1467454 - cross-origin stylesheet load without "crossorigin" attribute treats service worker synthesized CORS response as opaque

Status: NEW

(Core :: DOM: Service Workers, enhancement, P2)

Description

[Ben Kelly [:bkelly, not reviewing]]

Chrome is writing a WPT test for loading style sheets with service workers.  They found an unexpected issue in firefox:

https://bugs.chromium.org/p/chromium/issues/detail?id=848786#c12

The test is basically doing:

<link href="cross-origin-css.css?cors" rel="stylesheet" type="text/css">

Which initiates a cross-origin no-cors load for the stylesheet from the outer document.  The service worker then does:

    const use_cors =
        (url.searchParams.has('cors'));
	
    if (file == 'cross-origin-css.css') {
      let fetch_url =  REMOTE_ORIGIN + BASE_PATH + CSS_FILE;
      const mode = use_cors ? 'cors' : 'no-cors';
      event.respondWith(fetch(fetch_url, {'mode': mode}));
    }

So the service worker is responding with a "cors" response.

The fetch spec says to use the exact response provided by the service worker:

https://fetch.spec.whatwg.org/#http-fetch

We implemented this in bug 1369862.

Also, the CSSOM spec says that the stylesheet should look at the tainting of the response it received in step 10 here:

https://drafts.csswg.org/cssom/#requirements-on-user-agents-implementing-the-http-link-header

It seems that the stylesheet loader probably needs to be updated to use the nsILoadInfo::GetTainting() value instead of computing its own cross-origin tainting value.

Comment 1

[Andrew Sutherland [:asuth] (he/him)]

The chromium bug is not accessible with default privs, so if you can provide the current path of the future WPT test or link to their uplift issue when that happens, that would be helpful.

Comment 2

[Ben Kelly [:bkelly, not reviewing]]

The WPT tests landed upstream a week or so ago.  WPT sync is in bug 1467542.

Comment 3

[Tom Tung [:tt, :ttung]]

I'd like to take this bug.

Comment 4

[Tom Tung [:tt, :ttung]]

It seems that I'm not active at this bug, so remove the assignee.

I suspect that we might want to update the value of GetCORSMode() by getting the "tainting" from the channel so that we can bypass the check in the style sheet [1]. However, I didn't have time to check that.

[1] https://searchfox.org/mozilla-central/rev/de7676288a78b70d2b9927c79493adbf294faad5/layout/style/StyleSheet.cpp#718-724