sousa-gecko/testing/web-platform/tests/web-install/navigator-install-sandboxed-iframe.tentative.https.html

<!DOCTYPE html>
<title>navigator.install() in sandboxed and non-sandboxed iframes</title>
<link rel="help" href="https://github.com/MicrosoftEdge/MSEdgeExplainers/blob/main/WebInstall/explainer.md">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<body>
<script>
var lastCallbackId = 0;
var callbacks = {};

function postMessageAndWaitResult(frame) {
  return new Promise(function(resolve) {
    var id = ++lastCallbackId;
    callbacks[id] = resolve;
    frame.contentWindow.postMessage({id: id}, '*');
  });
}

window.onmessage = function(e) {
  var message = e.data;
  var id = message['id'];
  var callback = callbacks[id];
  delete callbacks[id];
  callback(message);
};

function with_iframe(url) {
  return new Promise(function(resolve) {
    var frame = document.createElement('iframe');
    frame.src = url;
    frame.onload = function() { resolve(frame); };
    document.body.appendChild(frame);
  });
}

function with_sandboxed_iframe(url, sandbox) {
  return new Promise(function(resolve) {
    var frame = document.createElement('iframe');
    frame.sandbox = sandbox;
    frame.src = url;
    frame.onload = function() { resolve(frame); };
    document.body.appendChild(frame);
  });
}

const helper_url = 'resources/navigator-install-iframe-helper.html';

promise_test(function(t) {
    return with_sandboxed_iframe(helper_url, 'allow-scripts')
      .then(function(frame) {
          t.add_cleanup(() => { frame.remove(); });
          return postMessageAndWaitResult(frame);
        })
      .then(function(message) {
          // In a sandboxed iframe without allow-same-origin, the origin is
          // opaque. The permissions policy default allowlist of "self" does not
          // include opaque origins, so the permissions policy check fails first
          // with a SecurityError.
          assert_equals(message.errorName, 'SecurityError',
              'Should throw SecurityError in sandboxed iframe');
        });
  }, 'navigator.install() in sandboxed iframe (allow-scripts) should throw ' +
     'SecurityError.');

promise_test(function(t) {
    return with_sandboxed_iframe(
               helper_url, 'allow-scripts allow-same-origin')
      .then(function(frame) {
          t.add_cleanup(() => { frame.remove(); });
          return postMessageAndWaitResult(frame);
        })
      .then(function(message) {
          // With allow-same-origin, the iframe retains its real origin, so the
          // permissions policy check passes. However, navigator.install()
          // disallows ALL sandboxed contexts, so the sandbox flags check fails
          // with a SecurityError.
          assert_equals(message.errorName, 'SecurityError',
              'Should throw SecurityError in sandboxed iframe even with ' +
              'allow-same-origin');
        });
  }, 'navigator.install() in sandboxed iframe (allow-scripts ' +
     'allow-same-origin) should throw SecurityError.');

promise_test(function(t) {
    return with_iframe(helper_url)
      .then(function(frame) {
          t.add_cleanup(() => { frame.remove(); });
          return postMessageAndWaitResult(frame);
        })
      .then(function(message) {
          // A regular same-origin iframe passes the permissions policy and
          // sandbox checks, but fails the main-frame check with an
          // InvalidStateError.
          assert_equals(message.errorName, 'InvalidStateError',
              'Should throw InvalidStateError in non-main-frame iframe');
        });
  }, 'navigator.install() in a same-origin iframe should throw ' +
     'InvalidStateError.');
</script>
</body>