HtmlUnit / Bugs / #447 Don't execute JavaScript in <noframes> and <iframe>

Java GUI-Less browser, supporting JavaScript, to run against web pages

#447 Don't execute JavaScript in <noframes> and <iframe>

Status: closed

Owner: Marc Guillemot

Labels: None

Priority: 5

Updated: 2012-10-21

Created: 2007-03-27

Creator: kkolman

Private: No

Since htmlunit supports frames, don't execute Javascript contained in <noframes> and <iframe> elements. Actually I think that <noframes>, <iframe> content shouldn't get loaded into the domtree at all. (see the tests 3 and 4 in the attached unit test).</noframes>

Discussion

kkolman - 2007-03-28

Logged In: YES
user_id=1612820
Originator: YES

File Added: NoFramesTest.java

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

kkolman - 2007-03-28

Reupload od the test - a stronger one

NoFramesTest.java

If you would like to refer to this comment somewhere else in this project, copy and paste the following link:

Ahmed Ashour - 2007-04-07

Logged In: YES
user_id=950730
Originator: NO

I don't think <noframes>, and <iframe> content shouldn't get loaded, otherwise HtmlPage.asXml() will not retrieve them (and that affects what the user expects). Below is a patch (can't be uploaded). However, HtmlInlineFrameTest.testSetSrcAttribute_ViaJavaScript fails and seems to be invalid test, please verify why it is there. Many thanks, Ahmed Ashour <hr> Index: src/java/com/gargoylesoftware/htmlunit/html/HtmlPage.java =================================================================== --- src/java/com/gargoylesoftware/htmlunit/html/HtmlPage.java (revision 1363) +++ src/java/com/gargoylesoftware/htmlunit/html/HtmlPage.java (working copy) @@ -87,6 +87,7 @@ <ul> <li><a class="user-mention" href="/u/author/profile/">@author</a> <a href="mailto:cse@dynabean.de">Christian Sell</a></li> <li><a class="user-mention" href="/u/author/profile/">@author</a> Chris Erskine</li> <li><a class="user-mention" href="/u/author/profile/">@author</a> Marc Guillemot</li> <li> <ul> <li><a class="user-mention" href="/u/author/profile/">@author</a> Ahmed Ashour */ public final class HtmlPage extends DomNode implements Page {</li> </ul> </li> </ul> @@ -1407,7 +1408,16 @@ <div class="codehilite"><pre><code> if (elem instanceof HtmlScript) { final HtmlScript scriptNode = (HtmlScript) node; getLog().debug("Script node added: " + scriptNode.asXml()); </code></pre></div> <ul> <li>scriptNode.executeScriptIfNeeded(); +</li> <li>boolean preventExecution = false;</li> <li>for( DomNode n = node; n != null; n = n.getParentNode() ) {</li> <li>if( n instanceof HtmlInlineFrame || n instanceof HtmlNoFrames ) {</li> <li>preventExecution = true;</li> <li>break;</li> <li>}</li> <li>}</li> <li>if( !preventExecution )</li> <li>scriptNode.executeScriptIfNeeded(); } else { final List scripts = elem.getHtmlElementsByTagName("script"); Index: src/java/com/gargoylesoftware/htmlunit/html/HtmlScript.java</li> </ul> =================================================================== --- src/java/com/gargoylesoftware/htmlunit/html/HtmlScript.java (revision 1363) +++ src/java/com/gargoylesoftware/htmlunit/html/HtmlScript.java (working copy) @@ -53,6 +53,7 @@ <ul> <li><a class="user-mention" href="/u/author/profile/">@author</a> <a href="mailto:cse@dynabean.de">Christian Sell</a></li> <li><a class="user-mention" href="/u/author/profile/">@author</a> Marc Guillemot</li> <li><a class="user-mention" href="/u/author/profile/">@author</a> David K. Taylor</li> <li> <ul> <li><a class="user-mention" href="/u/author/profile/">@author</a> Ahmed Ashour</li> </ul> </li> <li><a class="user-mention" href="/u/see/profile/">@see</a> <a href="http://www.w3.org/TR/2000/WD-DOM-Level-1-20000929/level-one-html.html#ID-81598695"></li> <li>DOM Level 1</a></li> <li> <a class="user-mention" href="/u/see/profile/">@see</a> <a href="http://www.w3.org/TR/2003/REC-DOM-Level-2-HTML-20030109/html.html#ID-81598695"> @@ -166,7 +167,15 @@ */ public DomNode appendChild(final DomNode node) { final DomNode response = super.appendChild(node); </li> <li> executeInlineScriptIfNeeded(); </li> <li>boolean preventExecution = false;</li> <li>for( DomNode o = node; o != null; o = o.getParentNode() ) {</li> <li>if( o instanceof HtmlInlineFrame || o instanceof HtmlNoFrames) {</li> <li>preventExecution = true;</li> <li>break;</li> <li>}</li> <li>}</li> <li>if( !preventExecution )</li> <li>executeInlineScriptIfNeeded(); return response; }</li> </ul> Index: src/test/java/com/gargoylesoftware/htmlunit/html/HtmlFrameSetTest.java =================================================================== --- src/test/java/com/gargoylesoftware/htmlunit/html/HtmlFrameSetTest.java (revision 1363) +++ src/test/java/com/gargoylesoftware/htmlunit/html/HtmlFrameSetTest.java (working copy) @@ -291,4 +291,35 @@ <div class="codehilite"><pre><code> assertEquals(URL_FIRST.toString(), lastAdditionalHeaders.get("Referer")); } </code></pre></div> -} <ul> <li>public void testScriptUnderNoFrames() throws Exception {</li> <li>final String firstContent</li> <li>= "<html><head><title>first</title></head>"</li> <li> <ul> <li>"<frameset cols='100%'>"</li> </ul> </li> <li> <ul> <li>" <frame src='http://second'' id='frame1'/>"</li> </ul> </li> <li> <ul> <li>" <noframes>"</li> </ul> </li> <li> <ul> <li>" <div><script>alert('1');</script></div>"</li> </ul> </li> <li> <ul> <li>" <script src='http://third'></script>"</li> </ul> </li> <li>+" </noframes>"
- "";
final String secondContent
= "<script>alert('2');</script>";
final String thirdContent
= "alert('3');";
final WebClient client = new WebClient();
+
final MockWebConnection webConnection = new MockWebConnection( client );
webConnection.setResponse(URL_FIRST, firstContent);
webConnection.setResponse(URL_SECOND, secondContent);
webConnection.setResponse(URL_THIRD, thirdContent, "text/javascript");
+
client.setWebConnection( webConnection );
final List expectedAlerts = Arrays.asList(new String[]{"2"});
ArrayList collectedAlerts = new ArrayList();
client.setAlertHandler( new CollectingAlertHandler(collectedAlerts) );
final HtmlPage firstPage = ( HtmlPage )client.getPage(URL_FIRST);
assertEquals( expectedAlerts, collectedAlerts );
}
+
+}

