-
Notifications
You must be signed in to change notification settings - Fork 70
Expand file tree
/
Copy pathsecurity.html
More file actions
110 lines (95 loc) · 3.24 KB
/
security.html
File metadata and controls
110 lines (95 loc) · 3.24 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
<html>
<head>
<meta http-equiv="Cache-control" content="public">
<meta http-equiv="Expires" content="Mon, 22 Jul 2022 11:12:01 GMT">
</head>
<style>
* { font-family: monospace; color: black }
</style>
<body>
<h1>Security tests</h1>
<script type="text/javascript" src="../js/all.js" asyc></script>
<!-- changeUrl -->
<h2>Changing url using top.window.history.pushState</h2>
<script>
function changeUrl() {
top.window.history.pushState('1Name2NXVi1RDPDgf5617UoW7xA6YrhM9F', '1Name2NXVi1RDPDgf5617UoW7xA6YrhM9F', '/1Name2NXVi1RDPDgf5617UoW7xA6YrhM9F/index.html');
}
</script>
<a href="#" onclick="changeUrl()">Test</a>
<!-- loadXsAjax -->
<h2>Load cross-site resource using ajax get</h2>
<script>
function loadXsAjax() {
$.ajax(
{"url": "/1Name2NXVi1RDPDgf5617UoW7xA6YrhM9F/content.json"}
).done(function(res) {
$("#loadXsAjax_output").text(res)
}).fail(function( jqXHR, res ) {
$("#loadXsAjax_output").text("Failed: "+res)
})
}
</script>
<a href="#" onclick="loadXsAjax()">Test</a>
<div id='loadXsAjax_output'>Result</div>
<!-- loadXsWrapperAjax -->
<h2>Load cross-site wrapper using ajax get</h2>
<script>
function loadXsWrapperAjax() {
$.ajax(
{"url": "/1Name2NXVi1RDPDgf5617UoW7xA6YrhM9F"}
).done(function(res) {
$("#loadXsWrapperAjax_output").text(res)
}).fail(function( jqXHR, res ) {
$("#loadXsWrapperAjax_output").text("Failed: "+res)
})
}
</script>
<a href="#" onclick="loadXsWrapperAjax()">Test</a>
<div id='loadXsWrapperAjax_output'>Result</div>
<!-- createXsIframe -->
<h2>Load other site resource using iframe</h2>
<script>
function createXsIframe() {
$("#createXsIframe_result").html('<iframe src="/1Name2NXVi1RDPDgf5617UoW7xA6YrhM9F/content.json" id="iframe2"></iframe>')
}
</script>
<a href="#" onclick="createXsIframe()">Test</a>
<div id='createXsIframe_result'>Result</div>
<!-- createXsWrapperIframe -->
<h2>Load other site wrapper using iframe</h2>
<script>
function createXsWrapperIframe() {
$("#createXsWrapperIframe_result").html('<iframe src="/1Name2NXVi1RDPDgf5617UoW7xA6YrhM9F" id="iframe2"></iframe>')
}
</script>
<a href="#" onclick="createXsWrapperIframe()">Test (Navigates away from site)</a>
<div id='createXsWrapperIframe_result'>Result</div>
<!-- Webworker -->
<h2>Webworkers</h2>
<script>
function createWebworker() {
// via http://www.html5rocks.com/en/tutorials/workers/basics/#toc-inlineworkers
var blob = new Blob([
"onmessage = function(e) { postMessage('msg from worker'); }"]);
var blobURL = window.URL.createObjectURL(blob);
console.log(blobURL)
var worker = new Worker(blobURL);
worker.onmessage = function(e) {
document.getElementById('webworker_result').textContent = event.data;
};
worker.postMessage("hello");
}
</script>
<a href="#" onclick="createWebworker()">Test</a>
<div id="webworker_result">Result</div>
<h2>Links</h2>
<ul>
<li><a href="security.html" id="link_to_current">Opening wrapper inner wrapper</a></li>
<li><a href="security.html" target="_top" id="link_to_top">Opening to _top</a></li>
<li><a href="security.html" target="_blank" id="link_to_blank">Opening to _blank</a></li>
<li><a href="#" onclick="window.top.location = window.location" id="inner_to_top">Opening current page to _top (should fail)</a></li>
<li><a href="../img/loading.gif" id="gif_to_current">Gif to current</a></li>
</ul>
</body>
</html>