1636952 - [wpt-sync] Sync PR 23506 - [Security][Coop] Use COOP only if this is top level

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, task, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 23506 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/23506
Details from upstream follow.

Pâris Meuleman <[e-mail]> wrote:

[Security][Coop] Use COOP only if this is top level

COOP is used only in top level document, and COOP headers from iframes
are ignored. This led to an issue in the linked bug, where COOP prevents
a sandboxed iframe to load.

The spec change corresponding to this is under review here:
https://whatpr.org/html/5334/browsing-the-web.html

with this relevant extract:

Let navigationCOOP be "unsafe-none".

If browsingContext is a top-level browsing context, then:

Set navigationCOOP to the result of obtaining a cross-origin opener
policy given response and reservedEnvironment.

If sandboxFlags is not empty and navigationCOOP is not "unsafe-none",
then display the inline content with an appropriate error shown to the
user, with the newly created Document object's origin set to a new
opaque origin, run the environment discarding steps for
reservedEnvironment, and return.

Bug: 1081169
Change-Id: I2c0b59c84ca52f63436a2312529a4bb0351fff30
Reviewed-on: https://chromium-review.googlesource.com/2193771
WPT-Export-Revision: 5fb26cfd84e6bce455b10ba42bb00c23e690aef9

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=86d4415fc1042f8eac9fd055364d7b48ba5e7c50

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

CI Results

Ran 12 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 72 tests

Status Summary

Firefox

OK : 1
PASS: 2[GitHub] 71[Gecko-android-em-7.0-x86_64-debug-geckoview, Gecko-android-em-7.0-x86_64-opt-geckoview] 73[Gecko-linux1804-64-debug, Gecko-linux1804-64-opt, Gecko-linux1804-64-qr-debug, Gecko-linux1804-64-qr-opt, Gecko-windows10-64-debug, Gecko-windows10-64-opt, Gecko-windows10-64-qr-debug, Gecko-windows10-64-qr-opt, Gecko-windows7-32-debug, Gecko-windows7-32-opt]
FAIL: 1

Chrome

OK : 1
PASS: 2
FAIL: 1

Safari

OK : 1
FAIL: 3

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Details

New Tests That Don't Pass

/html/cross-origin-opener-policy/coop-sandbox.https.html: OK [Gecko-linux1804-64-debug, Gecko-linux1804-64-opt, Gecko-linux1804-64-qr-debug, Gecko-linux1804-64-qr-opt, Gecko-windows10-64-debug, Gecko-windows10-64-opt, Gecko-windows10-64-qr-debug, Gecko-windows10-64-qr-opt, Gecko-windows7-32-debug, Gecko-windows7-32-opt, GitHub], SKIP [Gecko-android-em-7.0-x86_64-debug-geckoview, Gecko-android-em-7.0-x86_64-opt-geckoview] (Chrome: OK, Safari: OK)
<iframe sandbox="allow-popups allow-scripts"> Sandboxed Cross-Origin-Opener-Policy popup should result in a network error: FAIL (Chrome: PASS, Safari: FAIL)

Tests Disabled in Gecko Infrastructure

/html/cross-origin-opener-policy/coop-sandbox.https.html: OK [Gecko-linux1804-64-debug, Gecko-linux1804-64-opt, Gecko-linux1804-64-qr-debug, Gecko-linux1804-64-qr-opt, Gecko-windows10-64-debug, Gecko-windows10-64-opt, Gecko-windows10-64-qr-debug, Gecko-windows10-64-qr-opt, Gecko-windows7-32-debug, Gecko-windows7-32-opt, GitHub], SKIP [Gecko-android-em-7.0-x86_64-debug-geckoview, Gecko-android-em-7.0-x86_64-opt-geckoview] (Chrome: OK, Safari: OK)

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7e4449460eee
[wpt PR 23506] - [Security][Coop] Use COOP only if this is top level, a=testonly

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/347d148c23a4
[wpt PR 23506] - [Security][Coop] Use COOP only if this is top level, a=testonly

Comment 5

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/347d148c23a4