1817243 - [wpt-sync] Sync PR 38550 - Rewrite Storage Access API WPTs to block third-party cookies by default

Status: RESOLVED FIXED

(Testing :: web-platform-tests, task, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 38550 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/38550
Details from upstream follow.

Chris Fredrickson <[e-mail]> wrote:

Rewrite Storage Access API WPTs to block third-party cookies by default

This reflects the reality that blocking third-party cookies by default
is the desired end state, and browsers that have already gotten there
should not be penalized by tests that fail as a result.

Change-Id: I63dec963503f468908c838593df2e5db31d6dd0b

Reviewed-on: https://chromium-review.googlesource.com/4261348
WPT-Export-Revision: b6b1c13678c2b532f3aa6d2a0624f89ac6817a75

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

PR 38550 applied with additional changes from upstream: f574d4f5a2a373596de03a879e64536b30b897d0, 5e08ba6e6409d5c7dc5dc6612eab7f05c0f0be3e

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=55931c2dfc82b2da1968fff3c4b29d02d05def28

Comment 3

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

CI Results

Ran 9 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 16 tests and 2 subtests

Status Summary

Firefox

OK : 6[Gecko-android-em-7.0-x86_64-lite-qr-opt-geckoview, Gecko-android-em-7.0-x86_64-qr-debug-geckoview, Gecko-android-em-7.0-x86_64-qr-opt-geckoview, Gecko-linux1804-64-qr-debug, Gecko-linux1804-64-qr-opt, Gecko-windows10-32-2004-qr-debug, Gecko-windows10-32-2004-qr-opt, Gecko-windows10-64-2004-qr-debug, Gecko-windows10-64-2004-qr-opt] 7[GitHub]
PASS : 32[GitHub] 41[Gecko-android-em-7.0-x86_64-lite-qr-opt-geckoview, Gecko-android-em-7.0-x86_64-qr-debug-geckoview, Gecko-android-em-7.0-x86_64-qr-opt-geckoview, Gecko-linux1804-64-qr-debug, Gecko-windows10-32-2004-qr-debug, Gecko-windows10-32-2004-qr-opt, Gecko-windows10-64-2004-qr-debug, Gecko-windows10-64-2004-qr-opt] 42[Gecko-linux1804-64-qr-opt]
FAIL : 21[Gecko-linux1804-64-qr-opt] 22[Gecko-android-em-7.0-x86_64-lite-qr-opt-geckoview, Gecko-android-em-7.0-x86_64-qr-debug-geckoview, Gecko-android-em-7.0-x86_64-qr-opt-geckoview, Gecko-linux1804-64-qr-debug, Gecko-windows10-32-2004-qr-debug, Gecko-windows10-32-2004-qr-opt, Gecko-windows10-64-2004-qr-debug, Gecko-windows10-64-2004-qr-opt] 36[GitHub]
TIMEOUT: 10[Gecko-android-em-7.0-x86_64-lite-qr-opt-geckoview, Gecko-android-em-7.0-x86_64-qr-debug-geckoview, Gecko-android-em-7.0-x86_64-qr-opt-geckoview, Gecko-linux1804-64-qr-debug, Gecko-windows10-32-2004-qr-debug, Gecko-windows10-64-2004-qr-debug] 12[Gecko-linux1804-64-qr-opt, Gecko-windows10-32-2004-qr-opt, Gecko-windows10-64-2004-qr-opt, GitHub]
ERROR : 2[Gecko-linux1804-64-qr-opt, Gecko-windows10-32-2004-qr-opt, Gecko-windows10-64-2004-qr-opt, GitHub] 4[Gecko-android-em-7.0-x86_64-lite-qr-opt-geckoview, Gecko-android-em-7.0-x86_64-qr-debug-geckoview, Gecko-android-em-7.0-x86_64-qr-opt-geckoview, Gecko-linux1804-64-qr-debug, Gecko-windows10-32-2004-qr-debug, Gecko-windows10-64-2004-qr-debug]
NOTRUN : 16

Chrome

OK : 15
PASS : 75
FAIL : 11
TIMEOUT: 2
NOTRUN : 1

Safari

OK : 8
PASS : 27
FAIL : 38
TIMEOUT: 9
ERROR : 2
NOTRUN : 13

Links

Gecko CI (Treeherder)
GitHub PR Head
GitHub PR Base

Details

Firefox-only Failures

• /storage-access-api/hasStorageAccess-insecure.sub.window.html [wpt.fyi]
  • [cross-origin-frame] document.hasStorageAccess() should be disallowed in insecure contexts: FAIL
  • [nested-cross-origin-frame] document.hasStorageAccess() should be disallowed in insecure contexts: FAIL
• /storage-access-api/requestStorageAccess-insecure.sub.window.html [wpt.fyi]: TIMEOUT
• /storage-access-api/requestStorageAccess-non-fully-active.sub.https.window.html [wpt.fyi]: TIMEOUT

