Skip to content

Commit 7f2ea8f

Browse files
sysrqbMatthew Finkel
sysrqb
authored and
Matthew Finkel
committed
Partition Blob Registry by the top-level main document origin
https://bugs.webkit.org/show_bug.cgi?id=260035 rdar://problem/113705298 Reviewed by Alex Christensen and Sihui Liu. Public blob URLs are only accessible from same-origin dcuments, but access is not restricted by the top-level origin. This means that Blob URLs can be used as a cross-origin tracking mechanism within iframes. In this patch we partition public blob URLs within the Blob Registry by top-level origin. This partitioning is controlled by a feature flag that is disabled by default. I took a few approaches at solving this. The most difficult challenge was finding a solution that allowed retrieving BlobData using a public blob URL from WKWebView APIs. In that case, the relevant top document may not be obvious, or may not exist. As a result, the design of this partitioning is more like access control rather than adding another key into the hashmap. Two alternative designs I considered include creating a second hashmap that is keyed by <URL, SecurityOriginData> and we lookup the BlobData in that map if we have a SecurityOriginData, otherwise we use the unpartitioned map. Or, we create a new map from URL -> SecurityOriginData where we can lookup the associated top origin SecurityOriginData if we don't already know it. However, both of these options are more complex than the chosen implementation, and neither of them seemed safer. This change also enforces a noopener policy on new windows when the top origin of the opener is cross-origin with the blob's security origin. This is a mitigation that was discussed in the blob URL storage partitioning issue [0] with cross-engine support, and that seemed reasonable to me. [0] w3c/FileAPI#153 * LayoutTests/TestExpectations: * LayoutTests/http/tests/local/blob/download-blob-from-iframe-expected.txt: Added. * LayoutTests/http/tests/local/blob/download-blob-from-iframe.html: Added. * LayoutTests/http/tests/local/blob/navigate-blob-expected.txt: Added. * LayoutTests/http/tests/local/blob/navigate-blob.html: Added. * LayoutTests/http/tests/local/blob/resources/broadcast-channel-proxy.html: Added. * LayoutTests/http/tests/local/blob/resources/iframe-creating-or-downloading-blob.html: Added. * LayoutTests/http/tests/local/blob/resources/iframe-for-creating-and-navigating-to-blob.html: Added. * LayoutTests/http/tests/local/blob/resources/main-frame-with-iframe-creating-or-navigating-to-blob.html: Added. * LayoutTests/http/tests/local/blob/resources/main-frame-with-iframe-downloading-blob.html: Added. * LayoutTests/http/tests/security/blob-null-url-location-origin-expected.txt: * LayoutTests/http/tests/security/blob-null-url-location-origin.html: * LayoutTests/http/tests/security/cross-origin-blob-transfer-expected.txt: Added. * LayoutTests/http/tests/security/cross-origin-blob-transfer.html: Added. * LayoutTests/http/tests/security/resources/iframe-cross-origin-blob-transfer.html: Added. * LayoutTests/http/tests/security/top-level-unique-origin2.https.html: * LayoutTests/platform/gtk-wk2/http/tests/local/blob/download-blob-from-iframe-expected.txt: Added. * LayoutTests/platform/mac-wk1/TestExpectations: * Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml: * Source/WebCore/fileapi/BlobURL.cpp: (WebCore::BlobURL::isInternalURL): * Source/WebCore/fileapi/BlobURL.h: * Source/WebCore/fileapi/ThreadableBlobRegistry.cpp: (WebCore::ThreadableBlobRegistry::registerInternalFileBlobURL): (WebCore::ThreadableBlobRegistry::registerInternalBlobURL): (WebCore::ThreadableBlobRegistry::registerInternalBlobURLOptionallyFileBacked): (WebCore::ThreadableBlobRegistry::registerInternalBlobURLForSlice): (WebCore::isInternalBlobURL): Deleted. * Source/WebCore/loader/FrameLoader.cpp: (WebCore::FrameLoader::loadURL): (WebCore::FrameLoader::loadPostRequest): (WebCore::createWindow): * Source/WebCore/platform/network/BlobRegistryImpl.cpp: (WebCore::BlobRegistryImpl::registerBlobURLOptionallyFileBacked): (WebCore::BlobRegistryImpl::unregisterBlobURL): (WebCore::BlobRegistryImpl::getBlobDataFromURL const): (WebCore::BlobRegistryImpl::addBlobData): (WebCore::BlobRegistryImpl::registerBlobURLHandle): (WebCore::BlobRegistryImpl::unregisterBlobURLHandle): * Source/WebCore/platform/network/BlobRegistryImpl.h: Canonical link: https://commits.webkit.org/267172@main
1 parent b4e7bc6 commit 7f2ea8f

