You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by so...@apache.org on 2012/05/09 02:09:41 UTC

svn commit: r1335847 - in /myfaces/trinidad/branches/2.0.0.x-branch: src/site/xdoc/devguide/ trinidad-examples/trinidad-demo/src/main/webapp/WEB-INF/ trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/context/ trinidad-impl/src/main/java/o...

Author: sobryan
Date: Wed May  9 00:09:40 2012
New Revision: 1335847

URL: http://svn.apache.org/viewvc?rev=1335847&view=rev
Log:
TRINIDAD-2169 add framebusting support to handle clickjacking attacks

Added:
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/util/FrameBustingUtils.java
Modified:
    myfaces/trinidad/branches/2.0.0.x-branch/src/site/xdoc/devguide/configuration.xml
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-examples/trinidad-demo/src/main/webapp/WEB-INF/web.xml
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/context/TrinidadPhaseListener.java
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/xhtml/BodyRenderer.java
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/javascript/META-INF/adf/jsLibs/Page.js
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/xrts/org/apache/myfaces/trinidadinternal/resource/LoggerBundle.xrts
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimal-golden.xml
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalIE-golden.xml
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalIERtl-golden.xml
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalInacc-golden.xml
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalPPC-golden.xml
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalSaf-golden.xml
    myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalScrRdr-golden.xml

Modified: myfaces/trinidad/branches/2.0.0.x-branch/src/site/xdoc/devguide/configuration.xml
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/src/site/xdoc/devguide/configuration.xml?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/src/site/xdoc/devguide/configuration.xml (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/src/site/xdoc/devguide/configuration.xml Wed May  9 00:09:40 2012
@@ -351,6 +351,32 @@ Some Apache Trinidad configuration optio
 <code>&lt;context-param&gt;</code> elements in your
 <code>WEB-INF/web.xml</code>file.
 </p>
+
+<subsection name="org.apache.myfaces.trinidad.security.FRAME_BUSTING">
+
+<p>
+The parameter "org.apache.myfaces.trinidad.security.FRAME_BUSTING" controls the framebusting feature. 
+Framebusting stops content from running inside frames (meaning a frame or iframe tag).
+</p>
+<p>
+This context parameter is ignored when org.apache.myfaces.trinidad.util.ExternalContextUtils.isPortlet is true,
+and will behave as if the context parameter is set to 'never'.
+</p>
+<p>
+Possible values are:
+<ul>
+<li>differentOrigin - only bust frames if the an ancestor window origin and the
+                      frame origin are different. If the ancestor windows and frame have
+                      the same origin then allow the content to run in a frame. This is the default.
+</li>
+<li>always - always bust frames, meaning don't allow a page to be embedded in frames
+</li>
+<li>never - never bust frames, meaning always allow a page to be embedded in frames
+</li>
+</ul>
+</p>
+</subsection>
+
 <subsection name="org.apache.myfaces.trinidad.CACHE_VIEW_ROOT">
 <p>
 Enables or disables UIViewRoot caching;  defaults to true.

Modified: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-examples/trinidad-demo/src/main/webapp/WEB-INF/web.xml
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-examples/trinidad-demo/src/main/webapp/WEB-INF/web.xml?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-examples/trinidad-demo/src/main/webapp/WEB-INF/web.xml (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-examples/trinidad-demo/src/main/webapp/WEB-INF/web.xml Wed May  9 00:09:40 2012
@@ -34,6 +34,32 @@
     <param-value>.jspx</param-value>
   </context-param>
 
