xss-DENIED-javascript-variations.html

<html>
<head>
<script>
if (window.testRunner) {
  testRunner.dumpAsText();
  testRunner.dumpChildFrames();
}

var cases = [
  " javascript:document.write('FAIL')",
  "javascript\t:document.write('FAIL')",
  "javascript:document.write('FAIL')"
];

function runTest() {
  var a = window.frames[0];

  for (var i = 0; i < cases.length; i++) {
    try { a.location.href = cases[i]; } catch(e) {}
    try { a.location.replace(cases[i]); } catch(e) {}
    try { a.location = cases[i]; } catch(e) {}
  }
}
</script>

</head>
<body onload="runTest()">
<br>
<iframe name = 'VictimFrame' src="data:text/html,<p>Inner text should not be replaced.<p>"></iframe>

</body>
</html>

chromium/third_party/blink/web_tests/http/tests/security/xss-DENIED-javascript-variations.html