|
24 | 24 | <script src="js/utils.js"></script> |
25 | 25 | </head> |
26 | 26 | <body> |
27 | | - <div class="card" id="realtime-output"></div> |
28 | | - <script src="js/realtime.js"></script> |
29 | | - |
30 | | - <div class="card" id="cookies-output"></div> |
31 | | - <script src="js/cookies.js"></script> |
32 | | - |
33 | | - <div class="card" id="storage-output"></div> |
34 | | - <script src="js/storage.js"></script> |
35 | | - |
36 | | - <div class="card" id="uploads-output"></div> |
37 | | - <script src="js/uploads.js"></script> |
38 | | - |
39 | | - <div class="card" id="import-export-output"></div> |
40 | | - <script src="js/import-export.js"></script> |
41 | | - |
42 | | - <div class="card" id="unload-output"></div> |
43 | | - <script src="js/unload.js"></script> |
44 | | - |
45 | | - <div class="card" id="navigator-output"></div> |
46 | | - <script src="js/navigator.js"></script> |
47 | | - |
48 | | - <div class="card" id="update-api-output"></div> |
49 | | - <script src="js/update-api.js"></script> |
50 | | - |
51 | | - <div class="card" id="races-output"></div> |
52 | | - <script src="js/races.js"></script> |
53 | | - |
54 | | - <div class="card" id="wasm-output"></div> |
55 | | - <script src="js/wasm.js"></script> |
56 | | - |
57 | | - <div class="card" id="camera-access"></div> |
58 | | - <script src="js/media-access.js"></script> |
59 | | - |
60 | | - <iframe id="iframe-regular" style="display: none"></iframe> |
61 | | - <iframe |
62 | | - id="iframe-allow-same-origin" |
63 | | - sandbox="allow-same-origin" |
64 | | - style="display: none" |
65 | | - ></iframe> |
66 | | - <div class="card" id="webrtc-output"></div> |
67 | | - <script src="js/webrtc.js"></script> |
68 | | - <iframe |
69 | | - src="./iframe-webrtc-test.html" |
70 | | - sandbox="allow-scripts" |
71 | | - width="100%" |
72 | | - height="200" |
73 | | - ></iframe> |
74 | | - |
75 | | - <!-- DNS prefetch check, originally developed by Cure53 |
76 | | - and distributed as "Cure53 Test App - DNS checker" app. |
77 | | - See https://delta.chat/en/2023-05-22-webxdc-security#dns-prefetching-marks-another-exploit. --> |
78 | | - <div class="dns-prefetch-output"> |
79 | | - <header class="container"> |
80 | | - <h2>DNS Prefetch</h2> |
81 | | - </header> |
82 | | - <div class="container"> |
83 | | - <section> |
84 | | - <p>Usage instructions:</p> |
85 | | - <ol> |
86 | | - <li> |
87 | | - Navigate to |
88 | | - <a href="https://dig.pm/">https://dig.pm/</a> |
89 | | - and click Get Sub Domain. |
90 | | - </li> |
91 | | - <li>Input the subdomain from Step 1.</li> |
92 | | - <li>Click all 3 of the buttons.</li> |
93 | | - <li>Click Get Results on https://dig.pm/.</li> |
94 | | - <li>Observe the DNS lookup record.</li> |
95 | | - </ol> |
96 | | - <p> |
97 | | - Also see |
98 | | - <a |
99 | | - href="https://public.opentech.fund/documents/XDC-01-report_2_1.pdf" |
100 | | - >the audit</a |
101 | | - > |
102 | | - and |
103 | | - <a href="https://delta.chat/en/2023-05-22-webxdc-security" |
104 | | - >the blog post</a |
105 | | - >. |
106 | | - </p> |
107 | | - </section> |
108 | | - <p> |
109 | | - You can also utilize Wireshark, then https://dig.pm/ is not needed. |
110 | | - </p> |
111 | | - <input |
112 | | - id="dns-prefetch-domain-input" |
113 | | - type="text" |
114 | | - placeholder="abc.example.com" |
115 | | - required |
116 | | - /> |
117 | | - <br /> |