+   
+
+  <context-param> 
+    <!--description>
+      The parameter "org.apache.myfaces.trinidad.security.FRAME_BUSTING" controls 
+      the framebusting feature. Framebusting stops content from running inside 
+      frames (meaning a frame or iframe tag).
+
+      This context parameter is ignored when 
+      org.apache.myfaces.trinidad.util.ExternalContextUtils.isPortlet is true, 
+      and will behave as if the context parameter is set to 'never'.
+
+      Possible values are:
+
+          differentOrigin - only bust frames if the an ancestor window origin 
+                   and the frame origin are different. If the ancestor windows 
+                   and frame have the same origin then allow the content to run 
+                   in a frame. This is the default.
+          always - always bust frames, meaning don't allow a page to be embedded in frames
+          never - never bust frames, meaning always allow a page to be embedded in frames
+
+    </description-->
+    <param-name>org.apache.myfaces.trinidad.security.FRAME_BUSTING</param-name>
+    <param-value>differentOrigin</param-value>
+  </context-param> 
+
   <!-- Set to true for using the lightweight dialog feature -->
   <context-param>
     <param-name>org.apache.myfaces.trinidad.ENABLE_LIGHTWEIGHT_DIALOGS</param-name>

Modified: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/context/TrinidadPhaseListener.java
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/context/TrinidadPhaseListener.java?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/context/TrinidadPhaseListener.java (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/context/TrinidadPhaseListener.java Wed May  9 00:09:40 2012
@@ -26,6 +26,9 @@ import javax.faces.event.PhaseListener;
 
 import org.apache.myfaces.trinidadinternal.config.xmlHttp.XmlHttpConfigurator;
 import org.apache.myfaces.trinidadinternal.renderkit.core.CoreRenderKit;
+import org.apache.myfaces.trinidad.context.RequestContext;
+import org.apache.myfaces.trinidadinternal.util.FrameBustingUtils;
+import org.apache.myfaces.trinidadinternal.util.FrameBustingUtils.FrameBustingParamValue;
 
 /**
  * Performs some trinidad logic and provides some hooks.
@@ -68,11 +71,14 @@ public class TrinidadPhaseListener imple
   @SuppressWarnings("unchecked")
   public void beforePhase(PhaseEvent event)
   {
+    
+    PhaseId phaseId = event.getPhaseId();
+    
     // Ensure that the implicit object gets created.  In general,
     // "restore view" would be sufficient, but someone can call
     // renderResponse() before even calling Lifecycle.execute(),
     // in which case RESTORE_VIEW doesn't actually run.
-    if (event.getPhaseId() == PhaseId.RESTORE_VIEW)
+    if (phaseId == PhaseId.RESTORE_VIEW)
     {
       FacesContext context = event.getFacesContext();
       ExternalContext ec = context.getExternalContext();
@@ -82,11 +88,31 @@ public class TrinidadPhaseListener imple
     // If we've reached "apply request values", this is definitely a
     // postback (the ViewHandler should have reached the same conclusion too,
     // but make sure)
-    else if (event.getPhaseId() == PhaseId.APPLY_REQUEST_VALUES)
+    else if (phaseId == PhaseId.APPLY_REQUEST_VALUES)
     {
       FacesContext context = event.getFacesContext();
       markPostback(context);
     }
+       else if (phaseId == PhaseId.RENDER_RESPONSE)
+    {    
+      // add response headers for framebusting if needed
+
+      FacesContext context = event.getFacesContext();
+      FrameBustingParamValue frameBusting = FrameBustingUtils.getFrameBustingValue(context, RequestContext.getCurrentInstance());        
+  
+      if (! FrameBustingParamValue.FRAME_BUSTING_NEVER.equals(frameBusting))
+      {
+        // TODO: support CSP?
+        // https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html 
+        
+        // the X-Frame-Options header doesn't work on all browsers, but we're adding it anyway
+        String xFrameOptions = (FrameBustingParamValue.FRAME_BUSTING_ALWAYS.equals(frameBusting))
+                                  ? "deny"
+                                  : "sameorigin";
+
+        context.getExternalContext().addResponseHeader("X-Frame-Options", xFrameOptions); 
+      }
+    }    
   }
 
 

