1676908 - Consider adding test cases for the Chromium site isolation bugs reported by Microsoft

Status: NEW

(Core :: DOM: Content Processes, task, P3)

Description

[Chris Peterson [:cpeterson]]

Microsoft's "Deep Dive into Site Isolation (Part 1)" blog post describes (and links to crbug reports) for some site isolation bugs the author found in Chromium:

https://microsoftedge.github.io/edgevr/posts/deep-dive-into-site-isolation-part-1/

• Data URL Site inheritance
• Blob URL with opaque origin
• multiple CORB bypasses
• JavaScript URL navigation request that goes up to the browser process (bug 1647519)

Comment 1

[Anne (:annevk)]

I'm somewhat surprised that data URLs are allowed to share a process at all. I guess otherwise they might be used to quickly exceed the process limit? However, with that architecture their "opaque origin" is not that opaque anymore.

As for the CORB bypasses, these do not look like failures of CORB, but rather how error conditions are handled for connections/fetches in general. We need to ensure that all security checks happen in the parent process and that if it determines a network error is to be returned (due to CSP, Mixed Content, X-Frame-Options, etc.), no other information about the response is leaked to the content process. I.e., the content process knows the URL it requested, that it got a network error containing no useful information back, and the time that took, and that is all. I'm not sure to what extent we have audited this.

Comment 2

[Chris Peterson [:cpeterson]]

These would be tests for new hardening work. Moving to Fission Future because it doesn't need to block Fission MVP.