118 | | - <button type="button" onclick="dnsPrefetchUpdateLocation()"> |
119 | | - Update top.location |
120 | | - </button> |
121 | | - <br /> |
122 | | - <button type="button" onclick="dnsPrefetchAddIframe()"> |
123 | | - Add iframe |
124 | | - </button> |
125 | | - <br /> |
126 | | - <button type="button" onclick="dnsPrefetchAddPrefetch()"> |
127 | | - Add <link dns-prefetch> |
128 | | - </button> |
129 | | - <br /> |
130 | | - <iframe id="dns-prefetch-frame"></iframe> |
| 27 | + <div class="pages"> |
| 28 | + <div class="page active" id="page-webxdc"> |
| 29 | + <div class="card" id="realtime-output"></div> |
| 30 | + <script src="js/realtime.js"></script> |
| 31 | + <div class="card" id="uploads-output"></div> |
| 32 | + <script src="js/uploads.js"></script> |
| 33 | + <div class="card" id="import-export-output"></div> |
| 34 | + <script src="js/import-export.js"></script> |
| 35 | + <div class="card" id="update-api-output"></div> |
| 36 | + <script src="js/update-api.js"></script> |
| 37 | + |
| 38 | + <div class="card"> |
| 39 | + <header class="container"><h2>Webxdc Status Update Tests</h2></header> |
| 40 | + <div class="container"> |
| 41 | + <a href="./duplicated_updates_race.html"> |
| 42 | + Duplicated Status Updates Race Test |
| 43 | + </a> |
| 44 | + </div> |
| 45 | + </div> |
| 46 | + |
| 47 | + <div class="card" id="links-output"></div> |
| 48 | + <script src="js/links.js"></script> |
| 49 | + |
| 50 | + <div class="card" id="info-output"></div> |
| 51 | + <script src="js/info.js"></script> |
131 | 52 | </div> |
132 | | - </div> |
133 | | - <script src="js/dns-prefetch.js"></script> |
134 | | - |
135 | | - <div class="card"> |
136 | | - <header class="container"><h2>Webxdc Status Update Tests</h2></header> |
137 | | - <div class="container"> |
138 | | - <a href="./duplicated_updates_race.html"> |
139 | | - Duplicated Status Updates Race Test |
140 | | - </a> |
| 53 | + <div class="page" id="page-web-api"> |
| 54 | + <div class="card" id="storage-output"></div> |
| 55 | + <script src="js/storage.js"></script> |
| 56 | + <div class="card" id="unload-output"></div> |
| 57 | + <script src="js/unload.js"></script> |
| 58 | + <div class="card" id="navigator-output"></div> |
| 59 | + <script src="js/navigator.js"></script> |
| 60 | + |
| 61 | + <div class="card" id="races-output"></div> |
| 62 | + <script src="js/races.js"></script> |
| 63 | + |
| 64 | + <div class="card" id="wasm-output"></div> |
| 65 | + <script src="js/wasm.js"></script> |
| 66 | + </div> |
| 67 | + <div class="page" id="page-sandbox"> |
| 68 | + <div class="card" id="cookies-output"></div> |
| 69 | + <script src="js/cookies.js"></script> |
| 70 | + <div class="card" id="camera-access"></div> |
| 71 | + <script src="js/media-access.js"></script> |
| 72 | + |
| 73 | + <iframe id="iframe-regular" style="display: none"></iframe> |
| 74 | + <iframe |
| 75 | + id="iframe-allow-same-origin" |
| 76 | + sandbox="allow-same-origin" |
| 77 | + style="display: none" |
| 78 | + ></iframe> |
| 79 | + <div class="card" id="webrtc-output"></div> |
| 80 | + <script src="js/webrtc.js"></script> |
| 81 | + <iframe |
| 82 | + src="./iframe-webrtc-test.html" |
| 83 | + sandbox="allow-scripts" |
| 84 | + width="100%" |
| 85 | + height="200" |
| 86 | + ></iframe> |
| 87 | + |
| 88 | + <!-- DNS prefetch check, originally developed by Cure53 |
| 89 | + and distributed as "Cure53 Test App - DNS checker" app. |