25 files changed

+787
-37
lines changed

‎LayoutTests/TestExpectations‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5046,6 +5046,7 @@ webkit.org/b/227086 imported/w3c/web-platform-tests/webxr/xrWebGLLayer_construct
50465046
# Extra logging that needs to be silenced:
50475047
imported/w3c/web-platform-tests/webxr/webxr_availability.http.sub.html [ DumpJSConsoleLogInStdErr ]
50485048

5049+
http/tests/local/blob/navigate-blob.html [ DumpJSConsoleLogInStdErr ]
50495050

50505051
# "Opacity on an inline element should apply on float child".
50515052
webkit.org/b/234690 imported/w3c/web-platform-tests/css/css-color/inline-opacity-float-child.html [ ImageOnlyFailure ]

‎LayoutTests/http/tests/local/blob/download-blob-from-iframe-expected.txt‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
Download started.
2+
Downloading URL with suggested filename "testBlobFileName.html"
3+
Download completed.
4+
Download started.
5+
Download failed.
6+
Failed: WebKitBlobResource, code=1, description=The operation couldn’t be completed. (WebKitBlobResource error 1.)
7+
Download started.
8+
Download failed.
9+
Failed: WebKitBlobResource, code=1, description=The operation couldn’t be completed. (WebKitBlobResource error 1.)
10+
Download started.
11+
Download failed.
12+
Failed: WebKitBlobResource, code=1, description=The operation couldn’t be completed. (WebKitBlobResource error 1.)
13+
Download started.
14+
Download failed.
15+
Failed: WebKitBlobResource, code=1, description=The operation couldn’t be completed. (WebKitBlobResource error 1.)
16+
Download started.
17+
Download failed.
18+
Failed: WebKitBlobResource, code=1, description=The operation couldn’t be completed. (WebKitBlobResource error 1.)
19+
Download started.
20+
Download failed.
21+
Failed: WebKitBlobResource, code=1, description=The operation couldn’t be completed. (WebKitBlobResource error 1.)
22+
Download started.
23+
Downloading URL with suggested filename "testBlobFileName.html"
24+
Download completed.
25+
PASS successfullyParsed is true
26+
27+
TEST COMPLETE
28+
Opening https://localhost:8443 as main frame with iframe origin https://localhost:8443, creating blob
29+
PASS Opened window
30+
PASS iframe: created blob
31+
Opening https://localhost:8443 as main frame with iframe origin https://localhost:8443, downloading blob
32+
PASS Opened window
33+
PASS iframe: downloading blob
34+
Opening http://localhost:8000 as main frame with iframe origin https://localhost:8443, downloading blob
35+
PASS Opened window
36+
PASS iframe: downloading blob
37+
Opening http://127.0.0.1:8000 as main frame with iframe origin https://localhost:8443, downloading blob
38+
PASS Opened window
39+
PASS iframe: downloading blob
40+
Opening https://127.0.0.1:8443 as main frame with iframe origin https://localhost:8443, downloading blob
41+
PASS Opened window
42+
PASS iframe: downloading blob
43+
Opening https://127.0.0.1:8443 as main frame with iframe origin https://localhost:8443, creating blob
44+
PASS Opened window
45+
PASS iframe: created blob
46+
Opening https://localhost:8443 as main frame with iframe origin https://localhost:8443, downloading blob
47+
PASS Opened window
48+
PASS iframe: downloading blob
49+
Opening http://localhost:8000 as main frame with iframe origin https://localhost:8443, downloading blob
50+
PASS Opened window
51+
PASS iframe: downloading blob
52+
Opening http://127.0.0.1:8000 as main frame with iframe origin https://localhost:8443, downloading blob
53+
PASS Opened window
54+
PASS iframe: downloading blob
55+
Opening https://127.0.0.1:8443 as main frame with iframe origin https://localhost:8443, downloading blob
56+
PASS Opened window
57+
PASS iframe: downloading blob
58+
59+
PASS Test for creating blob in iframe and then downloading to it in same-origin iframe and same-origin, same-site, and cross-site main frames.
60+

