Files
ladybird/Tests/LibWeb/Text/input/html/csp-frame-ancestors-opaque-origin.html
Tim Ledbetter 3991555439 LibWeb: Block opaque origins in CSP frame-ancestors check
This matches the behavior of other engines.
2026-02-21 12:30:48 +01:00

34 lines
1.0 KiB
HTML

<!DOCTYPE html>
<script src="../include.js"></script>
<script>
asyncTest(async (done) => {
const server = httpTestServer();
const innerURL = await server.createEcho("GET", "/csp-frame-ancestors-inner", {
status: 200,
headers: {
"Content-Type": "text/html",
"Content-Security-Policy": "frame-ancestors 'self'",
},
body: "<html><body>inner</body></html>",
});
const middleURL = await server.createEcho("GET", "/csp-frame-ancestors-middle", {
status: 200,
headers: {
"Content-Type": "text/html",
},
body: `<html><body><iframe src="${innerURL}"></iframe></body></html>`,
});
const iframe = document.createElement("iframe");
iframe.sandbox = "allow-scripts";
iframe.src = middleURL;
iframe.onload = () => {
println("PASS");
done();
};
document.body.appendChild(iframe);
});
</script>