Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/http/tests/security/postMessage/invalid-origin-throws-exception.html 

<!DOCTYPE html>
<html>
<head>
<script src="resources/recv.js"></script>
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    // We have different console output in --site-per-process mode. See https://crbug.com/614413.
    testRunner.setDumpConsoleMessages(false);
    testRunner.waitUntilDone();
}
 
addEventListener("message", recv, false);

function tryPostMessage(origin) {
  try {
    win.postMessage("Trying origin=" + origin, origin);
    document.getElementById("result").innerHTML += "<br>Posted message to '" + origin + "' without any exceptions.";
  } catch(ex) {
    document.getElementById("result").innerHTML += "<br>Encountered exception \"" + ex + "\" while posting message to '" + origin + "'.";
  }
}

function test() {
    var iframe = document.getElementById('child');
    win = iframe.contentWindow;

    // Non-URLs should fail with a syntax error.
    tryPostMessage("");
    tryPostMessage("asdf");
    tryPostMessage("/tmp/foo");
    tryPostMessage("//localhost");

    // URLs without an origin should fail without generating any errors.
    tryPostMessage("asdf:");
    tryPostMessage("http:");
    
    win.postMessage('done', '*');
}
</script>
<body>
<div>window.location.href = <script>document.write(window.location.href);</script></div>
<div id="result">waiting...</div>
<div><iframe src="http://localhost:8000/security/postMessage/resources/post-message-listener.html" onload="test()"
  id="child" width="800" height="300" style="border: 1px solid black;">
</iframe></div>
</body>
</html>