mirror of
https://github.com/RGBCube/serenity
synced 2025-10-31 18:02:44 +00:00
68fa8f52b4
This verifies that XHR.open() throws a Security Error when 'CONNECT', 'TRACE', or 'TRACK' is passed as the method argument.
20 lines
578 B
HTML
20 lines
578 B
HTML
<script src="../include.js"></script>
|
|
<script>
|
|
test(() => {
|
|
const forbiddenMethods = ["CONNECT", "TRACE", "TRACK"];
|
|
const SECURITY_ERR = 18;
|
|
let i = 0;
|
|
for (const method of forbiddenMethods) {
|
|
const xhr = new XMLHttpRequest();
|
|
try {
|
|
xhr.open(method, "data:text/plain,", true);
|
|
}
|
|
catch (e) {
|
|
if (e.code === SECURITY_ERR)
|
|
i += 1;
|
|
}
|
|
}
|
|
if (i === forbiddenMethods.length)
|
|
println("PASS");
|
|
});
|
|
</script>
|