Modified: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/xhtml/BodyRenderer.java
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/xhtml/BodyRenderer.java?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/xhtml/BodyRenderer.java (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/renderkit/core/xhtml/BodyRenderer.java Wed May  9 00:09:40 2012
@@ -35,6 +35,8 @@ import org.apache.myfaces.trinidad.conte
 import org.apache.myfaces.trinidad.render.ExtendedRenderKitService;
 import org.apache.myfaces.trinidad.skin.Skin;
 import org.apache.myfaces.trinidad.util.Service;
+import org.apache.myfaces.trinidadinternal.util.FrameBustingUtils;
+import org.apache.myfaces.trinidadinternal.util.FrameBustingUtils.FrameBustingParamValue;
 
 
 /**
@@ -141,6 +143,10 @@ public class BodyRenderer extends PanelP
 
     if (supportsScripting(rc))
     {
+      // this sets display:none on body and removes it with javascript. If no javascript is supported,
+      // no need to render the script. (it breaks emailable page mode because display:none is never cleared) 
+      _renderFrameBustingScript(context, rc); 
+      
       _renderNoScript(context, rc);
       _storeInitialFocus(rc, component, bean);
     }
@@ -584,6 +590,47 @@ public class BodyRenderer extends PanelP
     return "(" + versionInfo + apiSpecTitle  + " - " + apiVersion  + "/"
                              + implSpecTitle + " - " + implVersion + ")";
   }
+  
+  private void _renderFrameBustingScript(
+    FacesContext     context,
+    RenderingContext rc
+  ) throws IOException
+  {    
+    // get the framebusting param set in web.xml
+    FrameBustingParamValue frameBusting = FrameBustingUtils.getFrameBustingValue(context, RequestContext.getCurrentInstance());
+    
+    if (! FrameBustingParamValue.FRAME_BUSTING_NEVER.equals(frameBusting))
+    {
+      ResponseWriter out = context.getResponseWriter();
+
+      // Add a style to hide the body tag, if the framebusting code runs and decides it does not
+      // need to bust frames then it will remove the style dom node, which will make the content
+      // visible.
+      //
+      // We are using a style element instead of setting a style/class directly on the
+      // body tag because if we ever added a splash screen it would not show.
+      // We are setting an id on the style so that it can be removed on the client,
+      // which will make the content visible.
+      //
+      // We had previously tried to use javascript to add display:block to the
+      // style attribute of the body tag, but the style attribute of the body tag can get removed,
+      // for example when you do ppr nav or you ppr the document. Therefore we are now
+      // removing the style element on the client.
+      //
+      out.startElement("style", null);
+      // an id cannot start with an underscore
+      out.writeAttribute("id", "trinFrameBustStyle", null);
+      out.writeText("body {display:none}", null);
+      out.endElement("style");
+
+      out.startElement("script", null);
+      XhtmlRenderer.renderScriptTypeAttribute(context, rc);
+      out.writeText("TrPage.__frameBusting(\"", null);
+      out.writeText(frameBusting, null);
+      out.writeText("\");", null);
+      out.endElement("script");
+    }
+  }  
 
   private PropertyKey _firstClickPassedKey;
   private PropertyKey _initialFocusIdKey;

