mirror of
https://github.com/HeyPuter/firefox.git
synced 2026-11-13 20:14:57 -10:00
Camillia Smith Barnes
bcf1114476
Automatic update from web-platform-tests Shared Storage: Allow fetch/img header writes if permission on redirect We correct the behavior of writing to shared storage from response headers to match the spec with regard to how `PermissionsPolicy` checks are handled. Currently, if permission is revoked for any request in a redirect chain, then no subsequent request in that chain can write to shared storage from response headers. This CL updates the behavior for `fetch()` and `HTMLImageElement` so that, for redirect chains of requests that have opted-in via `sharedStorageWritable`, each request in the chain has its `PermissionsPolicy` checked independently of the others in the chain. https://crrev.com/c/4935951 will do the same for `HTMLIframeElement`. Bug: 1218540,1489536 Change-Id: I3110a237fb7f960b91f5940a3309abc623e81dbc Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4911530 Commit-Queue: Cammie Smith Barnes <[email protected]> Reviewed-by: Yao Xiao <[email protected]> Reviewed-by: Philip Rogers <[email protected]> Cr-Commit-Position: refs/heads/main@{#1217122} -- wpt-commits: f631d1aa161f0176f3eb0ef206f7c6dc6b7af047 wpt-pr: 42534
50 lines
2.2 KiB
HTML
50 lines
2.2 KiB
HTML
<!doctype html>
|
|
<body>
|
|
<script src=/resources/testharness.js></script>
|
|
<script src=/resources/testharnessreport.js></script>
|
|
<script src=/common/utils.js></script>
|
|
<script src=/fenced-frame/resources/utils.js></script>
|
|
<script src=/shared-storage/resources/util.js></script>
|
|
<script>
|
|
'use strict';
|
|
const rawSetHeader = 'set;key=hello;value=world';
|
|
const setHeader = encodeURIComponent(rawSetHeader);
|
|
const sameOriginUrl =
|
|
`/shared-storage/resources/shared-storage-write.py?write=${setHeader}`;
|
|
const sameOrigin = generateURL(sameOriginUrl, []).origin;
|
|
|
|
promise_test(async t => {
|
|
const request = new Request(sameOriginUrl,
|
|
{
|
|
headers: {
|
|
'Sec-Shared-Storage-Writable': '?1'
|
|
}
|
|
});
|
|
assert_equals(request.mode, 'cors');
|
|
let response = await fetch(request);
|
|
let sharedStorageWritableHeader = await response.text();
|
|
assert_equals(sharedStorageWritableHeader,
|
|
"NO_SHARED_STORAGE_WRITABLE_HEADER");
|
|
await verifyKeyNotFoundForOrigin('hello', sameOrigin);
|
|
}, 'The \'Sec-Shared-Storage-Writable\' header cannot successfully be '
|
|
+ 'added directly via a JS fetch request with mode cors.');
|
|
|
|
promise_test(async t => {
|
|
const request = new Request(sameOriginUrl,
|
|
{
|
|
headers: {
|
|
'Sec-Shared-Storage-Writable': '?1'
|
|
},
|
|
mode: 'no-cors'
|
|
});
|
|
assert_equals(request.mode, 'no-cors');
|
|
let response = await fetch(request);
|
|
let sharedStorageWritableHeader = await response.text();
|
|
assert_equals(sharedStorageWritableHeader,
|
|
"NO_SHARED_STORAGE_WRITABLE_HEADER");
|
|
await verifyKeyNotFoundForOrigin('hello', sameOrigin);
|
|
}, 'The \'Sec-Shared-Storage-Writable\' header cannot successfully be '
|
|
+ 'added directly via a JS fetch request with mode no-cors.');
|
|
</script>
|
|
</body>
|