‎LayoutTests/http/tests/local/blob/download-blob-from-iframe.html‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"><!-- webkit-test-runner [ BlobRegistryTopOriginPartitioningEnabled=true ] -->
2+
<html>
3+
<head>
4+
<script src="../../../../resources/testharness.js"></script>
5+
<script src="../../../../resources/testharnessreport.js"></script>
6+
<script src="../../../../resources/js-test-pre.js"></script>
7+
</head>
8+
<body>
9+
<p id="description"></p>
10+
<div id="console"></div>
11+
<script>
12+
var test = async_test("Test for creating blob in iframe and then downloading to it in same-origin iframe and same-origin, same-site, and cross-site main frames.");
13+
14+
if (window.testRunner)
15+
testRunner.setShouldLogDownloadCallbacks(true);
16+
17+
let blobURL = "";
18+
let timeoutId;
19+
let handle;
20+
let shouldDownloadSameOriginBlob = true;
21+
let shouldDownloadSameSiteBlob = true;
22+
let shouldDownloadCrossSiteBlob = true;
23+
let shouldDownloadSecondCrossSiteBlob = true;
24+
let shouldCreateCrossSiteBlob = true;
25+
26+
function openBlobCreatingFrame(origin)
27+
{
28+
debug(`Opening ${origin} as main frame with iframe origin https://localhost:8443, creating blob`);
29+
handle = open(`${origin}/local/blob/resources/main-frame-with-iframe-downloading-blob.html`, "test-main-frame-create-blob");
30+
assert_true(!!handle, `Opening ${origin} for blob creation failed`);
31+
timeoutId = setTimeout(() => window.postMessage({ "status": "donefail", "message": `Opening ${origin} timed out.` }, '*'), 2000);
32+
}
33+
34+
function openBlobDownloadingFrame(origin)
35+
{
36+
debug(`Opening ${origin} as main frame with iframe origin https://localhost:8443, downloading blob`);
37+
handle = open(`${origin}/local/blob/resources/main-frame-with-iframe-downloading-blob.html?url=${blobURL}`, "test-main-frame-download-blob");
38+
assert_true(!!handle, `Opening ${origin} main frame for downloading blob failed`);
39+
timeoutId = setTimeout(() => window.postMessage({ "status": "donefail", "message": `Opening ${origin} timed out.` }, '*'), 2000);
40+
}
41+
42+
window.onload = () => {
43+
// Load main frame from localhost, iframe is loaded from localhost, blob is partitioned as https://localhost:8443 under https://localhost:8443. Blob is accessible from https://localhost:8443.
44+
openBlobCreatingFrame(`https://localhost:8443`);
45+
}
46+
47+
window.addEventListener("message", (e) => {
48+
if (timeoutId) {
49+
clearTimeout(timeoutId);
50+
timeoutId = undefined;
51+
handle = undefined;
52+
} else if (handle == e.source) {
53+
// If the timeout callback was already called, then don't handle this message, it's too late.
54+
return;
55+
}
56+
57+
if (e.data.status) {
58+
if (e.data.status == "pass" || e.data.status == "done")
59+
testPassed(`${e.data.message}`);
60+
else if (e.data.status == "fail" || e.data.status == "donefail")
61+
testFailed(`${e.data.message}`);
62+
else
63+
testFailed(`Unexpected status: ${e.data.status}`);
64+
if (e.data.status == "done" || e.data.status == "donefail") {
65+
if (shouldDownloadSameOriginBlob) {
66+
assert_true(e.data.url && e.data.url !== "", `Blob URL is not defined in same-origin download`);
67+
blobURL = encodeURI(e.data.url);
68+
openBlobDownloadingFrame(`https://localhost:8443`);
69+
shouldDownloadSameOriginBlob = false;
70+
} else if (shouldDownloadSameSiteBlob) {
71+
assert_true(e.data.url && e.data.url !== "", `Blob URL is not defined in same-site download`);
72+
blobURL = encodeURI(e.data.url);
73+
openBlobDownloadingFrame(`http://localhost:8000`);
74+
shouldDownloadSameSiteBlob = false;
75+
} else if (shouldDownloadCrossSiteBlob) {
76+
assert_true(e.data.url && e.data.url !== "", `Blob URL is not defined in first cross-site download`);
77+
blobURL = encodeURI(e.data.url);
78+
openBlobDownloadingFrame(`http://127.0.0.1:8000`);
79+
shouldDownloadCrossSiteBlob = false;
80+
} else if (shouldDownloadSecondCrossSiteBlob) {
81+
assert_true(e.data.url && e.data.url !== "", `Blob URL is not defined in second cross-site download`);
82+
blobURL = encodeURI(e.data.url);
83+
openBlobDownloadingFrame(`https://127.0.0.1:8443`);
84+
shouldDownloadSecondCrossSiteBlob = false;
85+
} else if (shouldCreateCrossSiteBlob) {
86+
// Load main frame from localhost, iframe is loaded from localhost, blob is partitioned as https://localhost:8443 under https://127.0.0.1:8443. Blob is not accessible from https://localhost:8443.
87+
openBlobCreatingFrame(`https://127.0.0.1:8443`);
88+
shouldCreateCrossSiteBlob = false;
89+
shouldDownloadSameOriginBlob = true;
90+
shouldDownloadSameSiteBlob = true;
91+
shouldDownloadCrossSiteBlob = true;
92+
shouldDownloadSecondCrossSiteBlob = true;
93+
} else {
94+
test.done();
95+
}
96+
}
97+
} else
98+
testFailed(`Unexpected message: ${e.data}`);
99+
});
100+
</script>
101+
<script src="../../../../resources/js-test-post.js"></script>
102+
</body>
103+
</html>

