Skip to content

test_runner doesn't report violations of same-origin policy #56772

Open
@srujzs

Description

@srujzs

This is a similar issue as dart-lang/test#2282.

Running the following code:

import 'dart:js_interop';

@JS()
external JSAny? get window;

void main() {
  final w = window.open('https://www.google.com');
  if (w == null) throw Exception();
  w.devicePixelRatio;
}

extension on JSAny? {
  external JSAny? open(String url);
  external int devicePixelRatio;
}

does not result in a SecurityError when run with tools/test.py -r chrome -c dart2js <test_path>. devicePixelRatio is a disallowed API on cross-origin windows. When I single-stepped the test however, the test does throw that error:

SecurityError: Failed to read a named property 'devicePixelRatio' from 'Window': Blocked a frame with origin "http://127.0.0.1:61457" from accessing a cross-origin frame.

It's possible we may need to enable same-origin policy (if possible) for this. It'd be useful to enable this so that we can run interop tests like cross_origin_test correctly.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area-testCross-cutting test issues (use area- labels for specific failures; not used for package:test).type-enhancementA request for a change that isn't a bug

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions