1910478 - [wpt-sync] Sync PR 47342 - Fenced frame: fix 'src' permissions policy allowlist.

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, task, P4)

Description

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Sync web-platform-tests PR 47342 into mozilla-central (this bug is closed when the sync is complete).

PR: https://github.com/web-platform-tests/wpt/pull/47342
Details from upstream follow.

Liam Brady <[e-mail]> wrote:

Fenced frame: fix 'src' permissions policy allowlist.

The 'src' allowlist is a feature unique to iframes and fenced frames
that, if set, only allows a given feature for the origin loaded in the
src attribute. This is calculated in the embedder. However, when loading
a fenced frame or iframe with a fenced frame config, that origin is
opaque to the embedder but transparent to the inner content. This causes
a mismatch where the inner content is told to only allow a feature for
an opaque 'src', but it will see it was navigated to a transparent URL.
It will then disallow the feature, even though it is navigated to the
FencedFrameConfig installed in the "src" or "config" attribute.

This CL fixes that mismatch by re-calculating the frame tree node's
pending container policy once the mapped URL is known. More
specifically, we do this in
NavigationRequest::ReadyToCommitNavigation(). Any allowlists that
match the opaque 'src' (a value set by the embedder that doesn't and
shouldn't know the final navigated URL) are replaced with the fenced
frame config's mapped URL's origin. This updated container policy is
sent to the inner container's renderer process as normal where it is
used to construct the final permissions policy, as well as being used to
calculate the final permissions policy on the browser side.

Bug: 349080952
Change-Id: Ia255fc991b466ae35214d432cbf705279ca1da79
Reviewed-on: https://chromium-review.googlesource.com/5714693
WPT-Export-Revision: aab00446f7568847e5db5a784db630735d1e2aa0

Comment 1

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

Pushed to try (stability) https://treeherder.mozilla.org/#/jobs?repo=try&revision=712759b93030ea95d0e4b46fa2f1def71080962e

Comment 2

[Web Platform Test Sync Bot [:wpt-sync] (Matrix: #interop:mozilla.org)]

CI Results

Ran 0 Firefox configurations based on mozilla-central, and Firefox, Chrome, and Safari on GitHub CI

Total 2 tests and 4 subtests

Status Summary

Firefox

OK : 2
FAIL : 8

Chrome

OK : 1
FAIL : 4
TIMEOUT: 2
NOTRUN : 3

Safari

OK : 2
FAIL : 8

Links

GitHub PR Head
GitHub PR Base

Details

New Tests That Don't Pass

• /fenced-frame/allow-attribute-src.https.html?type=iframe [wpt.fyi]
  • Src permissions policy in allow attribute.: FAIL (Chrome: TIMEOUT, Safari: FAIL)
  • Src permissions policy after same-origin navigation.: FAIL (Chrome: NOTRUN, Safari: FAIL)
  • Src permissions policy after cross-origin navigation.: FAIL (Chrome: NOTRUN, Safari: FAIL)
  • Src permissions policy in child iframe inheritance works properly.: FAIL (Chrome: NOTRUN, Safari: FAIL)
• /fenced-frame/allow-attribute-src.https.html?type=fencedframe [wpt.fyi]
  • Src permissions policy in allow attribute.: FAIL (Chrome: FAIL, Safari: FAIL)
  • Src permissions policy after same-origin navigation.: FAIL (Chrome: FAIL, Safari: FAIL)
  • Src permissions policy after cross-origin navigation.: FAIL (Chrome: FAIL, Safari: FAIL)
  • Src permissions policy in child iframe inheritance works properly.: FAIL (Chrome: FAIL, Safari: FAIL)

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/bbdc8423cc42
[wpt PR 47342] - Fenced frame: fix 'src' permissions policy allowlist., a=testonly

Comment 4

[tszentpeteri]

https://hg.mozilla.org/mozilla-central/rev/bbdc8423cc42