‎LayoutTests/http/tests/local/blob/navigate-blob-expected.txt‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
PASS successfullyParsed is true
2+
3+
TEST COMPLETE
4+
Opening https://localhost:8443 as main frame with iframe origin https://localhost:8443 creating blob
5+
PASS iframe: created blob
6+
PASS main frame: Fetched Blob
7+
PASS main frame: open() succeeded. Received message from blob: successfully navigated, have opener: true
8+
Opening http://127.0.0.1:8000 as main frame with iframe origin https://localhost:8443
9+
FAIL iframe: Fetching blob failed: Load failed
10+
FAIL iframe: WindowProxy handle is null (probably opened blob url with noopener)
11+
FAIL iframe: Could not open blob url, timed out
12+
FAIL main frame: Fetching blob failed: Load failed
13+
FAIL main frame: Could not open blob url, timed out
14+
Opening http://localhost:8000 as main frame with iframe origin https://localhost:8443
15+
FAIL iframe: Fetching blob failed: Load failed
16+
FAIL iframe: WindowProxy handle is null (probably opened blob url with noopener)
17+
FAIL iframe: Could not open blob url, timed out
18+
FAIL main frame: Fetching blob failed: Load failed
19+
FAIL main frame: Could not open blob url, timed out
20+
Opening https://localhost:8443 as main frame with iframe origin https://localhost:8443
21+
PASS iframe: Fetched Blob
22+
PASS iframe: open() succeeded. Received message from blob: successfully navigated, have opener: true
23+
PASS main frame: Fetched Blob
24+
PASS main frame: open() succeeded. Received message from blob: successfully navigated, have opener: true
25+
Opening http://127.0.0.1:8000 as main frame with iframe origin https://localhost:8443 creating blob
26+
PASS iframe: created blob
27+
FAIL main frame: Fetching blob failed: Load failed
28+
FAIL main frame: Could not open blob url, timed out
29+
Opening https://localhost:8443 as main frame with iframe origin https://localhost:8443
30+
FAIL iframe: Fetching blob failed: Load failed
31+
FAIL iframe: Could not open blob url, timed out
32+
FAIL main frame: Fetching blob failed: Load failed
33+
FAIL main frame: Could not open blob url, timed out
34+
Opening http://localhost:8000 as main frame with iframe origin https://localhost:8443
35+
FAIL iframe: Fetching blob failed: Load failed
36+
FAIL iframe: WindowProxy handle is null (probably opened blob url with noopener)
37+
FAIL iframe: Could not open blob url, timed out
38+
FAIL main frame: Fetching blob failed: Load failed
39+
FAIL main frame: Could not open blob url, timed out
40+
Opening http://127.0.0.1:8000 as main frame with iframe origin https://localhost:8443
41+
PASS iframe: Fetched Blob
42+
FAIL iframe: WindowProxy handle is null (probably opened blob url with noopener)
43+
PASS iframe: open() succeeded. Received message from blob: successfully navigated, have opener: false
44+
FAIL main frame: Fetching blob failed: Load failed
45+
FAIL main frame: Could not open blob url, timed out
46+
47+
PASS Test for creating blob in iframe and then navigating to it from same-origin iframe and cross-origin main frames.
48+

