1499422 - fullscreen and payment features should have 'self' as default value

Status: ASSIGNED

(Core :: DOM: Security, enhancement)

Description

[Andrea Marchesini [:baku]]

We currently use 'all' as default value for FeaturePolicy, but this is against allowfullscreen and allowpayment attributes. This bug is about fixing it.

Comment 1

[Andrea Marchesini [:baku]]

Attachment: self.patch

I also removed a TODO comment, because we are not going to implement allowusermediarequest. See bug 1498142.

Comment 2

[Olli Pettay [:smaug]]

Comment on attachment 9017583 [details] [diff] [review]
self.patch

So this doesn't change geolocation, but the bug is about geolocation.

Also, why this doesn't cause any test changes? I would have expected that without this patch fullscreen was (incorrectly) enabled in cross-origin iframes, since that is what * is about, no?

Comment 3

[Andrea Marchesini [:baku]]

> So this doesn't change geolocation, but the bug is about geolocation.

Right. My fault. I meant 'payment'. geolocation is currently allowed everywhere via permission, after prompting.

> Also, why this doesn't cause any test changes? I would have expected that
> without this patch fullscreen was (incorrectly) enabled in cross-origin
> iframes, since that is what * is about, no?

For 2 reasons:

1. all the tests use allowpaymentrequest and allowfullscreen. This grants the use of these 2 permission everywhere.
2. the default allowlist is not covered by WPT because each browser can have different policies.

Comment 4

[Andrea Marchesini [:baku]]

This depends on the result of the discussion here: https://github.com/WICG/feature-policy/issues/233
Landing suspended.

Comment 5

[Release mgmt bot [:suhaib / :marco/ :calixte]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:baku, could you have a look please?

Comment 6

[Andrea Marchesini [:baku]]

All the feature-policy patches/bugs are in a frozen state, until we decide what to do with this feature. It's still unclear if we want to ship feature-policy. No reason to fix this bug, at the moment.