mirror of
https://github.com/LadybirdBrowser/ladybird.git
synced 2025-07-26 18:59:35 +00:00
38765fd617
Opaque origins are meant to be unique in terms of equality from one another. Since this uniqueness needs to be across processes, use a nonce to implement the uniqueness check.
36 lines
1.2 KiB
HTML
36 lines
1.2 KiB
HTML
<!DOCTYPE html>
|
|
<script src="../include.js"></script>
|
|
<body>
|
|
<iframe id="iframeOuter"></iframe>
|
|
|
|
<script>
|
|
asyncTest(async done => {
|
|
const iframeOuter = document.getElementById('iframeOuter');
|
|
|
|
window.addEventListener('message', (event) => {
|
|
println(event.data);
|
|
done();
|
|
});
|
|
|
|
// Data URLs result in the iframes having an opaque origin, resulting in cross origin access.
|
|
const iframeOuterContent = `
|
|
<iframe id="iframeInner" src="data:text/html,<p>Iframe 1 content</p>" style="width: 300px; height: 100px;"></iframe>
|
|
|
|
<script>
|
|
const iframeInner = document.getElementById('iframeInner');
|
|
|
|
iframeInner.onload = () => {
|
|
try {
|
|
iframeInner.contentWindow.parent.frames[0].thing;
|
|
} catch (e) {
|
|
window.top.postMessage(e.message, '*');
|
|
}
|
|
}
|
|
|
|
<\/script>
|
|
`;
|
|
|
|
iframeOuter.src = 'data:text/html,' + encodeURIComponent(iframeOuterContent);
|
|
})
|
|
</script>
|
|
</body>
|