1523958 - FeaturePolicy: display-capture

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P2)

Description

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

FeaturePolicy support for display-capture.

A bit of urgency: getDisplayMedia landed in 66 (bug 1321221) enabled even in cross-origin iframes; didn't matter in Nightly, but in Beta where dom.security.featurePolicy.enabled is false, it's not great.

Comment 1

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Attachment: Bug 1523958 - FeaturePolicy: display-capture.

Comment 2

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

[Tracking Requested - why for this release]: see comment 0.

Comment 3

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Attachment: Bug 1523958 - Add screen-capture/feature-policy.https.html wpt test.

Comment 4

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

I've convinced myself that disallowing getDisplayMedia in cross-origin iframes is premature without feature policy enabled.

Even though this is technically a new API, the same functionality is already available through

navigator.mediaDevices.getUserMedia({video: {mediaSource: "screen"}});

...and this patch would disable both in cross-origin iframes, without a workaround until dom.security.featurePolicy.enabled rides the (maybe 68) train. I worry this might break some actual sites.

I considered only disabling the new API, but that might hurt convergence around the new API.

Instead, I'm going to push patches to simply enable "display-capture" feature policy, already reviewed.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9439612a6ff9
FeaturePolicy: display-capture. r=baku
https://hg.mozilla.org/integration/autoland/rev/0782920301f9
Add screen-capture/feature-policy.https.html wpt test. r=baku

Comment 6

[Oana Pop-Rus]

https://hg.mozilla.org/mozilla-central/rev/9439612a6ff9
https://hg.mozilla.org/mozilla-central/rev/0782920301f9

Comment 7

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Created web-platform-tests PR https://github.com/web-platform-tests/wpt/pull/15373 for changes under testing/web-platform/tests

Comment 8

[Chris Mills [:cmills]]

Note to MDN writers:

This is still behind a flag, so no note on the 67 rel notes.

But we should add this to the Feature-Policy page, annd update the BCD.

Comment 9

[Eric Shepherd [:sheppy]]

• Added reference page for Feature-Policy: display-capture
• Submitted BCD PR 4109 to add display-capture to feature policy
• Improvements and example added to getDisplayMedia() page
• Improvements to Using the Screen Capture API
• Expanded information provided in the main [Screen Capture API](https://developer.mozilla.org/en-US/docs/Web/API/Screen_Capture_API

This should be done now, assuming the PR goes through and doesn't need revisions.