ladybird/Tests/LibWeb/Text/input/HTML/MessagePort-MessageEvents-should-be-trusted.html
Luke Wilde 079c28d5e6 LibWeb: Make MessageEvents from {Window,MessagePort}.postMessage trusted
The MessagePort one in particular is required by Cloudflare Turnstile,
as the method it takes to run JS in a worker is to `eval` the contents
of `MessageEvent.data`. However, it will only do this if
`MessageEvent.isTrusted` is true, `MessageEvent.origin` is the empty
string and `MessageEvent.source` is `null`.

The Window version is a quick fix whilst in the vicinity, as its
MessageEvent should also be trusted.
2024-11-15 18:50:08 +01:00

29 lines
899 B
HTML

<!DOCTYPE html>
<script src="../include.js"></script>
<script>
asyncTest((done) => {
const workerJs = `
self.onmessage = (messageEvent) => {
if (messageEvent.isTrusted && messageEvent.origin === '' && messageEvent.source === null) {
self.postMessage(messageEvent.data + "pong");
}
};
`;
const workerJsBlob = new Blob([workerJs], {
type: "text/javascript",
});
const workerJsUrl = URL.createObjectURL(workerJsBlob);
const worker = new Worker(workerJsUrl);
worker.onmessage = (messageEvent) => {
if (messageEvent.isTrusted && messageEvent.origin === '' && messageEvent.source === null) {
println(messageEvent.data);
done();
}
};
worker.postMessage("ping\n");
});
</script>