| <!DOCTYPE html> |
| <title>Test the 'src' attribute set in fenced frames.</title> |
| <meta name=variant content="?type=fencedframe"> |
| <meta name=variant content="?type=iframe"> |
| <script src="/resources/testharness.js"></script> |
| <script src="/resources/testharnessreport.js"></script> |
| <script src="/common/utils.js"></script> |
| <script src="/common/dispatcher/dispatcher.js"></script> |
| <script src="resources/utils.js"></script> |
| <script src="/common/media.js"></script> |
| <script src="/common/get-host-info.sub.js"></script> |
| |
| <body></body> |
| <script> |
| frame_builder = () => { |
| const params = new URLSearchParams(location.search); |
| if (params.get('type') === "fencedframe") { |
| return attachFencedFrameContext({ |
| attributes: [["allow", "shared-storage"]] |
| }); |
| } else { |
| return attachIFrameContext({ |
| generator_api: "fledge", |
| attributes: [["allow", "shared-storage"]] |
| }); |
| } |
| } |
| |
| promise_test(async () => { |
| // Not specifying an allowlist for a permissions policy will default the |
| // allowlist to 'src', which is an allowlist unique to iframes/fencedframes |
| // that matches either the URL of the 'src' attribute, the mapped URL of the |
| // URN in the 'src' attribute, or the mapped URL of the config in the 'config' |
| // attribute. |
| const frame = await frame_builder(); |
| await frame.execute(async () => { |
| assert_true(document.featurePolicy.allowsFeature("shared-storage")); |
| }); |
| }, 'Src permissions policy in allow attribute.'); |
| |
| promise_test(async () => { |
| const frame = await frame_builder(); |
| await navigateFrameContext(frame, { |
| origin: get_host_info().HTTPS_ORIGIN, |
| }); |
| // When the fenced frame navigates itself to a same-origin page, the resulting |
| // document should still allow "shared-storage" since it is still same-origin to the |
| // original mapped URL (i.e. what 'src' is considered to be). |
| await frame.execute(async () => { |
| assert_true(document.featurePolicy.allowsFeature("shared-storage")); |
| }); |
| }, 'Src permissions policy after same-origin navigation.'); |
| |
| promise_test(async () => { |
| const frame = await frame_builder(); |
| await navigateFrameContext(frame, { |
| origin: get_host_info().HTTPS_REMOTE_ORIGIN, |
| }); |
| // When the fenced frame navigates itself to a cross-origin page, the |
| // resulting document should not allow "shared-storage" since it is now cross-origin |
| // to the original mapped URL (i.e. what 'src' is considered to be). |
| await frame.execute(async () => { |
| assert_false(document.featurePolicy.allowsFeature("shared-storage")); |
| }); |
| }, 'Src permissions policy after cross-origin navigation.'); |
| |
| promise_test(async () => { |
| const frame = await frame_builder(); |
| await frame.execute(async () => { |
| const child_frame = await attachIFrameContext(); |
| await child_frame.execute(() => { |
| assert_true(document.featurePolicy.allowsFeature("shared-storage")); |
| }) |
| }); |
| }, 'Src permissions policy in child iframe inheritance works properly.'); |
| </script> |