‎LayoutTests/http/tests/local/blob/navigate-blob.html‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"><!-- webkit-test-runner [ BlobRegistryTopOriginPartitioningEnabled=true BroadcastChannelOriginPartitioningEnabled=true ] -->
2+
<html>
3+
<head>
4+
<script src="../../../../resources/testharness.js"></script>
5+
<script src="../../../../resources/testharnessreport.js"></script>
6+
<script src="../../../../resources/js-test-pre.js"></script>
7+
</head>
8+
<body>
9+
<p id="description"></p>
10+
<div id="console"></div>
11+
<script>
12+
var test = async_test("Test for creating blob in iframe and then navigating to it from same-origin iframe and cross-origin main frames.");
13+
14+
let blobURL = "";
15+
let step = 0;
16+
let timeoutId;
17+
let handle;
18+
19+
function openBlobCreatingFrame(origin, step)
20+
{
21+
debug(`Opening ${origin} as main frame with iframe origin https://localhost:8443 creating blob`);
22+
handle = open(`${origin}/local/blob/resources/main-frame-with-iframe-creating-or-navigating-to-blob.html`, "test-main-frame-create-blob");
23+
assert_true(!!handle, `Opening ${origin} main frame for blob creation in step ${step} failed`);
24+
timeoutId = setTimeout(() => window.postMessage({ "status": "donefail", "message": `step ${step} timed out.` }, '*'), 2000);
25+
}
26+
27+
function handleMessage(e, nextOrigin)
28+
{
29+
let shouldStep = false;
30+
if (e.data.status) {
31+
if (e.data.status == "pass" || e.data.status == "done")
32+
testPassed(`${e.data.message}`);
33+
else if (e.data.status == "fail" || e.data.status == "donefail")
34+
testFailed(`${e.data.message}`);
35+
else
36+
testfailed(`Unexpected status: ${e.data.status}`);
37+
if (e.data.status == "done" || e.data.status == "donefail") {
38+
assert_true(e.data.url && e.data.url !== "", `Blob URL is not defined in step ${step}, status: ${e.data.status}, message: ${e.data.message}`);
39+
blobURL = encodeURI(e.data.url);
40+
shouldStep = true;
41+
}
42+
} else {
43+
testFailed(`Unexpected message: ${e.data.message}`);
44+
shouldStep = true;
45+
}
46+
47+
if (shouldStep) {
48+
if (handle) {
49+
handle.close();
50+
handle = undefined;
51+
}
52+
step = step + 1;
53+
if (step == 4) {
54+
// Load main frame from 127.0.0.1, iframe is loaded from localhost, create blob that is partitioned as https://localhost:8443 under http://127.0.0.1:8000.
55+
openBlobCreatingFrame(nextOrigin, step);
56+
} else if (!nextOrigin)
57+
return;
58+
else {
59+
debug(`Opening ${nextOrigin} as main frame with iframe origin https://localhost:8443`);
60+
assert_true(blobURL && blobURL !== "");
61+
handle = open(`${nextOrigin}/local/blob/resources/main-frame-with-iframe-creating-or-navigating-to-blob.html?url=${blobURL}`, "test-main-frame");
62+
assert_true(!!handle, `Opening ${origin} main frame for blob navigation in step ${step} failed`);
63+
timeoutId = setTimeout(() => window.postMessage({ "status": "donefail", "message": `step ${step} timed out.`, "url": blobURL }, '*'), 2000);
64+
}
65+
}
66+
}
67+
68+
window.onload = () => {
69+
// Load main frame from localhost, iframe is loaded from localhost, blob is partitioned as https://localhost:8443 under https://localhost:8443. Blob is accessible from https://localhost:8443.
70+
openBlobCreatingFrame(`https://localhost:8443`, step);
71+
}
72+
73+
window.addEventListener("message", (e) => {
74+
if (timeoutId) {
75+
clearTimeout(timeoutId);
76+
timeoutId = undefined;
77+
handle = undefined;
78+
} else if (handle == e.source) {
79+
// If the timeout callback was already called, then don't handle this message, it's too late.
80+
return;
81+
}
82+
83+
if (step == 0) {
84+
// On next step, load main frame from 127.0.0.1, iframe is loaded from localhost. Blob is not accessible from http://127.0.0.1:8000 iframe.
85+
handleMessage(e, "http://127.0.0.1:8000");
86+
} else if (step == 1) {
87+
// On next step, load main frame from http://localhost, iframe is loaded from https://localhost. Blob is not accessible from http://localhost:8000 iframe.
88+
handleMessage(e, "http://localhost:8000");
89+
} else if (step == 2) {
90+
// On next step, load main frame from https://localhost, iframe is loaded from https://localhost. Blob is accessible from https://localhost:8443 iframe.
91+
handleMessage(e, "https://localhost:8443");
92+
} else if (step == 3) {
93+
// On next step, load main frame from http://127.0.0.1, iframe is loaded from https://localhost. Blob is not accessible from https://localhost:8443 iframe.
94+
handleMessage(e, "http://127.0.0.1:8000");
95+
} else if (step == 4) {
96+
// On next step, load main frame from https://localhost, iframe is loaded from https://localhost. Blob is not accessible from https://localhost iframe.
97+
handleMessage(e, "https://localhost:8443");
98+
} else if (step == 5) {
99+
// On next step, load main frame from http://localhost, iframe is loaded from https://localhost. Blob is not accessible from http://localhost:8000 iframe.
100+
handleMessage(e, "http://localhost:8000");
101+
} else if (step == 6) {
102+
// On next step, load main frame from http://127.0.0.1, iframe is loaded from https://localhost. Blob is accessible from http://localhost:8000 iframe.
103+
handleMessage(e, "http://127.0.0.1:8000");
104+
} else if (step == 7) {
105+
handleMessage(e);
106+
if (step == 8 && e.data.status) {
107+
if (e.data.status == "done" || e.data.status == "donefail")
108+
test.done();
109+
}
110+
} else {
111+
testFailed(`Unexpected step: ${step}, ${e.data.message}`);
112+
}
113+
});
114+
</script>
115+
<script src="../../../../resources/js-test-post.js"></script>
116+
</body>
117+
</html>