Added: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/util/FrameBustingUtils.java
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/util/FrameBustingUtils.java?rev=1335847&view=auto
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/util/FrameBustingUtils.java (added)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/java/org/apache/myfaces/trinidadinternal/util/FrameBustingUtils.java Wed May  9 00:09:40 2012
@@ -0,0 +1,153 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.myfaces.trinidadinternal.util;
+
+
+import java.util.concurrent.ConcurrentMap;
+
+import javax.faces.context.FacesContext;
+
+import org.apache.myfaces.trinidad.util.ExternalContextUtils;
+
+import org.apache.myfaces.trinidad.context.RequestContext;
+import org.apache.myfaces.trinidad.logging.TrinidadLogger;
+
+/**
+ * @author Gabrielle Crawford
+ */
+public class FrameBustingUtils
+{
+
+  // This parameter controls the framebusting feature. framebusting stops content from
+  //       running inside frames (meaning a frame or iframe tag).
+  //
+  //       This context parameter is ignored when
+  //       org.apache.myfaces.trinidad.util.ExternalContextUtils.isPortlet is true,
+  //       and will behave as if the context parameter is set to 'never'.
+  //
+  //       Possible values are:
+  //         differentOrigin - only bust frames if the an ancestor window origin and the
+  //                     frame origin are different. If the ancestor windows and frame have
+  //                     the same origin then allow the content to run in a frame.
+  //                     This is the default.
+  //         always - always bust frames, meaning don't allow a page to be embedded in frames
+  //         never - never bust frames, meaning always allow a page to be embedded in frames
+  static public final String FRAME_BUSTING_PARAM = "org.apache.myfaces.trinidad.security.FRAME_BUSTING";
+  
+  public static enum FrameBustingParamValue
+  {
+
+    FRAME_BUSTING_NEVER("never"),
+    FRAME_BUSTING_ALWAYS("always"),
+    FRAME_BUSTING_DIFFERENT_ORIGIN("differentOrigin");
+
+    FrameBustingParamValue(String value)
+    {
+      _value = value;
+    }
+    
+    /**
+     * toString returns the vary-type value.
+     * @return the vary-type value.
+     */
+    public String toString()
+    {
+      return _value;
+    }
+
+    public String displayName()
+    {
+      return _value;
+    }
+    
+    private String _value;
+    
+    public static FrameBustingParamValue valueOfDisplayName(String displayName) 
+    {
+      if (FRAME_BUSTING_NEVER.displayName().equalsIgnoreCase(displayName))
+        return FRAME_BUSTING_NEVER;
+      else if (FRAME_BUSTING_ALWAYS.displayName().equalsIgnoreCase(displayName))
+        return FRAME_BUSTING_ALWAYS;
+      else  if (FRAME_BUSTING_DIFFERENT_ORIGIN.displayName().equalsIgnoreCase(displayName))        
+        return FRAME_BUSTING_DIFFERENT_ORIGIN;
+      
+      return null;
+    }
+    
+  }
+  
+  public static FrameBustingParamValue getFrameBustingValue(FacesContext context, RequestContext reqContext)
+  {   
+    // Act as if the value is never if
+    // 1. we're doing ppr, we should only need to bust frames on a full page render
+    // 2. if we're in a portal    
+    //     Portals have a concept of producers and consumers.
+    //     The main page is the consumer, and the portlets inside that page are the producers.
+    //     Producer content can only be accessed by trusted consumers.
+    //
+    //     The consumer page can set the context param as needed,
+    //     but the producers will not do framebusting.
+    //     In other words when ExternalContextUtils.isPortlet is true we will behave as if
+    //     the context param is set to 'never'.
+    if ( reqContext.isPartialRequest(context) ||
+         ExternalContextUtils.isPortlet(context.getExternalContext()))
+    {
+      return FrameBustingParamValue.FRAME_BUSTING_NEVER;    
+    }    
+    
+    ConcurrentMap<String, Object> appMap = reqContext.getApplicationScopedConcurrentMap();
+    FrameBustingParamValue frameBusting = (FrameBustingParamValue)appMap.get(FRAME_BUSTING_PARAM);
+    
+    if (frameBusting == null)
+    {
+      String frameBustingString = context.getExternalContext().getInitParameter(FRAME_BUSTING_PARAM);   
+      
+      if  (frameBustingString == null)
+      {
+        frameBusting = FrameBustingParamValue.FRAME_BUSTING_DIFFERENT_ORIGIN;
+      }
+      else
+      {        
+        frameBusting = FrameBustingParamValue.valueOfDisplayName(frameBustingString);   
+        
+        if (frameBusting == null)
+        {
+          frameBusting = FrameBustingParamValue.FRAME_BUSTING_DIFFERENT_ORIGIN;
+        
+          // if the context param was set but does not match a known legal value then log a warning
+          _LOG.warning("UNKNOWN_FRAME_BUSTING_VALUE");
+        }
+      }
+      
+      appMap.put(FRAME_BUSTING_PARAM, frameBusting);
+    }
+
+    return frameBusting;
+  }  
+  
+  public static void overrideFrameBustingValue(RequestContext reqContext, FrameBustingParamValue frameBusting)
+  {         
+    ConcurrentMap<String, Object> appMap = reqContext.getApplicationScopedConcurrentMap();      
+    appMap.put(FRAME_BUSTING_PARAM, frameBusting);
+  }    
+
+
+  static private final TrinidadLogger _LOG = 
+                             TrinidadLogger.createTrinidadLogger(FrameBustingUtils.class);  
+}

