sandboxed-iframe-javascript-url.html

<!DOCTYPE html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<body>
<script>
    async_test(t => {
        var i = document.createElement('iframe');
        i.setAttribute("sandbox", "allow-scripts");
        i.setAttribute("src", "javascript:top.postMessage('fail', '*');");
        window.addEventListener(
            "message",
            t.unreached_func("The sandboxed 'javascript:' URL should not execute."));

        document.body.appendChild(i);

        // TODO(mkwst): I would love a better test here, but I don't know how else to
        // verify that the script _doesn't_ execute.
        setTimeout(t.done.bind(t), 250);
    }, "JavaScript URLs in sandboxed iframes should not execute, as the origin is distinct from its opener.");
</script>

chromium/third_party/blink/web_tests/http/tests/security/sandboxed-iframe-javascript-url.html