1442689 - Restrict usage of synchronous XMLHttpRequest by feature policy

Status: ASSIGNED

(Core :: DOM: Networking, enhancement, P3)

Description

[Ian Clelland]

XMLHttpRequest objects can have their behavior controlled by feature policy
(https://github.com/whatwg/xhr/pull/177, not merged yet)

If the policy in the active document disallows the 'sync-xhr' feature, then calling .send() on the XMLHttpRequest object should throw a NetworkError (and ideally log a message to the developer console)

Demo: https://xhr.featurepolicy.rocks/
GitHub issue: https://github.com/whatwg/xhr/issues/178
Web Platform Tests: https://wpt.fyi/xhr/xmlhttprequest-sync-default-feature-policy.sub.html

Comment 1

[Thomas Wisniewski [:twisniewski]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=488b14f14e4a75d5d8878e518e6e3a1476711ed4

Comment 2

[Thomas Wisniewski [:twisniewski]]

Attachment: patch (do not land).diff

It seems we're not likely to move on this anytime soon, but I figured I might as well attach my patch here just in case.

Comment 3

[Anne (:annevk)]

This feature won't be supported in the allow attribute. It will instead be part of something called "Document Policies", see https://github.com/w3c/webappsec-feature-policy/blob/master/document-policy-explainer.md. This is still under design so not really ready for implementation.

Comment 4

[Thomas Wisniewski [:twisniewski]]

Comment on attachment 9050633 [details] [diff] [review]
patch (do not land).diff

Given that feature policy hasn't budged in four years, is still preffed off in Firefox by default, and the other browsers have been passing the WPTs.. I don't see any reason why we shouldn't just implement this in case we turn on the pref at some point. I'll post a fresh patch shortly.

Comment 5

[Thomas Wisniewski [:twisniewski]]

Attachment: Bug 1442689 - Add feature policy support for sync-xhr (behind the off-by-default feature policy pref); r?dlrobertson