Source code
Revision control
Copy as Markdown
Other Tools
Test Info:
- This WPT test may be referenced by the following Test IDs:
- /fetch/corb/script-html-via-cross-origin-blob-url.sub.html - WPT Dashboard Interop Dashboard
<!DOCTYPE html>
<!-- Test verifies that cross-origin blob URIs are blocked both with and
without CORB.
-->
<meta charset="utf-8">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<div id=log></div>
<script>
async_test(function(t) {
function step1_createSubframe() {
addEventListener("message", function(e) {
t.step(function() { step2_processSubframeMsg(e.data); })
});
var subframe = document.createElement("iframe")
// www1 is cross-origin, to ensure that the received blob will be cross-origin.
subframe.src = 'http://{{domains[www1]}}:{{ports[http][0]}}/fetch/corb/resources/subframe-that-posts-html-containing-blob-url-to-parent.html';
document.body.appendChild(subframe);
}
function step2_processSubframeMsg(msg) {
assert_false(msg.hasOwnProperty('error'), 'unexpected property found: "error"');
assert_equals(msg.blob_type, 'text/html');
assert_equals(msg.blob_size, 147);
// With and without CORB loading of a cross-origin blob should be blocked
// (this is verified by expecting |script.onerror|, but not |script.onload|
// below).
var script = document.createElement("script")
script.src = msg.blob_url;
script.onerror = t.step_func_done(function(){})
script.onload = t.unreached_func("Unexpected load event")
document.body.appendChild(script)
}
step1_createSubframe();
});
</script>