| 90 | + See https://delta.chat/en/2023-05-22-webxdc-security#dns-prefetching-marks-another-exploit. --> |
| 91 | + <div class="dns-prefetch-output"> |
| 92 | + <header class="container"> |
| 93 | + <h2>DNS Prefetch</h2> |
| 94 | + </header> |
| 95 | + <div class="container"> |
| 96 | + <section> |
| 97 | + <p>Usage instructions:</p> |
| 98 | + <ol> |
| 99 | + <li> |
| 100 | + Navigate to |
| 101 | + <a href="https://dig.pm/">https://dig.pm/</a> |
| 102 | + and click Get Sub Domain. |
| 103 | + </li> |
| 104 | + <li>Input the subdomain from Step 1.</li> |
| 105 | + <li>Click all 3 of the buttons.</li> |
| 106 | + <li>Click Get Results on https://dig.pm/.</li> |
| 107 | + <li>Observe the DNS lookup record.</li> |
| 108 | + </ol> |
| 109 | + <p> |
| 110 | + Also see |
| 111 | + <a |
| 112 | + href="https://public.opentech.fund/documents/XDC-01-report_2_1.pdf" |
| 113 | + >the audit</a |
| 114 | + > |
| 115 | + and |
| 116 | + <a href="https://delta.chat/en/2023-05-22-webxdc-security" |
| 117 | + >the blog post</a |
| 118 | + >. |
| 119 | + </p> |
| 120 | + </section> |
| 121 | + <p> |
| 122 | + You can also utilize Wireshark, then https://dig.pm/ is not |
| 123 | + needed. |
| 124 | + </p> |
| 125 | + <input |
| 126 | + id="dns-prefetch-domain-input" |
| 127 | + type="text" |
| 128 | + placeholder="abc.example.com" |
| 129 | + required |
| 130 | + /> |
| 131 | + <br /> |
| 132 | + <button type="button" onclick="dnsPrefetchUpdateLocation()"> |
| 133 | + Update top.location |
| 134 | + </button> |
| 135 | + <br /> |
| 136 | + <button type="button" onclick="dnsPrefetchAddIframe()"> |
| 137 | + Add iframe |
| 138 | + </button> |
| 139 | + <br /> |
| 140 | + <button type="button" onclick="dnsPrefetchAddPrefetch()"> |
| 141 | + Add <link dns-prefetch> |
| 142 | + </button> |
| 143 | + <br /> |
| 144 | + <iframe id="dns-prefetch-frame"></iframe> |
| 145 | + </div> |
| 146 | + </div> |
| 147 | + <script src="js/dns-prefetch.js"></script> |
141 | 148 | </div> |
142 | 149 | </div> |
143 | | - |
144 | | - <div class="card" id="links-output"></div> |
145 | | - <script src="js/links.js"></script> |
146 | | - |
147 | | - <div class="card" id="info-output"></div> |
148 | | - <script src="js/info.js"></script> |
| 150 | + <div class="tabs"> |
| 151 | + <div class="tab active" id="tab-webxdc">Webxdc</div> |
| 152 | + <div class="tab" id="tab-web-api">Web API</div> |
| 153 | + <div class="tab" id="tab-sandbox">Sandboxing</div> |
| 154 | + </div> |
| 155 | + <script> |
| 156 | + var tabs = [ |
| 157 | + { |
| 158 | + page: document.getElementById("page-webxdc"), |
| 159 | + tab: document.getElementById("tab-webxdc"), |
| 160 | + }, |
| 161 | + { |
| 162 | + page: document.getElementById("page-web-api"), |
| 163 | + tab: document.getElementById("tab-web-api"), |
| 164 | + }, |
| 165 | + { |
| 166 | + page: document.getElementById("page-sandbox"), |
| 167 | + tab: document.getElementById("tab-sandbox"), |
| 168 | + }, |
| 169 | + ]; |
| 170 | + for (const {page, tab} of tabs) { |
| 171 | + tab.onclick = () => { |
| 172 | + tabs.forEach(({page, tab}) => { |
| 173 | + page.classList.remove("active") |
| 174 | + tab.classList.remove("active") |
| 175 | + }); |
| 176 | + page.classList.add("active") |
| 177 | + tab.classList.add("active") |
| 178 | + } |
| 179 | + } |
| 180 | + </script> |
149 | 181 | </body> |
150 | 182 | </html> |
0 commit comments