1659763 - Align X-Frame-Options processing with the spec/WebKit/Blink

Status: RESOLVED FIXED

(Core :: DOM: Security, defect, P3)

Description

[Domenic Denicola]

In https://github.com/whatwg/html/pull/5737 we finally specified X-Frame-Options. https://github.com/web-platform-tests/wpt/pull/24618 greatly expanded the tests.

Browsers mostly agree on the behavior of the header. However, Gecko disagrees with the spec/WebKit/Blink in the case of conflicting header values, e.g. DENY,SAMEORIGIN. In particular the failures are in https://github.com/web-platform-tests/wpt/blob/master/x-frame-options/multiple.html .

The full spec processing model is at https://html.spec.whatwg.org/#the-x-frame-options-header .

Comment 1

[June Wilde (she/her) [:jewilde]]

Attachment: Bug 1659763 - Fix failing x-frame-options web platform tests; r=freddyb

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/3fc04d8eb32b
Fix failing x-frame-options web platform tests; r=freddyb,necko-reviewers,valentin

Comment 3

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/3fc04d8eb32b

Comment 4

[Sebastian Hengst [:aryx] (needinfo me if it's about an intermittent or backout)]

Backed out for causing crashes with signature [@ mozilla::dom::CanonicalBrowsingContext::Cast], e.g. bp-cae7174b-1e32-4748-95f4-f9f9f0230615.

Backout link: https://hg.mozilla.org/mozilla-central/rev/e8bfcd70e6ba5c6b9a6cc94e1a61b46d3f8949f8

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The bug is linked to a topcrash signature, which matches the following criteria:

• Top 10 desktop browser crashes on nightly
• Top 10 AArch64 and ARM crashes on nightly

:jewilde, could you consider increasing the severity of this top-crash bug?

For more information, please visit BugBot documentation.

Comment 6

[Frederik Braun [:freddy]]

Can't be a topcrash if it's backed out...

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/522cce1d0166
Fix failing x-frame-options web platform tests; r=freddyb,necko-reviewers,valentin

Comment 8

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/522cce1d0166