1512965 - Tainted "no-cors" <img> / <script> should be treated as cross-origin

Status: NEW

(Core :: DOM: Networking, defect, P2)

Description

[Anne (:annevk)]

Basically, when the request chain for a "no-cors" subresource on a document with origin A is A -> B -> A, the behavior should be as if the subresource came from B.

That is, trying to read image data should throw and script exceptions are to be muted. There might be some other endpoints affected here, but thus far there's only tests for these:

* https://github.com/web-platform-tests/wpt/pull/14112
* https://github.com/web-platform-tests/wpt/pull/14218

Chrome and Safari do the right thing here.

Comment 1

[Boris Zbarsky [:bzbarsky]]

This is already the case for scripts, fwiw: muting is and always has been based on the original request URI, not the response URI.

Are there other cases that matter here?  Stylesheets?  Anything else?

Comment 2

[Boris Zbarsky [:bzbarsky]]

Actually, maybe what I said about muting there is just wrong.  It wouldn't make any sense for same-origin loads that then redirect cross-origin...

Comment 3

[Anne (:annevk)]

What is already the case? (Note that we fail the script test.)

The general issue might also affect media, stylesheets, and maybe plugins? fetch() too, but we already do it correct there. I'm unclear on the testing situation for media, stylesheets, and plugins. https://github.com/whatwg/fetch/issues/737 tracks the general issue as far as testing and prose in the relevant standards is concerned.

Comment 4

[Boris Zbarsky [:bzbarsky]]

Yes, I was wrong.  Muting is currently just based on the origin of the final response.

Also, muting seems to work quite differently in Gecko and in the spec (e.g. Gecko only mutes actual Error instances, because that's where the muting information lives, and the tests throw strings, so Gecko does not pass the tests no matter what behavior we implement for the case this actually exists to address: syntax errors).

Comment 5

[Boris Zbarsky [:bzbarsky]]

(It would be useful to have tests that actually test the thing that muting is supposed to address, by the way.)

Comment 6

[Anne (:annevk)]

Added in https://github.com/web-platform-tests/wpt/pull/14460.