New Tests That Don't Pass

• /storage-access-api/hasStorageAccess-insecure.sub.window.html [wpt.fyi]
  • [top-level-context] document.hasStorageAccess() should be disallowed in insecure contexts: FAIL (Chrome: PASS, Safari: FAIL)
  • [same-origin-frame] document.hasStorageAccess() should be disallowed in insecure contexts: FAIL (Chrome: PASS, Safari: FAIL)
  • [cross-origin-frame] document.hasStorageAccess() should be disallowed in insecure contexts: FAIL (Chrome: PASS, Safari: PASS)
  • [nested-same-origin-frame] document.hasStorageAccess() should be disallowed in insecure contexts: FAIL (Chrome: PASS, Safari: FAIL)
  • [nested-cross-origin-frame] document.hasStorageAccess() should be disallowed in insecure contexts: FAIL (Chrome: PASS, Safari: PASS)
  • [top-level-context] document.hasStorageAccess() should reject in a document that isn't fully active.: FAIL (Chrome: PASS, Safari: FAIL)
  • [same-origin-frame] document.hasStorageAccess() should reject in a document that isn't fully active.: FAIL (Chrome: PASS, Safari: FAIL)
  • [cross-origin-frame] document.hasStorageAccess() should reject in a document that isn't fully active.: FAIL (Chrome: PASS, Safari: FAIL)
  • [nested-cross-origin-frame] document.hasStorageAccess() should reject in a document that isn't fully active.: FAIL (Chrome: PASS, Safari: FAIL)
  • [nested-same-origin-frame] document.hasStorageAccess() should reject in a document that isn't fully active.: FAIL (Chrome: PASS, Safari: FAIL)
• /storage-access-api/hasStorageAccess.sub.https.window.html [wpt.fyi]
  • [top-level-context] document.hasStorageAccess() should reject in a document that isn't fully active.: FAIL (Chrome: PASS, Safari: FAIL)
  • [same-origin-frame] document.hasStorageAccess() should reject in a document that isn't fully active.: FAIL (Chrome: PASS, Safari: FAIL)
  • [cross-origin-frame] document.hasStorageAccess() should reject in a document that isn't fully active.: FAIL (Chrome: PASS, Safari: FAIL)
  • [nested-same-origin-frame] document.hasStorageAccess() should reject in a document that isn't fully active.: FAIL (Chrome: PASS, Safari: FAIL)
  • [nested-cross-origin-frame] document.hasStorageAccess() should reject in a document that isn't fully active.: FAIL (Chrome: PASS, Safari: FAIL)
• /storage-access-api/requestStorageAccess-cross-origin-iframe-navigation.sub.https.window.html [wpt.fyi]: TIMEOUT (Chrome: OK, Safari: TIMEOUT)
  • Self-initiated same-origin navigations preserve storage access: TIMEOUT (Chrome: FAIL, Safari: TIMEOUT)
• /storage-access-api/requestStorageAccess-cross-origin-iframe.sub.https.window.html [wpt.fyi]: ERROR (Chrome: OK, Safari: ERROR)
  • [cross-origin-frame] document.requestStorageAccess() should be rejected with a NotAllowedError by default with no user gesture: NOTRUN
  • [cross-origin-frame] document.requestStorageAccess() should be resolved when called properly with a user gesture: NOTRUN (Chrome: PASS, Safari: NOTRUN)
  • [cross-origin-frame] document.requestStorageAccess() should be rejected with a NotAllowedError without permission grant: NOTRUN (Chrome: FAIL, Safari: NOTRUN)
  • [cross-origin-frame] document.requestStorageAccess() should be rejected with a NotAllowedError with denied permission: NOTRUN (Chrome: FAIL, Safari: NOTRUN)
  • [cross-origin-frame] document.requestStorageAccess() should resolve in top-level frame or otherwise reject with a NotAllowedError with no user gesture: NOTRUN (Chrome: PASS, Safari: NOTRUN)
• /storage-access-api/requestStorageAccess-cross-origin-sibling-iframes.sub.https.window.html [wpt.fyi]: TIMEOUT (Chrome: OK, Safari: TIMEOUT)
  • Grants have per-frame scope: TIMEOUT (Chrome: FAIL, Safari: TIMEOUT)
• /storage-access-api/requestStorageAccess-insecure.sub.window.html [wpt.fyi]: TIMEOUT (Chrome: OK, Safari: OK)
  • [non-fully-active] document.requestStorageAccess() should reject when run in a detached frame: TIMEOUT (Chrome: PASS, Safari: FAIL)
  • [non-fully-active] document.requestStorageAccess() should reject when run in a detached DOMParser document: NOTRUN (Chrome: PASS, Safari: FAIL)
