xss-DENIED-from-data-url-sub-frame-to-data-url-sub-frame.html

<html>
<head>
    <script src="../resources/cross-frame-access.js"></script>
    <script>
        var subFramesLoaded = 0;
        if (window.testRunner) {
            testRunner.dumpAsText();
            testRunner.dumpChildFrames();
            testRunner.waitUntilDone();
        }

        function startTestWhenReady() {
            if (++subFramesLoaded == 2)
                document.getElementById('secondSubFrame').contentWindow.postMessage('perform test', '*');
        }

        function loaded() {
            var firstURL = "data:text/html,<html>"
                + "<body>"
                +     "<p>Inner iframe.</p>"
                +     "<p id='accessMe'>Pass: Cross frame access from a sibling data: URL was denied.</p>"
                + "</body>"
                + "</html>";

            var iframe = document.getElementById("firstSubFrame");
            iframe.onload = startTestWhenReady;
            iframe.src = firstURL;

            var secondURL = "data:text/html,<html>"
                + "<head>"
                +     "<scr" + "ipt>"
                +         "function loaded() {"
                +             "window.addEventListener('message', performTest);"
                +         "}"
                +         "function performTest() {"
                +             "try {"
                +                 "parent.frames['firstSubFrame'].document.getElementById('accessMe').innerHTML = 'FAIL: Cross frame access from a sibling data: URL was allowed.';"
                +             "} catch (e) {"
                +             "}"
                +             "if (window.testRunner)"
                +                 "testRunner.notifyDone();"
                +         "}"
                +     "</scr" + "ipt>"
                + "</head>"
                + "<body onload=\"loaded();\">"
                +     "<p>Inner iframe.</p>"
                +     "<pre id='console'></pre>"
                + "</body>"
                + "</html>";

            iframe = document.getElementById("secondSubFrame");
            iframe.onload = startTestWhenReady;
            iframe.src = secondURL;
        }
    </script>
</head>
<body onload="loaded();">
    <p>This tests that a data: URL subframe can't access a sibling data: URL subframe.</p>
    <iframe id="firstSubFrame" name="firstSubFrame"></iframe>
    <iframe id="secondSubFrame" name="secondSubFrame"></iframe>
</body>
</html>
chromium/third_party/blink/web_tests/http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-to-data-url-sub-frame.html
