1265961 - Fix referrers for subresources in srcdoc iframes

Status: RESOLVED DUPLICATE of bug 1534681

(Core :: DOM: Core & HTML, defect, P3)

Description

[Boris Zbarsky [:bzbarsky]]

We seems to use document->GetDocumentURI() as the referrer, in general.  But for srcdoc iframes, this is wrong: it should be the referrer URI of the parent document.  See https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer step 3 substep 3 subsubstep 3 subsubsubstep 2.

I'm going to get tests landed in wpt for this first (because the setup of the referrer-policy tests is nontrivial and needs actual review from their owner over in github), then implement the various changes needed here.  https://github.com/w3c/web-platform-tests/pull/2851 tracks that.

Comment 1

[Boris Zbarsky [:bzbarsky]]

Oh, and note that srcdoc will also need to inherit referrer policy.  Need to check how exactly this should work.  Now that I'm carefully reading this referrer policy spec, it's got all sorts of issues.  :(

Comment 2

[Boris Zbarsky [:bzbarsky]]

Another note: the web platform tests for referrer-policy are not really owned and the people who are supposed to take a look at my proposed changes are being AWOL.  The answer might just end up being that I push changes without their review and call it a day...

Comment 3

[Ben Kelly [:bkelly, not reviewing]]

I'm enabling a bunch of referrer-policy tests over in bug 1341079.  A number of failures are revealed that all appear to be due to srcdoc.  I'll need info here once they are enabled and marked expected fail.

Comment 4

[Ben Kelly [:bkelly, not reviewing]]

I've enabled the tests and marked a bunch expected fail due to srcdoc.  See:

https://hg.mozilla.org/integration/mozilla-inbound/rev/b4f01417998f

Comment 5

[Boris Zbarsky [:bzbarsky]]

Note to self: KeyframeUtils definitely has a place that uses the document URI as referrer.

Comment 6

[Ben Kelly [:bkelly, not reviewing]]

Note, we do pull referrer from the principal spec for the non-document worker case.  Maybe you could do the same here if we inherit the right principal.

I'd love to fix that, though.  Getting the referrer from the principal spec is incredibly error prone.  See bug 1340694.  Long term I plan to expose a "ClientInfo" data structure that can be associated with any environment/environment settings object.  So both document and worker would have one.  I'm hoping we can make referrer code pull from this ClientInfo data so it just works for all cases.

Comment 7

[Boris Zbarsky [:bzbarsky]]

And SVG's MappedAttrParser.  And in fact, all CSS parsing in general.  :(

Comment 8

[Boris Zbarsky [:bzbarsky]]

Oh, in terms of fixing this for srcdoc we'll do it by just looking at the parent.  Doing it for other things that should "inherit" the referrer will be more complicated.

And the hardest (or at least most annoying) part is finding all the places that currently assume referrer URI == document URI and fixing them.