18 lines
397 B
HTML
18 lines
397 B
HTML
<body>
|
|
<script>
|
|
if (window.testRunner)
|
|
testRunner.dumpAsText();
|
|
|
|
alert(1);
|
|
var doc = document.implementation.createDocument('http://www.w3.org/1999/xhtml', 'html', null);
|
|
alert(2);
|
|
var ifr = doc.createElement('iframe');
|
|
alert(3);
|
|
ifr.setAttribute('src', 'javascript:alert(7)');
|
|
alert(4);
|
|
var adopted = document.adoptNode(ifr)
|
|
alert(5);
|
|
document.body.appendChild(adopted);
|
|
alert(6);
|
|
</script>
|