‎LayoutTests/http/tests/local/blob/resources/broadcast-channel-proxy.html‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
2+
<html>
3+
<head>
4+
<script>
5+
if (window.opener) {
6+
const bc = new BroadcastChannel("blob-bc");
7+
bc.onmessage = (e) => window.opener.postMessage(e.data, '*');
8+
}
9+
</script>
10+
</head>
11+
</html>
12+

‎LayoutTests/http/tests/local/blob/resources/iframe-creating-or-downloading-blob.html‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
2+
<html>
3+
<body>
4+
<script>
5+
6+
function download(blobURL)
7+
{
8+
let downloadAnchor = document.createElement("a");
9+
downloadAnchor.href = blobURL;
10+
downloadAnchor.download = "testBlobFileName";
11+
document.body.appendChild(downloadAnchor);
12+
downloadAnchor.click();
13+
}
14+
15+
if (window.location.search) {
16+
let params = new URLSearchParams(document.location.search);
17+
let blobURL = decodeURI(params.get("url"));
18+
19+
download(blobURL);
20+
window.top.postMessage({ "from": "iframe", "status": "done", "message": "iframe: downloading blob", "url": blobURL }, "*");;
21+
} else {
22+
const documentContent = 'Downloaded!';
23+
let blob = new Blob([documentContent], { "type" : "text/html" });
24+
window.top.postMessage({ "from": "iframe", "status": "done", "message": "iframe: created blob", "url": URL.createObjectURL(blob) }, "*");;
25+
}
26+
</script>
27+
</body>
28+
</html>

0 commit comments

Comments
 (0)