chromium/third_party/blink/web_tests/fast/frames/sandboxed-iframe-forms.html

<!DOCTYPE html>
<html>
  <head>
    <script src="../../resources/testharness.js"></script>
    <script src="../../resources/testharnessreport.js"></script>
  </head>
  <body>
  </body>
  <script>
    // This test runs:
    // - Five iframes with forms allowed,
    // - One iframe with forms disallowed,
    // - Five more iframes with forms allowed.
    // If ten form submissions are made, and the disallowed submission is not
    // one of them. It means it was blocked.
    //
    // NOTE(arthursonzogni): It is not clear to me why loading the 10 iframes
    // with form allowed matter for this test. They were kept in case it was
    // done purposefully.
    async_test(test => {
      let i = 0;
      window.addEventListener("message", event => {
        assert_equals(event.data, 'form allowed');
        ++i;
        if (i == 10)
          test.done();
      });

      for(let i = 0; i<11; ++i) {
        const iframe = document.createElement("iframe");
        if (i == 5) {
          iframe.src = "resources/sandboxed-iframe-form-disallowed.html";
          iframe.sandbox = "allow-scripts allow-same-origin";
        } else {
          iframe.src = "resources/sandboxed-iframe-form-allowed.html";
          iframe.sandbox = "allow-scripts allow-forms allow-same-origin";
        }
        document.body.appendChild(iframe);
      }
    });
  </script>
</html>