file_blob_uri_blocks_modals.html

Enable keyboard shortcuts

<!DOCTYPE HTML>

<html>

<head>

  <meta charset="utf-8">

</head>

<body>

<!-- iframe loading the blob url with null origin -->

<iframe id="blobFrame"></iframe>

<script>

  // If the alert box is blocked correctly by the CSP then postMessage will

  // send the message and test passes.

  var alertScriptText = "data:text/html,<script>location=URL.createObjectURL(" +

        "new Blob(['<script>alert(document.URL);parent.parent.postMessage(" +

        "{\"test\": \"block_alert_test\", \"msg\": \"alert blocked by" +

        " CSP\"}, \"*\");<\\/script>'], {type:\"text/html\"}));<\/script>";

  document.getElementById("blobFrame").src=alertScriptText;

  try {

    var w = window.open("http://www.example.com","newwindow");

    parent.postMessage({"test": "block_window_open_test",

                               "msg": "new window not blocked by CSP"},"*");

  } catch(err) {

    parent.postMessage({"test": "block_window_open_test",

                               "msg": "window blocked by CSP"},"*");

</script>

</body>

</html>