1517872 - [wpt-sync] Sync PR 14722 - Allow same-origin responses in CORB (even initiated by content scripts).

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, enhancement, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 14722 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/14722
Details from upstream follow.

Lukasz Anforowicz <[e-mail]> wrote:
>  Allow same-origin responses in CORB (even initiated by content scripts).
>  
>  Consider the following scenario: A content script from
>  chrome-extension://example-extension injected into
>  https://example.com/page.html performs an XHR/fetch of
>  https://example.com/resource.json.
>  
>  The scenario above has been problematic for CORB, because
>  CrossOriginReadBlocking::ResponseAnalyzer::ShouldBlockBasedOnHeaders
>  sees that |initiator| (chrome-extension://example-extension) is
>  different from |target_origin| (https://example.com).  Before this
>  CL, such case would be considered cross-origin and blocked (this didn't
>  happen in practice only because URLLoaderFactories for extensions had
>  CORB turned off).  After this CL, such case would be considered
>  same-origin based on a matching |request_initiator_site_lock| (this
>  change enables turning CORB on for extensions in a separate, later CL).
>  
>  Change-Id: I367a5452f7aa080d590ff46bf4a57d1403ae80dd
>  Bug: 918660
>  Reviewed-on: https://chromium-review.googlesource.com/1394432
>  WPT-Export-Revision: cbe9e6597682ec0369bf96fd67403305d0f02ea8

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try https://treeherder.mozilla.org/#/jobs?repo=try&revision=dfe07094a922883ec46c2a3ebe69c382825a158b

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=03e527c34470eaa19a7d2e32bdb035df5a56e3c8

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/fae2c3eae0f2
[wpt PR 14722] - Allow same-origin responses in CORB (even initiated by content scripts)., a=testonly

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/8c9722a9c976
[wpt PR 14722] - Allow same-origin responses in CORB (even initiated by content scripts)., a=testonly

Comment 5

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/8c9722a9c976