modify-attributes-in-callback.html | Explore in Territory

<!DOCTYPE html>
<head>
  <script src="/resources/testharness.js"></script>
  <script src="/resources/testharnessreport.js"></script>
  <meta http-equiv="Content-Security-Policy"
        content="require-trusted-types-for 'script'; trusted-types *">
</head>
<body>
<iframe id="iframe" data-x="" srcdoc="content" onmouseover=""></iframe>
<div id="div"></div>
<script>
  // This is a regression test for https://g-issues.chromium.org/issues/333739948
  // The test should hold true for any browser that supports Trusted Types.

  let target = "data-x";
  trustedTypes.createPolicy("default", {
    createHTML: (s, _, sink) => {
      assert_equals(sink, 'HTMLIFrameElement srcdoc');
      iframe.removeAttribute(target);
      return s;
    },
    createScript: (s) => {
      if (s == 'accepted') {
        return s;
      }

      div.setAttribute('onmouseover', 'accepted');
      return s;
    }
  });

  test(t => {
    // Original bug report: Delete an attribute *before* the current one.
    assert_equals(iframe.srcdoc, "content");
    assert_equals(iframe.getAttribute("onmouseover"), "");
    iframe.setAttribute("srcdoc", "alert(1)");
    assert_equals(iframe.srcdoc, "alert(1)");
    assert_equals(iframe.getAttribute("onmouseover"), "");
  }, "Ensure the right attributes are modified.");

  test(t => {
    // Second case: Delete the exact attribute. It still gets set.
    target = "srcdoc";
    assert_equals(iframe.srcdoc, "alert(1)");
    iframe.setAttribute("srcdoc", "new srcdoc value");
    assert_equals(iframe.srcdoc, "new srcdoc value");
  }, "Ensure the deleted attributes is modified.");

  test(t => {
    div.toggleAttribute('onmouseover');
    assert_equals(div.attributes.length, 2);
    assert_equals(div.attributes.onmouseover.value, '');
    div.removeAttribute('onmouseover');
  }, "Ensure toggleAttribute results in an empty attribute.");

  test(t => {
    div.setAttribute('onmouseover', 'foo');
    assert_equals(div.attributes.length, 2);
    assert_equals(div.attributes.onmouseover.value, 'foo');
    div.removeAttribute('onmouseover');
  }, "Ensure setAttribute results in right attribute value.");

  test(t => {
    div.setAttributeNS(null, 'onmouseover', 'foo');
    assert_equals(div.attributes.length, 2);
    assert_equals(div.attributes.onmouseover.value, 'foo');
    div.removeAttribute('onmouseover');
  }, "Ensure setAttributeNS results in right attribute value.");

</script>
chromium/third_party/blink/web_tests/external/wpt/trusted-types/modify-attributes-in-callback.html