Modified: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/javascript/META-INF/adf/jsLibs/Page.js
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/javascript/META-INF/adf/jsLibs/Page.js?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/javascript/META-INF/adf/jsLibs/Page.js (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/javascript/META-INF/adf/jsLibs/Page.js Wed May  9 00:09:40 2012
@@ -1019,4 +1019,66 @@ TrPage.prototype._getDomToBeUpdated = fu
   }
 
   return oldElements;
-}
\ No newline at end of file
+}
+
+
+// static method called on server
+TrPage.__frameBusting = function(frameBusting)
+{
+
+  if ( !(self == top || frameBusting == "never"))
+  {
+    if (frameBusting == "always")
+    {
+      top.location.href = location.href;
+    }
+    else
+    {
+      var topNotProcessed = true;
+      var parentWindow = parent;
+
+      while (topNotProcessed)
+      {
+        try
+        {
+          // if we have a different origin parentWindow.location.href will throw an exception
+          // in firefox and IE
+          var parentWindowLocation = parentWindow.location.href;
+
+          // in safari and google chrome no exception is thrown for referring to
+          // parentWindow.location.href, instead the parent window location is undefined
+          if (parentWindowLocation == null)
+          {
+            top.location.href = location.href;
+            return;
+          }
+        }
+        catch(e)
+        {
+          // the content has different origin, redirect 
+          top.location.href = location.href;
+          return;
+        }
+
+        if (parentWindow == top)
+          topNotProcessed = false;
+
+        parentWindow = parentWindow.parent;
+      }
+    }
+  }
+
+  // we didn't end up framebusting, so show the content
+  //
+  // We had previously tried to use javascript to add display:block to the
+  // style attribute of the body tag, but the style attribute of the body tag can get removed,
+  // for example when you do ppr nav or you ppr the document. Therefore we are now
+  // removing the style element on the client.
+  var styleNode = document.getElementById("trinFrameBustStyle");
+
+  if (styleNode)
+  {
+    styleNode.parentNode.removeChild(styleNode);
+  }
+}
+

Modified: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/xrts/org/apache/myfaces/trinidadinternal/resource/LoggerBundle.xrts
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/xrts/org/apache/myfaces/trinidadinternal/resource/LoggerBundle.xrts?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/xrts/org/apache/myfaces/trinidadinternal/resource/LoggerBundle.xrts (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/main/xrts/org/apache/myfaces/trinidadinternal/resource/LoggerBundle.xrts Wed May  9 00:09:40 2012
@@ -27,6 +27,9 @@
 <!-- UNKNOWN_AGENT_TYPE_CREATE_WITH_NULL -->
 <resource key="UNKNOWN_AGENT_TYPE_CREATE_WITH_NULL">The agent type is unknown; creating an agent with null agent attributes.</resource>
 
+<!-- UNKNOWN_FRAME_BUSTING_VALUE -->
+<resource key="UNKNOWN_FRAME_BUSTING_VALUE">The web.xml context param org.apache.myfaces.trinidad.security.FRAME_BUSTING is set to an unknow value, the legal value are 'never', 'always', or 'differentOrigin'.</resource>
+
 <!-- CANNOT_GET_CAPABILITIES -->
 <resource key="CANNOT_GET_CAPABILITIES">could not get capabilities from capabilities document</resource>
 

Modified: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimal-golden.xml
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimal-golden.xml?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimal-golden.xml (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimal-golden.xml Wed May  9 00:09:40 2012
@@ -10,6 +10,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -33,6 +43,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -57,6 +77,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -81,6 +111,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -105,6 +145,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -129,6 +179,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -153,6 +213,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -177,6 +247,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -200,6 +280,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -224,6 +314,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -248,6 +348,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -272,6 +382,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -296,6 +416,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -320,6 +450,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -343,6 +483,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.

