xss-DENIED-object-element.html | Explore in Territory

<html>
<head>
<script>
if (window.testRunner) {
    testRunner.waitUntilDone();
    testRunner.dumpAsText();
}

window.onload = function()
{
    object = document.createElement("object");
    object.data = "http://localhost:8000/security/resources/innocent-victim.html";
    document.body.appendChild(object);
    object.onload = function() {
        object.onload = null;
        object.data = "javascript:alert(document.body.innerHTML)";
        object.innerHTML = "foo";

        if (window.testRunner)
            setTimeout("testRunner.notifyDone()", 50);
    }
}
</script>
</head>
<body>
There should be no alert displayed.
</body>
</html>

chromium/third_party/blink/web_tests/http/tests/security/xss-DENIED-object-element.html