Skip to content

Commit 29c58c0

Browse files
domenicdomenic
authored
Expand X-Frame-Options tests
Follows whatwg/html#5737. Closes #21730 by incorporating all of those tests.
1 parent 4dacb6e commit 29c58c0

File tree

15 files changed

+423
-347
lines changed

15 files changed

+423
-347
lines changed

‎html/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,4 @@ For historical reasons, parts of HTML have their own directories:
1717
* [/websockets](/websockets)
1818
* [/webstorage](/webstorage)
1919
* [/workers](/workers)
20+
* [/x-frame-options](/x-frame-options)

‎x-frame-options/META.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
spec: https://tools.ietf.org/html/rfc7034
1+
spec: https://html.spec.whatwg.org/#the-x-frame-options-header
22
suggested_reviewers:
33
- annevk
44
- mikewest
5+
- domenic

‎x-frame-options/README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
1-
This directory contains tests for
2-
[HTTP Header Field X-Frame-Options](https://tools.ietf.org/html/rfc7034).
1+
This directory contains tests for [`X-Frame-Options`](https://html.spec.whatwg.org/#the-x-frame-options-header).
2+
3+
Currently it only tests `<iframe>`. It would be nice to test `<embed>` and `<object>` as well.

‎x-frame-options/deny.html‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>X-Frame-Options variations of DENY</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
<script src="./support/helper.sub.js"></script>
7+
8+
<body>
9+
<script>
10+
"use strict";
11+
12+
xfo_simple_tests({
13+
headerValue: `DENY`,
14+
sameOriginAllowed: false,
15+
crossOriginAllowed: false
16+
});
17+
18+
xfo_simple_tests({
19+
headerValue: `denY`,
20+
sameOriginAllowed: false,
21+
crossOriginAllowed: false
22+
});
23+
24+
xfo_simple_tests({
25+
headerValue: ` DENY `,
26+
sameOriginAllowed: false,
27+
crossOriginAllowed: false
28+
});
29+
30+
xfo_simple_tests({
31+
headerValue: `DENY`,
32+
cspValue: `default-src 'self'`,
33+
sameOriginAllowed: false,
34+
crossOriginAllowed: false
35+
});
36+
37+
xfo_simple_tests({
38+
headerValue: `DENY`,
39+
cspValue: `frame-ancestors 'self'`,
40+
sameOriginAllowed: true,
41+
crossOriginAllowed: false
42+
});
43+
</script>

‎x-frame-options/deny.sub.html‎

Lines changed: 0 additions & 61 deletions
This file was deleted.

‎x-frame-options/get-decode-split.html‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>X-Frame-Options headers use the get, decode, and split algorithm</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
<script src="support/helper.sub.js"></script>
7+
8+
<body>
9+
<script>
10+
"use strict";
11+
12+
xfo_simple_tests({
13+
headerValue: `,SAMEORIGIN,,DENY,`,
14+
sameOriginAllowed: false,
15+
crossOriginAllowed: false
16+
});
17+
18+
xfo_simple_tests({
19+
headerValue: ` SAMEORIGIN, DENY`,
20+
sameOriginAllowed: false,
21+
crossOriginAllowed: false
22+
});
23+
</script>

‎x-frame-options/invalid.html‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>X-Frame-Options invalid values</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
<script src="./support/helper.sub.js"></script>
7+
8+
<body>
9+
<script>
10+
"use strict";
11+
12+
xfo_simple_tests({
13+
headerValue: `INVALID`,
14+
sameOriginAllowed: true,
15+
crossOriginAllowed: true
16+
});
17+
18+
xfo_simple_tests({
19+
headerValue: `ALLOW-FROM https://example.com/`,
20+
sameOriginAllowed: true,
21+
crossOriginAllowed: true
22+
});
23+
24+
xfo_simple_tests({
25+
headerValue: `ALLOW-FROM=https://example.com/`,
26+
sameOriginAllowed: true,
27+
crossOriginAllowed: true
28+
});
29+
30+
xfo_simple_tests({
31+
headerValue: `ALLOWALL`,
32+
sameOriginAllowed: true,
33+
crossOriginAllowed: true
34+
});
35+
36+
xfo_simple_tests({
37+
headerValue: `"DENY"`,
38+
sameOriginAllowed: true,
39+
crossOriginAllowed: true
40+
});
41+
42+
xfo_simple_tests({
43+
headerValue: `"SAMEORIGIN"`,
44+
sameOriginAllowed: true,
45+
crossOriginAllowed: true
46+
});
47+
48+
xfo_simple_tests({
49+
headerValue: `"SAMEORIGIN,DENY"`,
50+
sameOriginAllowed: true,
51+
crossOriginAllowed: true
52+
});
53+
54+
xfo_simple_tests({
55+
headerValue: ``,
56+
sameOriginAllowed: true,
57+
crossOriginAllowed: true
58+
});
59+
</script>

‎x-frame-options/invalid.sub.html‎

Lines changed: 0 additions & 84 deletions
This file was deleted.

0 commit comments

Comments
 (0)