Modified: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalIE-golden.xml
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalIE-golden.xml?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalIE-golden.xml (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalIE-golden.xml Wed May  9 00:09:40 2012
@@ -10,6 +10,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -33,6 +43,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -57,6 +77,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -81,6 +111,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -105,6 +145,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -129,6 +179,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -153,6 +213,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -177,6 +247,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -200,6 +280,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -224,6 +314,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -248,6 +348,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -272,6 +382,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -296,6 +416,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -320,6 +450,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -343,6 +483,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.

Modified: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalIERtl-golden.xml
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalIERtl-golden.xml?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalIERtl-golden.xml (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalIERtl-golden.xml Wed May  9 00:09:40 2012
@@ -10,6 +10,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -33,6 +43,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -57,6 +77,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -81,6 +111,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -105,6 +145,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -129,6 +179,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -153,6 +213,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -177,6 +247,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -200,6 +280,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -224,6 +314,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -248,6 +348,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -272,6 +382,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -296,6 +416,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -320,6 +450,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -343,6 +483,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.

Modified: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalInacc-golden.xml
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalInacc-golden.xml?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalInacc-golden.xml (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalInacc-golden.xml Wed May  9 00:09:40 2012
@@ -10,6 +10,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -29,6 +38,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -49,6 +67,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -69,6 +96,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -89,6 +125,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -109,6 +154,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -129,6 +183,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -149,6 +212,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -168,6 +240,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -188,6 +269,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -208,6 +298,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -228,6 +327,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -248,6 +356,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -268,6 +385,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >
@@ -287,6 +413,15 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <span
          id="id_text"
         >

Modified: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalPPC-golden.xml
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalPPC-golden.xml?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalPPC-golden.xml (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalPPC-golden.xml Wed May  9 00:09:40 2012
@@ -9,6 +9,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -31,6 +41,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -54,6 +74,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -77,6 +107,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -100,6 +140,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -123,6 +173,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -146,6 +206,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -169,6 +239,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -191,6 +271,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -214,6 +304,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -237,6 +337,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -260,6 +370,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -283,6 +403,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -306,6 +436,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -329,6 +469,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.

Modified: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalSaf-golden.xml
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalSaf-golden.xml?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalSaf-golden.xml (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalSaf-golden.xml Wed May  9 00:09:40 2012
@@ -10,6 +10,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -33,6 +43,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -57,6 +77,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -81,6 +111,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -105,6 +145,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -129,6 +179,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -153,6 +213,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -177,6 +247,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -200,6 +280,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -224,6 +314,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -248,6 +348,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -272,6 +382,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -296,6 +416,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -320,6 +450,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -343,6 +483,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.

Modified: myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalScrRdr-golden.xml
URL: http://svn.apache.org/viewvc/myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalScrRdr-golden.xml?rev=1335847&r1=1335846&r2=1335847&view=diff
==============================================================================
--- myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalScrRdr-golden.xml (original)
+++ myfaces/trinidad/branches/2.0.0.x-branch/trinidad-impl/src/test/resources/org/apache/myfaces/trinidadinternal/renderkit/golden/body-minimalScrRdr-golden.xml Wed May  9 00:09:40 2012
@@ -10,6 +10,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -33,6 +43,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -57,6 +77,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -81,6 +111,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -105,6 +145,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -129,6 +179,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -153,6 +213,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -177,6 +247,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -200,6 +280,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -224,6 +314,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -248,6 +348,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -272,6 +382,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -296,6 +416,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -320,6 +450,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.
@@ -343,6 +483,16 @@
         >
       
     </a>
+    <style
+         id="trinFrameBustStyle"
+        >
+      body {display:none}
+    </style>
+    <script
+         type="text/javascript"
+        >
+      TrPage.__frameBusting("differentOrigin");
+    </script>
     <noscript
         >
       This page uses JavaScript and requires a JavaScript enabled browser.Your browser is not JavaScript enabled.