mirror of
https://github.com/lexmount/moli.git
synced 2026-09-25 16:01:33 +00:00
ldm0
53f790c13a
Keep request origin independent of URL resolution and referrer context, including local blob fetches and inherited or sandboxed srcdoc documents. Reject missing browser origins at the resource client boundary and retain one Request across Service Worker redirects and network fallback. Cover dispatch rejection, wire Origin/Cookie headers, memory-cache partitioning and preserved Service Worker request metadata. Validation: workspace fmt and Clippy passed; Nextest passed 17,517 tests with 13 existing skips. Renderer test debug symbols were disabled to fit available build memory; tests and debug assertions were unchanged.
51 lines
2.3 KiB
JavaScript
51 lines
2.3 KiB
JavaScript
async function(cross) {
|
|
const results = {};
|
|
const local = URL.createObjectURL(new Blob(['local']));
|
|
for (const opaque of [false, true]) {
|
|
const kind = opaque ? 'opaque' : 'inherited';
|
|
const cases = [
|
|
{name: 'relative', url: './forbidden-' + kind, mode: 'same-origin'},
|
|
{name: 'home', url: location.origin + (opaque ? '/forbidden-opaque-home' : '/allowed-home'), mode: 'same-origin'},
|
|
{name: 'redirect', url: location.origin + '/redirect-allowed?to=' + encodeURIComponent(cross + '/forbidden-redirect-' + kind), mode: 'same-origin'},
|
|
{name: 'blob', url: local, mode: 'same-origin'},
|
|
{name: 'data', url: 'data:text/plain,data', mode: 'same-origin'},
|
|
{name: 'cors', url: './cors-' + kind, mode: 'cors'},
|
|
{name: 'preflight', url: './preflight-' + kind, mode: 'cors', method: 'PUT', headers: {'X-Probe': 'yes'}}
|
|
];
|
|
const frame = document.createElement('iframe');
|
|
if (opaque) frame.setAttribute('sandbox', 'allow-scripts');
|
|
const terminal = new Promise(resolve => {
|
|
const handler = event => {
|
|
if (event.source !== frame.contentWindow || event.data.kind !== kind) return;
|
|
removeEventListener('message', handler);
|
|
resolve(event.data.results);
|
|
};
|
|
addEventListener('message', handler);
|
|
});
|
|
frame.srcdoc = `<base href='${cross}/'><script>
|
|
(async () => {
|
|
const results = {};
|
|
for (const test of ${JSON.stringify(cases)}) {
|
|
try {
|
|
results[test.name] = await (await fetch(test.url, test)).text();
|
|
} catch (error) { results[test.name] = error.name; }
|
|
}
|
|
parent.postMessage({kind: '${kind}', results}, '*');
|
|
})();
|
|
<\/script>`;
|
|
document.body.append(frame);
|
|
results[kind] = await terminal;
|
|
frame.remove();
|
|
}
|
|
URL.revokeObjectURL(local);
|
|
const base = document.createElement('base');
|
|
base.href = cross + '/';
|
|
document.head.append(base);
|
|
try {
|
|
await fetch('./forbidden-top-base', {mode: 'same-origin'});
|
|
results.topBase = 'unexpected-success';
|
|
} catch (error) { results.topBase = error.name; }
|
|
base.remove();
|
|
return JSON.stringify(results);
|
|
}
|