Content - 943fb9495ee35e3cf677af6fc40ed7ee3c057cee - fcbe1c5/XMLHttpRequest/send-after-setting-document-domain.htm

visit type:

Tip revision: fef9e88912d729c4ca02473b1d46d0e2e95b4590 authored by Aryeh Gregor on 12 April 2016, 13:36:58 UTC
Test DOMTokenList

Tip revision: fef9e88

send-after-setting-document-domain.htm

<!doctype html>
<html>
  <head>
    <title>XMLHttpRequest: send() with document.domain set</title>
    <script src="/resources/testharness.js"></script>
    <script src="/resources/testharnessreport.js"></script>
    <!-- The spec doesn't seem to explicitly cover this case (as of June 2013) -->
    <link rel="help" href="https://xhr.spec.whatwg.org/#the-open()-method" data-tested-assertations="following::ol[1]/li[2]/ol[1]/li[3]" />
  </head>
  <body>
    <div id="log"></div>
    <script>
      // first make sure we actually run off a domain with at least three parts, in order to be able to shorten it..
      if (location.hostname.split(/\./).length < 3) {
        location.href = location.protocol+'//www2.'+location.host+location.pathname
      }

      test(function() {
        document.domain = document.domain // this is not a noop, it does actually change the security context
        var client = new XMLHttpRequest()
        client.open("GET", "resources/status.py?content=hello", false)
        client.send(null)
        assert_equals(client.responseText, "hello")
        document.domain = document.domain.replace(/^\w+\./, '')
        client.open("GET", "resources/status.py?content=hello2", false)
        client.send(null)
        assert_equals(client.responseText, "hello2")
      }, "loading documents from original origin after setting document.domain")
      // try to load a document from the origin document.domain was set to
      test(function () {
        var client = new XMLHttpRequest()
        client.open("GET", location.protocol + '//' + document.domain + location.pathname.replace(/[^\/]*$/, '') + "resources/status.py?content=hello3", false)
        // AFAIK this should throw
        assert_throws('NetworkError', function(){client.send(null)})
      }, "loading documents from the origin document.domain was set to should throw")
    </script>
  </body>
</html>

Browse the archive

https://github.com/web-platform-tests/wpt