|
| 1 | +<!DOCTYPE html> |
| 2 | +<html> |
| 3 | + <head> |
| 4 | + <meta charset="utf-8" /> |
| 5 | + <script src="/resources/testharness.js"></script> |
| 6 | + <script src="/resources/testharnessreport.js"></script> |
| 7 | + </head> |
| 8 | + <body> |
| 9 | + <script> |
| 10 | + const iframeSrcdoc = ` |
| 11 | + <!DOCTYPE html> |
| 12 | + <head> |
| 13 | + <meta charset="utf-8"> |
| 14 | + <meta |
| 15 | + http-equiv="Content-Security-Policy" |
| 16 | + content="require-trusted-types-for 'script'" |
| 17 | + /> |
| 18 | + </head> |
| 19 | + <body> |
| 20 | + <div id="nonSVGTestElements"> |
| 21 | + <iframe id="iframe.srcdoc" srcdoc="v"></iframe> |
| 22 | + <script id="script.src" src="v"><\/script> |
| 23 | + </div> |
| 24 | + <svg id="svgTestElements"> |
| 25 | + <script id="script.href" href="v"><\/script> |
| 26 | + <script id="script.xlink:href" xlink:href="v"><\/script> |
| 27 | + </svg> |
| 28 | + </body>`; |
| 29 | + |
| 30 | + const testCases = [ |
| 31 | + ['iframe', 'srcdoc'], |
| 32 | + ['script', 'src'], |
| 33 | + ['script', 'href'], |
| 34 | + ['script', 'xlink:href'], |
| 35 | + ]; |
| 36 | + |
| 37 | + const sourceFrame = document.createElement("iframe"); |
| 38 | + sourceFrame.srcdoc = iframeSrcdoc; |
| 39 | + document.body.append(sourceFrame); |
| 40 | + |
| 41 | + sourceFrame.addEventListener("load", () => { |
| 42 | + testCases.forEach(testCase => { |
| 43 | + async_test(t => { |
| 44 | + t.step_func_done(() => { |
| 45 | + const elementId = testCase.join("."); |
| 46 | + const sourceElement = |
| 47 | + sourceFrame.contentWindow.document.getElementById(elementId); |
| 48 | + const sourceAttr = sourceElement.getAttributeNode(testCase[1]); |
| 49 | + sourceElement.removeAttributeNode(sourceAttr); |
| 50 | + |
| 51 | + document.body.append(sourceElement); |
| 52 | + // Now `sourceElement`'s node document's global should belong to |
| 53 | + // a non-TT realm. |
| 54 | + // Hence, below calls of `setAttributeNode` and `setAttributeNS` |
| 55 | + // should not throw. |
| 56 | + // See the analogous test |
| 57 | + // <Element-setAttribute-respects-Elements-node-documents-globals-CSP-after-adoption-from-TT-realm.html> |
| 58 | + // for details about the relevant specs. |
| 59 | + |
| 60 | + sourceElement.setAttributeNode(sourceAttr); |
| 61 | + sourceElement.setAttributeNS(sourceAttr.namespaceURI, |
| 62 | + sourceAttr.name, sourceAttr.value); |
| 63 | + |
| 64 | + assert_true(true, |
| 65 | + "Neither `setAttributeNode` nor `setAttributeNS` threw"); |
| 66 | + })(); |
| 67 | + }, `Trusted types are not enforced for setAttributeNode and |
| 68 | + setAttributeNS after moving the target node from a TT-realm to a |
| 69 | + non-TT realm for ${testCase[0]}.${testCase[1]}`); |
| 70 | + }); |
| 71 | + }); |
| 72 | + </script> |
| 73 | + </body> |
| 74 | +</html> |
0 commit comments