<!DOCTYPE html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/utils.js"></script>

<meta http-equiv="Content-Security-Policy" content="img-src 'none'">
<body>
<script>
  let message_from = (source_token, starts_with) => {
    return new Promise(resolve => {
      window.addEventListener('message', msg => {
        if (msg.data.token === source_token) {
          if (!starts_with || msg.data.msg.startsWith(starts_with))
            resolve(msg.data.msg);
        }
      });
    });
  };

  const img_url = window.origin + "/content-security-policy/support/fail.png";

  const img_tag_string = img_token => `
    <img src="${img_url}"
         onload="top.postMessage(
             {msg: 'img loaded', token: '${img_token}'}, '*');"
         onerror="top.postMessage(
             {msg: 'img blocked', token: '${img_token}'}, '*');"
    >
   `;

  const html_test_payload = img_token => `
    <!doctype html>
    <script>
      function add_image() {
        let img = document.createElement('img');
        img.onload = () => top.postMessage(
            {msg: 'img loaded', token: '${img_token}'}, '*');
        img.onerror = () => top.postMessage(
            {msg: 'img blocked', token: '${img_token}'}, '*');
        img.src = '${img_url}';
        document.body.appendChild(img);
      }
    </scr`+`ipt>
    <body onpageshow="add_image();"></body>
  `;
  let blob_url = blob_token => URL.createObjectURL(
    new Blob([html_test_payload(blob_token)], { type: 'text/html' }));

  let write_img_to_about_blank = async (t, iframe, img_token) => {
    await t.step_wait(
      condition = () => {
        try {
          return iframe.contentWindow.location.href == "about:blank";
        } catch {}
        return false;
      },
      description = "Wait for the iframe to navigate.",
      timeout=6000,
      interval=50);

    let div = iframe.contentDocument.createElement('div');
    div.innerHTML = img_tag_string(img_token);
    iframe.contentDocument.body.appendChild(div);
  };

  let testCases = [
    test_token => ({
      token: test_token,
      url: "about:blank",
      add_img_function: (t, iframe) =>
          write_img_to_about_blank(t, iframe, test_token),
      other_origin: window.origin,
      name: '"about:blank" document is navigated back from history same-origin.',
    }),
    test_token => ({
      token: test_token,
      url: "about:blank",
      add_img_function: (t, iframe) =>
          write_img_to_about_blank(t, iframe, test_token),
      other_origin: "http://{{hosts[alt][]}}:{{ports[http][0]}}",
      name: '"about:blank" document is navigated back from history cross-origin.',
    }),
    test_token => ({
      token: test_token,
      url: blob_url(test_token),
      other_origin: window.origin,
      name: 'blob URL document is navigated back from history same-origin.',
    }),
    test_token => ({
      token: test_token,
      url: blob_url(test_token),
      other_origin: "http://{{hosts[alt][]}}:{{ports[http][0]}}",
      name: 'blob URL document is navigated back from history cross-origin.',
    }),
    test_token => ({
      token: test_token,
      url: `data:text/html,${html_test_payload(test_token)}`,
      other_origin: window.origin,
      name: 'data URL document is navigated back from history same-origin.',
    }),
    test_token => ({
      token: test_token,
      url: `data:text/html,${html_test_payload(test_token)}`,
      other_origin: "http://{{hosts[alt][]}}:{{ports[http][0]}}",
      name: 'data URL document is navigated back from history cross-origin.',
    }),
    test_token => ({
      token: test_token,
      srcdoc: `${html_test_payload(test_token)}`,
      other_origin: window.origin,
      name: 'srcdoc iframe is navigated back from history same-origin.',
    }),
    test_token => ({
      token: test_token,
      srcdoc: `${html_test_payload(test_token)}`,
      other_origin: "http://{{hosts[alt][]}}:{{ports[http][0]}}",
      name: 'srcdoc iframe is navigated back from history cross-origin.',
    }),
  ].map(f => f(token()));

  testCases.forEach(testCase => {
    promise_test(async t => {
      // Create an iframe.
      let iframe = document.createElement('iframe');
      document.body.appendChild(iframe);

      // Perform a real navigation in the iframe. This is needed because the
      // initial empty document is not stored in history (so there is no way of
      // navigating back to it and test history inheritance).
      const token_1 = token();
      let loaded_1 = message_from(token_1);
      iframe.contentWindow.location = testCase.other_origin +
        "/content-security-policy/inheritance/support" +
        `/postmessage-top.html?token=${token_1}`;
      assert_equals(await loaded_1, "ready",
                    "Could not navigate iframe.");

      // Navigate to the local scheme document.
      let message = message_from(testCase.token);
      if (testCase.url)
        iframe.contentWindow.location = testCase.url;
      else
        iframe.srcdoc = testCase.srcdoc;

      // If the local scheme document is "about:blank", we need to write its
      // content now.
      if (testCase.add_img_function) {
        testCase.add_img_function(t, iframe);
      }

      // Check that the local scheme document inherits CSP from the initiator.
      assert_equals(await message, "img blocked",
                    "Image should be blocked by CSP inherited from navigation initiator.");

      // Navigate to another page, which will navigate back.
      const token_2 = token();
      let loaded_2 = message_from(token_2, "ready");
      let message_2 = message_from(testCase.token, "img");
      iframe.contentWindow.location = testCase.other_origin +
        "/content-security-policy/inheritance/support" +
        `/message-top-and-navigate-back.html?token=${token_2}`;
      assert_equals(await loaded_2, "ready",
                    "Could not navigate iframe.");

      // If the local scheme document is "about:blank", we need to write its
      // content again.
      if (testCase.add_img_function) {
        testCase.add_img_function(t, iframe);
      }

      // Check that the local scheme document reloaded from history still has
      // the original CSPs.
      assert_equals(await message_2, "img blocked",
                    "Image should be blocked by CSP reloaded from history.");
    }, "History navigation in iframe: " + testCase.name);
  });
</script>
</body>
