Source code
Revision control
Copy as Markdown
Other Tools
Test Info: Warnings
- This test has a WPT meta file that expects 1 subtest issues.
- This WPT test may be referenced by the following Test IDs:
- /clipboard-apis/async-navigator-clipboard-read-sanitize.https.html - WPT Dashboard Interop Dashboard
<!doctype html>
<meta charset="utf-8">
<title>Async Clipboard.read() should sanitize text/html</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/resources/testdriver.js"></script>
<script src="/resources/testdriver-vendor.js"></script>
<script src="resources/user-activation.js"></script>
<body>Body needed for test_driver.click()
<p><button id="button">Put payload in the clipboard</button></p>
<div id="output"></div>
<script>
let testFailed = false;
function fail() {
testFailed = true;
}
button.onclick = () => document.execCommand('copy');
document.oncopy = ev => {
ev.preventDefault();
ev.clipboardData.setData(
'text/html',
`<form><math><mtext></form><form><mglyph><xmp></math><img src=invalid onerror=fail()></xmp>`);
};
promise_test(async test => {
await tryGrantReadPermission();
await test_driver.click(button);
await waitForUserActivation();
const items = await navigator.clipboard.read();
const htmlBlob = await items[0].getType("text/html");
const html = await htmlBlob.text();
// This inserts an image with `onerror` handler if `html` is not properly sanitized
output.innerHTML = html;
// Allow the 'error' event to be dispatched asynchronously
await new Promise(resolve => test.step_timeout(resolve, 100));
assert_false(testFailed);
});
</script>
</body>