mirror of
https://github.com/HeyPuter/firefox.git
synced 2026-11-13 20:14:57 -10:00
Camillia Smith Barnes
be23e57e17
Automatic update from web-platform-tests Shared Storage: Allow writes from headers in all sandboxed frames Previously, writing to shared storage via response headers by way of a fetch or image request would work inside a sandboxed iframe only if the iframe had sandbox flag "allow-same-origin". We remove this unnecessary restriction by correcting the origin used for the opaqueness check for sharedStorageWritable image and fetch requests: instead of checking the environment's origin for opaqueness, we now check the request's origin for opaqueness in order to determine eligibility for the 'Sec-Shared-Storage-Writable' request header. See https://github.com/WICG/shared-storage/pull/155 for the related specification fix. Bug: 339172115 Change-Id: Ia3d048c8441bb99ea48d3943c55fe83c943bcadf Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5527770 Reviewed-by: Nate Chapin <[email protected]> Reviewed-by: Yao Xiao <[email protected]> Commit-Queue: Cammie Smith Barnes <[email protected]> Cr-Commit-Position: refs/heads/main@{#1303509} -- wpt-commits: a05ac39c9649bc0be55863d26213499c10a30af1 wpt-pr: 46233
65 lines
2.4 KiB
HTML
65 lines
2.4 KiB
HTML
<!doctype html>
|
|
<body>
|
|
<script src=/resources/testharness.js></script>
|
|
<script src=/resources/testharnessreport.js></script>
|
|
<script src=/common/utils.js></script>
|
|
<script src=/fenced-frame/resources/utils.js></script>
|
|
<script src=/shared-storage/resources/util.js></script>
|
|
<script>
|
|
'use strict';
|
|
const origin = window.location.origin;
|
|
const rawSetHeader = 'set;key=hello;value=world';
|
|
const setHeader = encodeURIComponent(rawSetHeader);
|
|
|
|
promise_test(async t => {
|
|
let frame = document.createElement('iframe');
|
|
const promise = new Promise((resolve, reject) => {
|
|
window.addEventListener('message', async function handler(evt) {
|
|
if (evt.source === frame.contentWindow &&
|
|
evt.data.sharedStorageWritableHeader) {
|
|
document.body.removeChild(frame);
|
|
window.removeEventListener('message', handler);
|
|
resolve(evt.data.sharedStorageWritableHeader);
|
|
}
|
|
});
|
|
window.addEventListener('error', (error) => {
|
|
reject(error);
|
|
});
|
|
});
|
|
|
|
const innerUrl =
|
|
`${origin}\\/shared-storage\\/resources\\/shared-storage-write-`
|
|
+ `notify-parent.py?write=${setHeader}`;
|
|
const innerCode = `
|
|
let parentOrOpener = window.opener || window.parent;
|
|
let innerFrame = document.createElement('iframe');
|
|
window.addEventListener('message', async (evt) => {
|
|
if (evt.source === innerFrame.contentWindow &&
|
|
evt.data.sharedStorageWritableHeader) {
|
|
parentOrOpener.postMessage({sharedStorageWritableHeader:
|
|
evt.data.sharedStorageWritableHeader}, '*');
|
|
}
|
|
});
|
|
window.addEventListener('error', (error) => {
|
|
parentOrOpener.postMessage({sharedStorageWritableHeader: error.message}, '*');
|
|
});
|
|
innerFrame.src = '${innerUrl}';
|
|
innerFrame.sharedStorageWritable = true;
|
|
document.body.appendChild(innerFrame);
|
|
`;
|
|
|
|
const dataURL = 'data:text/html;base64,'
|
|
+ btoa(unescape('%3Chtml%3E%3Cbody%3E%3Cscript%3E'
|
|
+ encodeURIComponent(innerCode) +
|
|
'%3C%2Fscript%3E%3C%2Fbody%3E%3C%2Fhtml%3E'));
|
|
frame.src = dataURL;
|
|
document.body.appendChild(frame);
|
|
|
|
const result = await promise;
|
|
assert_equals(result, "NO_SHARED_STORAGE_WRITABLE_HEADER");
|
|
await verifyKeyNotFoundForOrigin('hello', origin);
|
|
|
|
}, 'shared storage iframe request disallowed in opaque origin from data URL');
|
|
</script>
|
|
</body>
|