Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/http/tests/security/javascriptURL/xss-ALLOWED-from-javascript-url-to-javscript-url.html 

<html>
<body>
    <p>This tests that a javascript: URL subframe can access a child javascript: URL subframe of itself.</p>
    <iframe name="aFrame" id="aFrame" style="width: 500px; height: 300px;"></iframe>
    <script>
        if (window.testRunner) {
            testRunner.dumpAsText();
            testRunner.dumpChildFrames();
            testRunner.waitUntilDone();
        }

        var innerURL = 'javascript:\\\"<html>'
            + "<body>"
            +     '<p id=\\\\\\\"accessMe\\\\\\\">FAIL: Cross frame access from a javascript: URL was denied.</p>'
            +     "<p>Inner-inner iframe.</p>"
            + "</body>"
            + '</html>\\\"';

        var url = "javascript:\"<html>"
            + "<body>"
            +     "<iframe src='" + innerURL + "'></iframe>"
            +     "<p>Inner iframe.</p>"
            +     "<scr" + "ipt>"
            +         "var testDone = false;"
            +         "setTimeout(test, 1);"
            +         "setTimeout(function() {"
            +             "if (!testDone) {"
            +                 "alert('FAIL: Test timed out');"
            +                 "if (parent.testRunner)"
            +                     "parent.testRunner.notifyDone();"
            +             "}"
            +         "}, 2000);"
            +         "function test() {"
            +             "try {"
            +                 "if (frames[0].document.body && frames[0].document.getElementById('accessMe')) {"
            +                     "frames[0].document.getElementById('accessMe').innerHTML = 'PASS: Cross frame access from a javascript: URL was allowed!';"
            +                     "if (parent.testRunner)"
            +                         "parent.testRunner.notifyDone();"
            +                     "testDone = true;"
            +                     "return;"
            +                 "}"
            +             "} catch (e) {"
            +             "}"
            +             "setTimeout(test, 1);"
            +         "}"
            +     "</scri" + "pt>"
            + "</body>"
            + "</html>\"";

        var iframe = document.getElementById("aFrame");
        iframe.src = url;
    </script>
</body>
</html>