iframe-inheritance-javascript.html | Explore in Territory

<!doctype html>
<title>Referrer Policy: iframes with javascript url reuse referrer policy</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/get-host-info.sub.js"></script>
<script src="resources/make-html-script.js"></script>
<meta name="referrer" content="unsafe-url">
<div id="log"></div>
<script>

[
  {
    fetchReferrer: "",
    // Because the URL of the Document of <iframe src="javascript:..."> is
    // "about:blank", the stripped URL is no referrer:
    // https://w3c.github.io/webappsec-referrer-policy/#strip-url.
    expected: undefined
  },
  {
    fetchReferrer: location.origin+"/custom",
    // <iframe src="javascript:..."> inherits its parent's referrer policy.
    // Note: Setting an explicit URL as referrer succeeds
    // because the same-origin check at
    // https://fetch.spec.whatwg.org/#dom-request
    // is done against <iframe>'s origin, which inherits the parent
    // Document's origin == location.orgin. Furthermore, since the iframe
    // inherits its parent's referrer policy, the URL should be restricted to
    // its origin.
    expected: self.origin + "/custom"
  }
].forEach(({ fetchReferrer, expected }) => {
  promise_test(t => {
    return new Promise(resolve => {
      window.addEventListener("message", t.step_func(msg => {
        assert_equals(msg.data.referrer, expected);
        resolve();
      }), { once: true });
      const iframe = document.createElement("iframe");
      iframe.src = `javascript:'${createScriptString(get_host_info().REMOTE_ORIGIN, fetchReferrer)}'`;
      document.body.appendChild(iframe);
    });
  });
});

</script>
chromium/third_party/blink/web_tests/external/wpt/referrer-policy/generic/inheritance/iframe-inheritance-javascript.html
