1834703 - Return null origin of "blob:" URL containing inner non-"http(s):" URL

Status: RESOLVED FIXED

(Core :: DOM: Networking, enhancement, P2)

Description

[Valentin Gosu [:valentin] {{ PTO 3 July - 3 August }}]

See https://github.com/whatwg/url/pull/771 for spec change.
Bug 1834391 and https://github.com/web-platform-tests/wpt/pull/40133 for WPT tests.

Comment 1

[Oliver Medhurst [:canadahonk]]

Attachment: Bug 1834703 - Return null origin of "blob:" URL containing disallowed inner schemes r?edgul,valentin

Return null origin of a blob URL containing an inner URL which is not of
http/https schemes to comply with new spec change.

Examples:

• "blob:blob:https://example.org/" - inner blob URL
• "blob:ws://example.org/" - inner non-http(s) URL

Spec PR: https://github.com/whatwg/url/pull/771
WPT tests: https://github.com/web-platform-tests/wpt/pull/40133

New WPT tests are not merged into central yet, so tested manually
instead and results are as expected with WPTs.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/34c5add98599
Return null origin of "blob:" URL containing inner non-"http(s):" URL r=smaug,valentin

Comment 3

[Norisz Fay [:noriszfay]]

Backed out for causing xpcshell failure on test_BrowserUtils_urlFormatting.js

Backout link

Push with failures

Failure log

Comment 4

[Oliver Medhurst [:canadahonk]]

Sorry for the trouble, updated patch.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7cd945c5be6e
Return null origin of "blob:" URL containing disallowed inner schemes r=smaug,valentin

Comment 6

[Cosmin Sabou [:CosminS]]

Backed out for causing mochitest plain failures on test_unknown_url_origin.html.

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&selectedTaskRun=JvVc0fDfTDO14Jsc8sf3Nw.0&resultStatus=testfailed%2Cbusted%2Cexception%2Cusercancel&revision=7cd945c5be6eac2287abb63f113bdc2ad17930a6

Failure log: https://treeherder.mozilla.org/logviewer?job_id=417680248&repo=autoland

Backout link: https://hg.mozilla.org/integration/autoland/rev/237a6239812a40762b61a38e02430b4d62fcfbe7

Comment 7

[Oliver Medhurst [:canadahonk]]

Sorry, didn't catch those tests; updated expectations in patch and retested.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/af0665af9541
Return null origin of "blob:" URL containing disallowed inner schemes r=smaug,valentin

Comment 9

[Atila Butkovits]

Backed out for causing failures at test_unknown_url_origin.html.

Backout link: https://hg.mozilla.org/integration/autoland/rev/2e3060c42d23ca4053d63aeb3d4ada23de3d4b4e

Push with failures: https://treeherder.mozilla.org/jobs?repo=autoland&selectedTaskRun=IJ_6eusEQtacSu4nJq35cg.0&resultStatus=testfailed%2Cbusted%2Cexception%2Cretry%2Cusercancel&revision=af0665af954105365927736b6a65c4d28533bc4d

Failure log: https://treeherder.mozilla.org/logviewer?job_id=418886565&repo=autoland&lineNumber=10897

Comment 10

[Oliver Medhurst [:canadahonk]]

Test expectations changes were slightly wrong, will fix later.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2d7083c6241d
Return null origin of "blob:" URL containing disallowed inner schemes r=smaug,valentin

Comment 12

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bdc116caf375
Backed out changeset 2d7083c6241d for bc failure on browser_wpi_isolate_high_value.js

Comment 13

[BugBot [:suhaib / :marco/ :calixte]]

There is an r+ patch which didn't land and no activity in this bug for 2 weeks.
:canadahonk, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit BugBot documentation.

Comment 14

[Oliver Medhurst [:canadahonk]]

Marked as changes planned.

Comment 15

[Anne (:annevk)]

Note the small proposed change in https://github.com/whatwg/url/pull/780 to safelist the "file" scheme as well.

Comment 16

[edgul]

Hey Oliver, we have this on our radar for interop 2024, did you have any interest in taking another stab at this?

Comment 17

[Oliver Medhurst [:canadahonk]]

Hi, sorry for the delay, I could possibly look at this for a bit once I have the cycles, but if it is needed more urgently I am busy with other work for a while and someone else might have to pick it up. Thanks!

Comment 18

[Sean Kim [:sekim]]

Attachment: Bug 1834703 - Return null origin of blob: URL containing disallowed inner schemes r?edgul,valentin

Comment 19

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f5b1aa60467e
Return null origin of "blob:" URL containing disallowed inner schemes r=smaug,valentin

Comment 20

[Iulian Moraru]

https://hg.mozilla.org/mozilla-central/rev/f5b1aa60467e