\ No newline at end of file

Index: src/test/java/com/gargoylesoftware/htmlunit/html/HtmlInlineFrameTest.java

===================================================================

--- src/test/java/com/gargoylesoftware/htmlunit/html/HtmlInlineFrameTest.java (revision 1363)

+++ src/test/java/com/gargoylesoftware/htmlunit/html/HtmlInlineFrameTest.java (working copy)

@@ -37,8 +37,12 @@

*/
package com.gargoylesoftware.htmlunit.html;

+import java.util.ArrayList;
+import java.util.Arrays;
import java.util.Collections;
+import java.util.List;

+import com.gargoylesoftware.htmlunit.CollectingAlertHandler;
import com.gargoylesoftware.htmlunit.MockWebConnection;
import com.gargoylesoftware.htmlunit.WebClient;
import com.gargoylesoftware.htmlunit.WebTestCase;
@@ -48,6 +52,7 @@

@version $Revision$
@author Mike Bowler
- @author Ahmed Ashour
  /
  public class HtmlInlineFrameTest extends WebTestCase {
  /*
  @@ -122,4 +127,33 @@
  
  assertEquals( "http://third", iframe.getSrcAttribute() );
  assertEquals( "Third", ((HtmlPage)iframe.getEnclosedPage()).getTitleText() );
  }
  -}
  +
public void testScriptUnderIFrame() throws Exception {
final String firstContent
= ""
- "<iframe src="http://second">"</li> </ul> </li> <li> <ul> <li>" <div><script>alert('1');</script></div>"</li> </ul> </li> <li> <ul> <li>" <script src='http://third'></script>"</li> </ul> </li> <li> <ul> <li>"</iframe>"
- "";
final String secondContent
= "<script>alert('2');</script>";
final String thirdContent
= "alert('3');";
final WebClient client = new WebClient();
+
final MockWebConnection webConnection = new MockWebConnection( client );
webConnection.setResponse(URL_FIRST, firstContent);
webConnection.setResponse(URL_SECOND, secondContent);
webConnection.setResponse(URL_THIRD, thirdContent, "text/javascript");
+
client.setWebConnection( webConnection );
final List expectedAlerts = Arrays.asList(new String[]{"2"});
ArrayList collectedAlerts = new ArrayList();
client.setAlertHandler( new CollectingAlertHandler(collectedAlerts) );
final HtmlPage firstPage = ( HtmlPage )client.getPage(URL_FIRST);
assertEquals( expectedAlerts, collectedAlerts );
}
+}

\ No newline at end of file

Don't execute JavaScript in <noframes> and <iframe>

Java GUI-Less browser, supporting JavaScript, to run against web pages

Group

Searches

Help

#447 Don't execute JavaScript in <noframes> and <iframe>

Discussion