[wpt-sync] Sync PR 40410 - Reland "Fenced frames: Local network access."
Categories
(Core :: DOM: Networking, task, P4)
Tracking
()
Tracking | Status | |
---|---|---|
firefox116 | --- | fixed |
People
(Reporter: wpt-sync, Unassigned)
References
(Depends on 1 open bug, )
Details
(Whiteboard: [wptsync downstream])
Attachments
(1 file)
73.87 KB,
text/plain
|
Details |
Sync web-platform-tests PR 40410 into mozilla-central (this bug is closed when the sync is complete).
PR: https://github.com/web-platform-tests/wpt/pull/40410
Details from upstream follow.
Xiaochen Zhou <xiaochenzh@chromium.org> wrote:
Reland "Fenced frames: Local network access."
This is a reland of commit c02af164b8b7cee63e3c97901113c386f9100e67
Original change's description:
Fenced frames: Local network access.
Fenced frames are only allowed in secure context. So the tests are
all in secure contexts.
- Subresource fetch:
Fenced frame's IP address space is set to
kPublic
in order to make
it subject to local network access check.web_tests/external/wpt/fetch/local-network-access/
fetch.https.window.js is replicated and replaced iframes with fenced
frames. All test cases are passing with the same behaviors as iframes.
- Document fetch:
Fenced frame's document fetch initiator can only be the parent.
Fenced frames can only be navigated in two ways:
- Directly by their parent, and never by another frame at a distance
viawindow.location
orwindow.open
; in this case theClientSecurityState
needs to come from the parent.- By themselves; in this case the
ClientSecurityState
also needs to
come from its embedder/parent.The ClientSecurityState of its parent is supplied to the
NavigationURLLoader.web_tests/external/wpt/fetch/local-network-access/
iframe.tentative.https.window.js is replicated and replaced iframes
with fenced frames. All test cases have the same results as the
iframe test expectations, except one:treat-as-public-address to local (same-origin): no preflight
required
Iframe: the request is made without preflight. The nested iframe is
loaded successfully.Fenced frame: a preflight is made, and gets blocked. See a. below.
I changed the test expectation for this test only. (PASS for iframe,
but FAIL for fenced frame)Here are some noteworthy things we observed for document fetch. The
following only applies to embedder-initiated navigations (i.e., the
initial navigation of the frame):
a. Fenced frame's document fetch's preflight request is always sent
withOrigin: null
. This applies to embedder-initiated navigations
(i.e., the initial navigation of the frame). I think this affects the
outcome of Local Network Access check algorithm.
https://source.chromium.org/chromium/chromium/src/+/main:content/browser/fenced_frame/fenced_frame.cc;l=119-126?q=fencedframe::n&ss=chromium%2Fchromium%2FsrcA
null
origin implies
LocalNetworkAccessChecker::is_potentially_trustworthy_same_origin_
will always be false.b. For testing purposes, we tried manually overriding the initiator
origin with a real origin and found that the preflight request still
failed. This is because the credentials mode of the navigation is
'include'
, which preventsAccess-Control-Allow-Origin: '*'
from
working, which iframes equivalently suffer from: https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/web_tests/external/wpt/fetch/local-network-access/iframe.tentative.https.window-expected.txt?q=%22FAIL%20%22%20f:third_party%2Fblink%2Fweb_tests%2Fexternal%2Fwpt%2Ffetch%2Flocal-network-access%2Fiframe.tentative.https.window-expected.txt.Bug: 1420626
Change-Id: I74c97369d235e1725c650bfe87f29372992cb56b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4532557
Reviewed-by: Titouan Rigoudy \<titouan@chromium.org>
Reviewed-by: Alex Moshchuk \<alexmos@chromium.org>
Reviewed-by: Weizhong Xia \<weizhong@google.com>
Commit-Queue: Xiaochen Zhou \<xiaochenzh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1154027}Bug: 1420626
Change-Id: I5c1f326e991f14125f5c3991046553d6e3200784Reviewed-on: https://chromium-review.googlesource.com/4595521
WPT-Export-Revision: 677f1dd463b662ee71fe24f6db0d8ac4b3b231d8
Assignee | ||
Updated•2 years ago
|
Assignee | ||
Comment 1•2 years ago
|
||
Assignee | ||
Comment 2•2 years ago
|
||
Comment 4•2 years ago
|
||
bugherder |
Description
•