Source code

Revision control

Copy as Markdown

Other Tools

Test Info:

async function test_uri(t, uri, expected) {
const object = document.createElement("object");
const promise = new Promise((resolve, reject) => {
object.onerror = e => reject(e.type);
object.onload = () => resolve("success");
object.data = uri;
document.body.append(object);
});
if (expected === "success") {
await promise;
} else {
await promise_rejects_exactly(t, expected, promise);
}
object.remove();
}
promise_test(async t => {
await test_uri(t, "about:blank", "success");
}, "about: allowed in object");
promise_test(async t => {
const blobParts = ['Hello, world!'];
const blob = new Blob(blobParts, { type: "text/html" })
await test_uri(t, URL.createObjectURL(blob), "success");
}, "blob: allowed in object");
promise_test(async t => {
await test_uri(t, "data:,Hello%2C%20World%21", "success");
}, "data: allowed in object");
promise_test(async t => {
await test_uri(t, "https://{{domains[www]}}:{{ports[https][0]}}", "success");
}, "https: allowed in object");
promise_test(async t => {
await test_uri(t, "http://{{domains[www]}}:{{ports[http][0]}}", "success");
}, "http: allowed in object");
promise_test(async t => {
await test_uri(t, "javascript:'x'", "error");
}, "javascript: scheme not allowed in object");