, |
| setBothDocumentDomains, |
| testSameAgentCluster, |
| testDifferentAgentClusters, |
| testOriginIsolationRestricted |
| } from "./resources/helpers.mjs"; |
| |
| promise_setup(async () => { |
| await insertAboutBlankIframe(); |
| await insertIframe("{{hosts[][www]}}"); |
| }); |
| |
| // Since the initial about:blank inherits its origin from its parent, it is |
| // same-origin with the parent, and thus cross-origin with child2. |
| testSameAgentCluster([self, 0], "parent to about:blank"); |
| testDifferentAgentClusters([0, 1], "about:blank to child2"); |
| testDifferentAgentClusters([1, 0], "child2 to about:blank"); |
| |
| testOriginIsolationRestricted(self, true, "parent"); |
| testOriginIsolationRestricted(0, true, "about:blank"); |
| testOriginIsolationRestricted(1, false, "child2"); |
| |
| async function insertAboutBlankIframe() { |
| const iframe = document.createElement("iframe"); |
| document.body.append(iframe); |
| |
| // Now use document.write() to get the child frame script in there, without |
| // actually navigating anywhere. |
| // We need to absolutize the URL to since about:blank doesn't have a base URL. |
| const scriptURL = (new URL("./resources/child-frame-script.mjs", import.meta.url)).href; |
| iframe.contentDocument.write(`<script type="module" src="${scriptURL}"></scr` + `ipt>`); |
| iframe.contentDocument.close(); |
| |
| await new Promise((resolve, reject) => { |
| // Note that since this code runs during the same event loop turn as the |
| // contentDocument.write() above, we know that the load/error events will |
| // not have been fired at this time. (The spec guarantees they are fired |
| // from queued tasks.) |
| const script = iframe.contentDocument.querySelector("script"); |
| script.onload = resolve; |
| script.onerror = () => reject( |
| new Error("Could not load the child frame script into the about:blank page") |
| ); |
| }); |
| |
| await setBothDocumentDomains(iframe.contentWindow); |
| } |
| </script> |
