|
@@ -1555,41 +1555,42 @@ describe('BrowserWindow module', () => {
|
|
|
})
|
|
|
})
|
|
|
|
|
|
- it('should open windows in another domain with cross-scripting disabled', (done) => {
|
|
|
- w.destroy()
|
|
|
- w = new BrowserWindow({
|
|
|
+ it('should open windows in another domain with cross-scripting disabled', async () => {
|
|
|
+ const w = await openTheWindow({
|
|
|
show: false,
|
|
|
webPreferences: {
|
|
|
sandbox: true,
|
|
|
- preload: preload
|
|
|
+ preload
|
|
|
}
|
|
|
})
|
|
|
+
|
|
|
ipcRenderer.send('set-web-preferences-on-next-new-window', w.webContents.id, 'preload', preload)
|
|
|
- let popupWindow
|
|
|
w.loadFile(path.join(fixtures, 'api', 'sandbox.html'), { search: 'window-open-external' })
|
|
|
- w.webContents.once('new-window', (e, url, frameName, disposition, options) => {
|
|
|
- assert.strictEqual(url, 'http://www.google.com/#q=electron')
|
|
|
- assert.strictEqual(options.width, 505)
|
|
|
- assert.strictEqual(options.height, 605)
|
|
|
- ipcMain.once('child-loaded', function (event, openerIsNull, html) {
|
|
|
- assert(openerIsNull)
|
|
|
- assert.strictEqual(html, '<h1>http://www.google.com/#q=electron</h1>')
|
|
|
- ipcMain.once('answer', function (event, exceptionMessage) {
|
|
|
- assert(/Blocked a frame with origin/.test(exceptionMessage))
|
|
|
-
|
|
|
- // FIXME this popup window should be closed in sandbox.html
|
|
|
- closeWindow(popupWindow, { assertSingleWindow: false }).then(() => {
|
|
|
- popupWindow = null
|
|
|
- done()
|
|
|
- })
|
|
|
- })
|
|
|
- w.webContents.send('child-loaded')
|
|
|
- })
|
|
|
- })
|
|
|
-
|
|
|
- app.once('browser-window-created', function (event, window) {
|
|
|
- popupWindow = window
|
|
|
- })
|
|
|
+ const expectedPopupUrl = 'http://www.google.com/#q=electron' // Set in the "sandbox.html".
|
|
|
+
|
|
|
+ // The page is going to open a popup that it won't be able to close.
|
|
|
+ // We have to close it from here later.
|
|
|
+ // XXX(alexeykuzmin): It will leak if the test fails too soon.
|
|
|
+ const [, popupWindow] = await emittedOnce(app, 'browser-window-created')
|
|
|
+
|
|
|
+ // Wait for a message from the popup's preload script.
|
|
|
+ const [, openerIsNull, html, locationHref] = await emittedOnce(ipcMain, 'child-loaded')
|
|
|
+ expect(openerIsNull).to.be.true('window.opener is not null')
|
|
|
+ expect(html).to.equal(`<h1>${expectedPopupUrl}</h1>`,
|
|
|
+ 'looks like a http: request has not been intercepted locally')
|
|
|
+ expect(locationHref).to.equal(expectedPopupUrl)
|
|
|
+
|
|
|
+ // Ask the page to access the popup.
|
|
|
+ w.webContents.send('touch-the-popup')
|
|
|
+ const [, exceptionMessage] = await emittedOnce(ipcMain, 'answer')
|
|
|
+
|
|
|
+ // We don't need the popup anymore, and its parent page can't close it,
|
|
|
+ // so let's close it from here before we run any checks.
|
|
|
+ await closeWindow(popupWindow, { assertSingleWindow: false })
|
|
|
+
|
|
|
+ expect(exceptionMessage).to.be.a('string',
|
|
|
+ `child's .document is accessible from its parent window`)
|
|
|
+ expect(exceptionMessage).to.match(/^Blocked a frame with origin/)
|
|
|
})
|
|
|
|
|
|
it('should inherit the sandbox setting in opened windows', (done) => {
|