<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Security-Policy" content="form-action 'none'">
<script>
if (window.testRunner) {
testRunner.dumpAsText();
testRunner.waitUntilDone();
testRunner.setPopupBlockingEnabled(false);
}
// Open a new window with the name matching form.target attribute below.
let w = window.open(
'http://localhost:8080/security/resources/post-done-to-opener.html',
'namedCrossSiteWindow')
Promise.all([
new Promise(resolve => {
window.addEventListener('message', msg => {
if (msg.source === w) resolve()
});
}),
new Promise(resolve =>
window.addEventListener('load', _ => resolve())),
]).then(_ => {
document.getElementById('theform').addEventListener('submit', function(e) {
console.log('submit event fired.');
});
setTimeout(function() {
document.getElementById('submit').click();
}, 0);
});
document.addEventListener('securitypolicyviolation', function(e) {
console.log('securitypolicyviolation event fired.');
console.log('securitypolicyviolation_event.documentURI=' + e.documentURI);
console.log('securitypolicyviolation_event.blockedURI=' + e.blockedURI);
console.log('securitypolicyviolation_event.violatedDirective=' + e.violatedDirective);
setTimeout(function() {
testRunner.notifyDone();
}, 0);
});
</script>
</head>
<body>
<form action='/navigation/resources/form-target.pl' id='theform'
method='post' target="namedCrossSiteWindow">
<input type='text' name='fieldname' value='fieldvalue'>
<input type='submit' id='submit' value='submit'>
</form>
<p>Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.</p>
</body>
</html>
Codebase Browser
chromium