cross-origin-window-open.html | Explore in Territory

<!DOCTYPE html>
<html>
<head>
  <script src="/resources/testharness.js"></script>
  <script src="/resources/testharnessreport.js"></script>
  <script src="/security/contentSecurityPolicy/resources/cascade-helper.js"></script>
  <meta http-equiv="content-security-policy" content="img-src 'none'">
</head>
<body>
<script>
  async_test(t => {
    assert_blocked_image_in_document(t, document, "http://example.test:8000/resources/square.png?img-in-top-level");
  }, "Image loaded in top-level blocked.");

  async_test(t => {
    window.addEventListener("message", t.step_func(e => {
      assert_equals(e.data, "blocked");
      t.done();
    }));

    var win = window.open("about:blank");
    win.document.write(
        "<script>" +
        "  var i = document.createElement('img');" +
        "  i.onload = _ => opener.postMessage('loaded', '*');" +
        "  i.onerror = _ => opener.postMessage('blocked', '*');" +
        "  i.src = 'http://example.test:8000/resources/square.png?data-frame'" +
        "</scr" + "ipt>");
  }, "Image loaded via data: window blocked.");
</script>
</body>
</html>

chromium/third_party/blink/web_tests/http/tests/security/contentSecurityPolicy/cascade/cross-origin-window-open.html