test_win_open_blocked.html

Enable keyboard shortcuts

<!DOCTYPE html>

<html>

<head>

  <!-- we have to allowlist the actual script that spawns the tests,

       hence the nonce.-->

  <meta http-equiv="Content-Security-Policy" content="default-src 'none';

                    script-src 'nonce-foo'; style-src 'nonce-foo'">

  <script nonce="foo" src="/tests/SimpleTest/SimpleTest.js">

  </script>

  <link nonce="foo" rel="stylesheet" type="text/css"

                    href="/tests/SimpleTest/test.css"/>

  <!-- this script block with window.open and document.open will not

       be executed, since default-src is none -->

  <script>

    let win = window.open('file_default_src_none_csp.html');

    document.open();

    document.write("<script type='application/javascript'>" +

                   "  window.opener.postMessage('document-opened', '*');" +

                   "<\/script>");

    document.close();

  </script>

  <script nonce="foo">

    SimpleTest.waitForExplicitFinish();

    SimpleTest.requestFlakyTimeout("have to test that opening a " +

                                   "new window/document has not succeeded");

    window.addEventListener("message", receiveMessage);

    let checkWindowStatus = false;

    let checkDocumentStatus = false;

    function receiveMessage(event) {

      window.removeEventListener("message", receiveMessage);

        if (event.data == "window-opened") {

          checkWindowStatus = true;

          win.close();

        if (event.data == "document-opened") {

          checkDocumentStatus = true;

          doc.close();

    setTimeout(function () {

        is(checkWindowStatus, false,

          "window shouldn't be opened");

        is(checkDocumentStatus, false,

          "document shouldn't be opened");

        SimpleTest.finish();

    }, 1500);

  </script>

</head>

<body>

</body>

</html>