  • [top-level-context] document.requestStorageAccess() should be rejected when called with a user gesture in insecure context: NOTRUN
• /storage-access-api/requestStorageAccess-nested-cross-origin-iframe.sub.https.window.html [wpt.fyi]: ERROR [Gecko-android-em-7.0-x86_64-lite-qr-opt-geckoview, Gecko-android-em-7.0-x86_64-qr-debug-geckoview, Gecko-android-em-7.0-x86_64-qr-opt-geckoview, Gecko-linux1804-64-qr-debug, Gecko-windows10-32-2004-qr-debug, Gecko-windows10-64-2004-qr-debug], TIMEOUT [Gecko-linux1804-64-qr-opt, Gecko-windows10-32-2004-qr-opt, Gecko-windows10-64-2004-qr-opt, GitHub] (Chrome: OK, Safari: TIMEOUT)
  • [nested-cross-origin-frame] document.requestStorageAccess() should be rejected with a NotAllowedError by default with no user gesture: NOTRUN
  • [nested-cross-origin-frame] document.requestStorageAccess() should be resolved when called properly with a user gesture: NOTRUN (Chrome: PASS, Safari: NOTRUN)
  • [nested-cross-origin-frame] document.requestStorageAccess() should be rejected with a NotAllowedError without permission grant: NOTRUN (Chrome: FAIL, Safari: NOTRUN)
  • [nested-cross-origin-frame] document.requestStorageAccess() should be rejected with a NotAllowedError with denied permission: NOTRUN (Chrome: FAIL, Safari: NOTRUN)
  • [nested-cross-origin-frame] document.requestStorageAccess() should resolve in top-level frame or otherwise reject with a NotAllowedError with no user gesture: NOTRUN (Chrome: PASS, Safari: NOTRUN)
• /storage-access-api/requestStorageAccess-nested-same-origin-iframe.sub.https.window.html [wpt.fyi]: ERROR [Gecko-android-em-7.0-x86_64-lite-qr-opt-geckoview, Gecko-android-em-7.0-x86_64-qr-debug-geckoview, Gecko-android-em-7.0-x86_64-qr-opt-geckoview, Gecko-linux1804-64-qr-debug, Gecko-windows10-32-2004-qr-debug, Gecko-windows10-64-2004-qr-debug], TIMEOUT [Gecko-linux1804-64-qr-opt, Gecko-windows10-32-2004-qr-opt, Gecko-windows10-64-2004-qr-opt, GitHub] (Chrome: OK, Safari: TIMEOUT)
  • [nested-same-origin-frame] document.requestStorageAccess() should be rejected with a NotAllowedError by default with no user gesture: NOTRUN
  • [nested-same-origin-frame] document.requestStorageAccess() should be resolved when called properly with a user gesture: NOTRUN (Chrome: PASS, Safari: NOTRUN)
  • [nested-same-origin-frame] document.requestStorageAccess() should resolve in top-level frame or otherwise reject with a NotAllowedError with no user gesture: NOTRUN (Chrome: PASS, Safari: NOTRUN)
• /storage-access-api/requestStorageAccess-non-fully-active.sub.https.window.html [wpt.fyi]: TIMEOUT (Chrome: OK, Safari: OK)
  • [non-fully-active] document.requestStorageAccess() should not resolve when run in a detached frame: TIMEOUT (Chrome: PASS, Safari: FAIL)
  • [non-fully-active] document.requestStorageAccess() should not resolve when run in a detached DOMParser document: NOTRUN (Chrome: PASS, Safari: FAIL)
• /storage-access-api/requestStorageAccess.sub.https.window.html [wpt.fyi]: ERROR (Chrome: OK, Safari: ERROR)
  • [top-level-context] document.requestStorageAccess() should be rejected with a NotAllowedError by default with no user gesture: NOTRUN
  • [top-level-context] document.requestStorageAccess() should be resolved when called properly with a user gesture: NOTRUN (Chrome: PASS, Safari: NOTRUN)
  • [top-level-context] document.requestStorageAccess() should resolve in top-level frame or otherwise reject with a NotAllowedError with no user gesture: NOTRUN (Chrome: FAIL, Safari: NOTRUN)
• /storage-access-api/storage-access-permission.sub.https.window.html [wpt.fyi]: TIMEOUT (Chrome: TIMEOUT, Safari: TIMEOUT)
  • Permissions grants are observable across same-origin iframes: TIMEOUT (Chrome: TIMEOUT, Safari: TIMEOUT)
  • IFrame tests: NOTRUN (Chrome: NOTRUN, Safari: NOTRUN)
• /storage-access-api/storageAccess.testdriver.sub.html [wpt.fyi]
  • TestDriver - Set Storage Access Command Tests: FAIL [Gecko-android-em-7.0-x86_64-lite-qr-opt-geckoview, Gecko-android-em-7.0-x86_64-qr-debug-geckoview, Gecko-android-em-7.0-x86_64-qr-opt-geckoview, Gecko-linux1804-64-qr-debug, Gecko-windows10-32-2004-qr-debug, Gecko-windows10-32-2004-qr-opt, Gecko-windows10-64-2004-qr-debug, Gecko-windows10-64-2004-qr-opt, GitHub], PASS [Gecko-linux1804-64-qr-opt] (Chrome: FAIL, Safari: PASS)
