<!DOCTYPE html>
<title>Test the 'src' attribute set in fenced frames.</title>
<meta name=variant content="?type=fencedframe">
<meta name=variant content="?type=iframe">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/utils.js"></script>
<script src="/common/dispatcher/dispatcher.js"></script>
<script src="resources/utils.js"></script>
<script src="/common/media.js"></script>
<script src="/common/get-host-info.sub.js"></script>
<body></body>
<script>
frame_builder = () => {
const params = new URLSearchParams(location.search);
if (params.get('type') === "fencedframe") {
return attachFencedFrameContext({
attributes: [["allow", "shared-storage"]]
});
} else {
return attachIFrameContext({
generator_api: "fledge",
attributes: [["allow", "shared-storage"]]
});
}
}
promise_test(async () => {
// Not specifying an allowlist for a permissions policy will default the
// allowlist to 'src', which is an allowlist unique to iframes/fencedframes
// that matches either the URL of the 'src' attribute, the mapped URL of the
// URN in the 'src' attribute, or the mapped URL of the config in the 'config'
// attribute.
const frame = await frame_builder();
await frame.execute(async () => {
assert_true(document.featurePolicy.allowsFeature("shared-storage"));
});
}, 'Src permissions policy in allow attribute.');
promise_test(async () => {
const frame = await frame_builder();
await navigateFrameContext(frame, {
origin: get_host_info().HTTPS_ORIGIN,
});
// When the fenced frame navigates itself to a same-origin page, the resulting
// document should still allow "shared-storage" since it is still same-origin to the
// original mapped URL (i.e. what 'src' is considered to be).
await frame.execute(async () => {
assert_true(document.featurePolicy.allowsFeature("shared-storage"));
});
}, 'Src permissions policy after same-origin navigation.');
promise_test(async () => {
const frame = await frame_builder();
await navigateFrameContext(frame, {
origin: get_host_info().HTTPS_REMOTE_ORIGIN,
});
// When the fenced frame navigates itself to a cross-origin page, the
// resulting document should not allow "shared-storage" since it is now cross-origin
// to the original mapped URL (i.e. what 'src' is considered to be).
await frame.execute(async () => {
assert_false(document.featurePolicy.allowsFeature("shared-storage"));
});
}, 'Src permissions policy after cross-origin navigation.');
promise_test(async () => {
const frame = await frame_builder();
await frame.execute(async () => {
const child_frame = await attachIFrameContext();
await child_frame.execute(() => {
assert_true(document.featurePolicy.allowsFeature("shared-storage"));
})
});
}, 'Src permissions policy in child iframe inheritance works properly.');
</script>
Codebase Browser
chromium