1454721 - Add same-site cookie test for about:blank and about:srcdoc

Status: RESOLVED FIXED

(Core :: DOM: Security, enhancement, P1)

Comment 1

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1454721_test_same_site_about.patch

Hey Dan, as far as I understand this is the behavior we are expecting fro about:srcdoc and about:blank which both inherit the security context.

If the including context is same-origin, then we grant access to same site cookies and if the including context is cross-origin, then we do not grant access to same site cookies.

Comment 2

[Daniel Veditz [:dveditz]]

It's not exactly the "including context", it's the effective script origin. That's usually the same thing though, and in any case should be correct if you get it from the channel. see bug 802895 comment 18

Comment 3

[Daniel Veditz [:dveditz]]

Comment on attachment 8968645 [details] [diff] [review]
bug_1454721_test_same_site_about.patch

Review of attachment 8968645 [details] [diff] [review]:
-----------------------------------------------------------------

This looks good as a loading test so let's land it. I think we also need equivalent navigation tests as well to make sure we don't look at navigation from about:srcdoc and say that's cross-origin. That is
   parent
      <iframe about:...>
          onload -> document.location = cookie-testing site

Where parent is SAME-SITE and CROSS-SITE, and the frame is about:srcdoc and about:blank. Basically the cases you test here except with a navigation instead of a sub-frame.

r=dveditz

Comment 4

[Christoph Kerschbaumer [:ckerschb]]

Attachment: bug_1454721_test_same_site_about.patch

(In reply to Daniel Veditz [:dveditz] from comment #3)
> Where parent is SAME-SITE and CROSS-SITE, and the frame is about:srcdoc and
> about:blank. Basically the cases you test here except with a navigation
> instead of a sub-frame.

Yeah, that makes sense. I extended the tests to not only include sub-frame inclusion but also navigational tests.

Carrying over r+ from dveditz!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/8306e1afdb9b
Add same-site cookie test for about:blank and about:srcdoc. r=dveditz

Comment 6

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/8306e1afdb9b