• /top-level-storage-access-api/tentative/requestStorageAccessForOrigin-insecure.sub.window.html [wpt.fyi]
  • [insecure-context] document.requestStorageAccessForOrigin() should be supported on the document interface: FAIL (Chrome: PASS)
  • [insecure-context] document.requestStorageAccessForOrigin() should be rejected by default with no user gesture: FAIL (Chrome: PASS)
  • [non-fully-active] document.requestStorageAccessForOrigin() should not resolve when run in a detached frame: FAIL (Chrome: PASS)
  • [non-fully-active] document.requestStorageAccessForOrigin() should not resolve when run in a detached DOMParser document: FAIL (Chrome: PASS)
  • [insecure-context] document.requestStorageAccessForOrigin() should be rejected when called in an insecure context: FAIL (Chrome: PASS)
  • [secure-frame-on-insecure-page] document.requestStorageAccessForOrigin() should be supported on the document interface: FAIL
  • [secure-frame-on-insecure-page] document.requestStorageAccessForOrigin() should be rejected when called in an iframe: FAIL
  • [frame-on-insecure-page] document.requestStorageAccessForOrigin() should be supported on the document interface: FAIL (Chrome: PASS)
  • [frame-on-insecure-page] document.requestStorageAccessForOrigin() should be rejected when called in an iframe: FAIL (Chrome: FAIL)
• /top-level-storage-access-api/tentative/requestStorageAccessForOrigin.sub.https.window.html [wpt.fyi]
  • [top-level-context] document.requestStorageAccessForOrigin() should be supported on the document interface: FAIL (Chrome: PASS, Safari: FAIL)
  • [top-level-context] document.requestStorageAccessForOrigin() should be rejected by default with no user gesture: FAIL (Chrome: PASS, Safari: FAIL)
  • [non-fully-active] document.requestStorageAccessForOrigin() should not resolve when run in a detached frame: FAIL (Chrome: PASS, Safari: FAIL)
  • [non-fully-active] document.requestStorageAccessForOrigin() should not resolve when run in a detached DOMParser document: FAIL (Chrome: PASS, Safari: FAIL)
  • [top-level-context] document.requestStorageAccessForOrigin() should be resolved when called properly with a user gesture and the same site: FAIL (Chrome: PASS, Safari: FAIL)
  • [top-level-context] document.requestStorageAccessForOrigin() should be rejected when called with an invalid site: FAIL (Chrome: PASS, Safari: FAIL)
  • [top-level-context] document.requestStorageAccessForOrigin() should be rejected when called with an opaque origin: FAIL (Chrome: PASS, Safari: FAIL)
  • [same-origin-frame] document.requestStorageAccessForOrigin() should be supported on the document interface: FAIL (Chrome: PASS, Safari: FAIL)
  • [same-origin-frame] document.requestStorageAccessForOrigin() should be rejected when called in an iframe: FAIL (Chrome: FAIL, Safari: FAIL)
  • [top-level-context] document.requestStorageAccessForOrigin() should be rejected when called with no argument: FAIL (Chrome: PASS, Safari: FAIL)
  • [top-level-context] document.requestStorageAccessForOrigin() should be resolved when called properly with a user gesture: FAIL (Chrome: PASS, Safari: FAIL)
  • [same-origin-frame] document.requestStorageAccessForOrigin() should be rejected when called with no argument: FAIL (Chrome: PASS, Safari: FAIL)
• /top-level-storage-access-api/tentative/top-level-storage-access-permission.sub.https.window.html [wpt.fyi]
  • Permission default state can be queried: FAIL (Chrome: FAIL, Safari: FAIL)

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/417dc6d9aa26
[wpt PR 38550] - Rewrite Storage Access API WPTs to block third-party cookies by default, a=testonly
https://hg.mozilla.org/integration/autoland/rev/c651b1348450
[wpt PR 38550] - Update wpt metadata, a=testonly

Comment 5

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/417dc6d9aa26
https://hg.mozilla.org/mozilla-central/rev/c651b1348450