<!DOCTYPE html>
<meta charset="utf-8">
<title>javascript: URL security check</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>

<body>
<script>
"use strict";

const cases = [
  ["cross-origin", "http://{{hosts[][www]}}:{{ports[http][0]}}/common/blank.html"],
  ["cross-origin-domain but same-origin", "/html/browsers/windows/resources/document-domain-setter.html"]
];

for (const [description, url] of cases) {
  promise_test(async t => {
    const iframe = await insertIframe(t, url);

    const unreached = t.unreached_func("message event fired");
    t.add_cleanup(() => window.removeEventListener("message", unreached));
    window.addEventListener("message", unreached);

    iframe.src = `javascript:parent.postMessage("boo", "*")`;

    // If no message was received after this time, the test passes.
    await new Promise(r => t.step_timeout(r, 50));
  }, `${description}, setting src`);

  promise_test(async t => {
    const iframe = await insertIframe(t, url);

    const unreached = t.unreached_func("message event fired");
    t.add_cleanup(() => window.removeEventListener("message", unreached));
    window.addEventListener("message", unreached);

    iframe.contentWindow.location.href = `javascript:parent.postMessage("boo", "*")`;

    // If no message was received after this time, the test passes.
    await new Promise(r => t.step_timeout(r, 50));
  }, `${description}, setting location.href`);
}

function insertIframe(t, url) {
  return new Promise((resolve, reject) => {
    const iframe = document.createElement("iframe");
    iframe.src = url;
    iframe.onload = () => resolve(iframe);
    iframe.onerror = () => reject(new Error("Failed to load the outer iframe"));

    t.add_cleanup(() => iframe.remove());

    document.body.append(iframe);
  });
}
</script>
