1270050 - W3C origin-when-crossorigin vs origin-when-cross-origin

Status: RESOLVED FIXED

(Core :: DOM: Security, defect)

Description

[Thomas Nguyen (:tnguyen)]

https://github.com/w3c/webappsec/commit/c992d5cd9c93eaa509ee499efd7ef8f5ab9811d8

Seems that origin-when-crossorigin will be replaced by origin-when-cross-origin.
However many web platform tests currently (and current public version) are using origin-when-crossorigin.

origin-when-crossorigin value should be treated as valid value as well.

Comment 1

[Thomas Nguyen (:tnguyen)]

Discussed internally and we thought that the wpt should use latest and correct value "origin-when-cross-origin".
What we should do is to change this value correctly in referrer-policy web platform test.

Comment 2

[Christoph Kerschbaumer [:ckerschb]]

Franziskus, just making sure you have seen this bug.

Comment 3

[Thomas Nguyen (:tnguyen)]

I would like to add some additional information: 
There's a typo issue in specs (editor's reply in [1], [2], should be Mike). Old version specs [3] and new one [4] should be public soon
`origin-when-cross-origin` is correct but Chrome and Firefox already ship `origin-when-crossorigin` and sites already used it

In current version, Google supports both of `origin-when-crossorigin` and `origin-when-cross-origin` (I tried with Google Canary and web platform tests are passed with both of them). However, running web platform tests in Firefox still fails in this sort of test (~28 cases failed with setAttribute), because `origin-when-crossorigin` is still considered as invalid value attribute (Bug 1178337 has just fixed recently but only added `origin-when-cross-origin` to the valid enums)

[1] https://lists.w3.org/Archives/Public/public-webappsec/2015May/0064.html
[2] https://lists.w3.org/Archives/Public/public-webappsec/2015May/0091.html
[3] https://www.w3.org/TR/referrer-policy/#referrer-policy-delivery-meta
[4] https://w3c.github.io/webappsec-referrer-policy/

Currently referrer policy web platform tests are written based on the old one `origin-when-crossorigin`
I discussed with Franziskus and there're 2 ways to go:
- Support `origin-when-crossorigin` in Firefox
- Fix web platform test to use `origin-when-cross-origin` because `origin-when-crossorigin`  will be deprecated soon
It makes more sense to go second one. And Franziskus should know about that
:) Thanks

Comment 4

[Thomas Nguyen (:tnguyen)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=6759f071a967

Comment 5

[Thomas Nguyen (:tnguyen)]

Attachment: Change `crossorigin` to `cross-origin`

Comment 6

[Thomas Nguyen (:tnguyen)]

Attachment: Update meta file

Comment 7

[Thomas Nguyen (:tnguyen)]

Hi Christoph,
Could you please take a look into that?
This renamed  `origin-when-crossorigin` --> `origin-when-cross-origin` in web platform tests and updated meta file as well

Comment 8

[Christoph Kerschbaumer [:ckerschb]]

Comment on attachment 8750154 [details] [diff] [review]
Change `crossorigin` to `cross-origin`

Franziskus is the right reviewer for this.

Comment 9

[Franziskus Kiefer [:franziskus]]

Comment on attachment 8750154 [details] [diff] [review]
Change `crossorigin` to `cross-origin`

Review of attachment 8750154 [details] [diff] [review]:
-----------------------------------------------------------------

I still see some |crossorigin| in spec_json.js. r+ with those fixed as well.

Comment 10

[Thomas Nguyen (:tnguyen)]

Attachment: Change `crossorigin` to `cross-origin`

Thanks Franziskus for your reviewing

Comment 11

[Thomas Nguyen (:tnguyen)]

Try looks good
https://treeherder.mozilla.org/#/jobs?repo=try&revision=eb1005956bb3

Comment 12

[Franziskus Kiefer [:franziskus]]

(In reply to Thomas Nguyen[:tnguyen] from comment #11)
> Try looks good
> https://treeherder.mozilla.org/#/jobs?repo=try&revision=eb1005956bb3

what's up with all the oranges on Win7?

Comment 13

[Thomas Nguyen (:tnguyen)]

Something went wrong with windows 7 recently. 
You could see all of try results have the same result with many failures on Windows 7(click: go next 50)

Comment 14

[Thomas Nguyen (:tnguyen)]

Hi Josh, could you please review this?
This only renamed  `origin-when-crossorigin` --> `origin-when-cross-origin` in web platform tests and updated meta file as well.

Comment 15

[Josh Matthews [:jdm]]

Comment on attachment 8753752 [details] [diff] [review]
Change `crossorigin` to `cross-origin`

Review of attachment 8753752 [details] [diff] [review]:
-----------------------------------------------------------------

This appears to be racing with https://github.com/w3c/web-platform-tests/pull/3059, so we'll see what happens!

Comment 16

[Thomas Nguyen (:tnguyen)]

Try result in comment 11

Comment 17

[Thomas Nguyen (:tnguyen)]

Thanks Josh and Franziskus for your review.

Comment 18

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/d67e5ce76bf5
https://hg.mozilla.org/integration/mozilla-inbound/rev/54be367a7ed9

Comment 19

[Carsten Book [:Tomcat]]

for some reasons starting with this push we have perma failures like https://treeherder.mozilla.org/logviewer.html#?job_id=28628738&repo=mozilla-inbound so i had to back this out

Comment 20

[Pulsebot]

Backout:
https://hg.mozilla.org/integration/mozilla-inbound/rev/51b499637697
https://hg.mozilla.org/integration/mozilla-inbound/rev/2adb4dd6324d

Comment 21

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9a7ac883cb35
https://hg.mozilla.org/integration/mozilla-inbound/rev/07ede99a3cd3

Comment 22

[Carsten Book [:Tomcat]]

did some investigation and seems your patch is innocent (sorry for the backout) and all the timeouts where more caused by bug 1275281 - sorry for the backout again - re-checked this in

Comment 23

[Thomas Nguyen (:tnguyen)]

Nice, thanks

Comment 24

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/9a7ac883cb35
https://hg.mozilla.org/mozilla-central/rev/07ede99a3cd3