From 0193961a0b54ed3239a8d6f0b9b883bf5f0fd652 Mon Sep 17 00:00:00 2001 From: Mike West Date: Tue, 5 Mar 2019 11:11:53 +0000 Subject: [PATCH] Bug 1527560 [wpt PR 15348] - Implement `Sec-Fetch-Mode`, a=testonly Automatic update from web-platform-tests Implement `Sec-Fetch-Mode` This patch implements `Sec-Fetch-Mode`, which adds the current CORS mode to outgoing, secure requests, as defined in https://mikewest.github.io/sec-metadata/#sec-fetch-mode-header. Bug: 843478 Change-Id: I811bfa86bdac1600b8abdd275d9526f6408e62e2 Reviewed-on: https://chromium-review.googlesource.com/c/1466362 Reviewed-by: Camille Lamy Commit-Queue: Mike West Cr-Commit-Position: refs/heads/master@{#631651} -- wpt-commits: 86bfe06b7260f552913b3274c30377ce7e9968b8 wpt-pr: 15348 --- .../embed.tentative.https.sub.html | 6 +-- .../fetch.tentative.https.sub.html | 50 +++++++++++++++++-- .../font.tentative.https.sub.html | 6 +-- .../iframe.tentative.https.sub.html | 9 ++-- .../sec-metadata/iframe.tentative.sub.html | 9 ++-- .../sec-metadata/img.tentative.https.sub.html | 9 ++-- .../object.tentative.https.sub.html | 6 +-- ...oss-site-redirect.tentative.https.sub.html | 6 +-- ...direct-cross-site.tentative.https.sub.html | 2 +- ...edirect-same-site.tentative.https.sub.html | 2 +- ...e-origin-redirect.tentative.https.sub.html | 6 +-- ...ame-site-redirect.tentative.https.sub.html | 6 +-- .../report.tentative.https.sub.html | 6 +-- .../fetch/sec-metadata/resources/helper.js | 3 +- .../script.tentative.https.sub.html | 24 +++++++-- .../sec-metadata/script.tentative.sub.html | 9 ++-- .../serviceworker.tentative.https.sub.html | 2 +- .../sharedworker.tentative.https.sub.html | 2 +- .../style.tentative.https.sub.html | 27 ++++++++-- .../track.tentative.https.sub.html | 47 +++++++++++++++-- .../window-open.tentative.https.sub.html | 18 ++++--- .../worker.tentative.https.sub.html | 2 +- .../xslt.tentative.https.sub.html | 6 +-- 23 files changed, 202 insertions(+), 61 deletions(-) diff --git a/testing/web-platform/tests/fetch/sec-metadata/embed.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/embed.tentative.https.sub.html index 1c69c021accb..6f0c43959504 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/embed.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/embed.tentative.https.sub.html @@ -13,7 +13,7 @@ let e = document.createElement('embed'); e.src = "https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; e.onload = e => { - let expected = {"dest":"embed", "site":"same-origin", "user":"?F"}; + let expected = {"dest":"embed", "site":"same-origin", "user":"?F", "mode":"no-cors"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) @@ -32,7 +32,7 @@ let e = document.createElement('embed'); e.src = "https://{{hosts[][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; e.onload = e => { - let expected = {"dest":"embed", "site":"same-site", "user":"?F"}; + let expected = {"dest":"embed", "site":"same-site", "user":"?F", "mode":"no-cors"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) @@ -51,7 +51,7 @@ let e = document.createElement('embed'); e.src = "https://{{hosts[alt][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; e.onload = e => { - let expected = {"dest":"embed", "site":"cross-site", "user":"?F"}; + let expected = {"dest":"embed", "site":"cross-site", "user":"?F", "mode":"no-cors"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) diff --git a/testing/web-platform/tests/fetch/sec-metadata/fetch.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/fetch.tentative.https.sub.html index f6460b4efca7..dc4b977ac6ec 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/fetch.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/fetch.tentative.https.sub.html @@ -3,6 +3,7 @@ diff --git a/testing/web-platform/tests/fetch/sec-metadata/font.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/font.tentative.https.sub.html index d2bcf6928848..9792f2dce942 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/font.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/font.tentative.https.sub.html @@ -46,7 +46,7 @@ promise_test(t => { return new Promise((resolve, reject) => { let key = "font-same-origin"; - let expected = {"dest":"font", "site":"same-origin", "user":"?F"}; + let expected = {"dest":"font", "site":"same-origin", "user":"?F", "mode": "cors"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) @@ -58,7 +58,7 @@ promise_test(t => { return new Promise((resolve, reject) => { let key = "font-same-site"; - let expected = {"dest":"font", "site":"same-site", "user":"?F"}; + let expected = {"dest":"font", "site":"same-site", "user":"?F", "mode": "cors"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) @@ -70,7 +70,7 @@ promise_test(t => { return new Promise((resolve, reject) => { let key = "font-cross-site"; - let expected = {"dest":"font", "site":"cross-site", "user":"?F"}; + let expected = {"dest":"font", "site":"cross-site", "user":"?F", "mode": "cors"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) diff --git a/testing/web-platform/tests/fetch/sec-metadata/iframe.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/iframe.tentative.https.sub.html index 6ee14300296b..73bd90745d1a 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/iframe.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/iframe.tentative.https.sub.html @@ -14,7 +14,8 @@ assert_header_equals(e.data, { "dest": "nested-document", "site": "same-origin", - "user":"?F" + "user": "?F", + "mode": "navigate" }); t.done(); })); @@ -32,7 +33,8 @@ assert_header_equals(e.data, { "dest": "nested-document", "site": "same-site", - "user": "?F" + "user": "?F", + "mode": "navigate" }); t.done(); })); @@ -50,7 +52,8 @@ assert_header_equals(e.data, { "dest": "nested-document", "site": "cross-site", - "user": "?F" + "user": "?F", + "mode": "navigate" }); t.done(); })); diff --git a/testing/web-platform/tests/fetch/sec-metadata/iframe.tentative.sub.html b/testing/web-platform/tests/fetch/sec-metadata/iframe.tentative.sub.html index ce31a8182510..eab2d3f5886e 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/iframe.tentative.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/iframe.tentative.sub.html @@ -14,7 +14,8 @@ assert_header_equals(e.data, { "dest": "", "site": "", - "user": "" + "user": "", + "mode": "", }); t.done(); })); @@ -32,7 +33,8 @@ assert_header_equals(e.data, { "dest": "", "site": "", - "user": "" + "user": "", + "mode": "", }); t.done(); })); @@ -50,7 +52,8 @@ assert_header_equals(e.data, { "dest": "", "site": "", - "user": "" + "user": "", + "mode": "", }); t.done(); })); diff --git a/testing/web-platform/tests/fetch/sec-metadata/img.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/img.tentative.https.sub.html index c5c389503cca..252b220011c5 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/img.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/img.tentative.https.sub.html @@ -21,7 +21,8 @@ assert_header_equals(got, { "dest": "image", "site": "same-origin", - "user": "?F" + "user": "?F", + "mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin` }); }), [], @@ -42,7 +43,8 @@ assert_header_equals(got, { "dest": "image", "site": "same-site", - "user": "?F" + "user": "?F", + "mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin` }); }), [], @@ -63,7 +65,8 @@ assert_header_equals(got, { "dest": "image", "site": "cross-site", - "user": "?F" + "user": "?F", + "mode": "cors", // Because `loadImageInWindow` tacks on `crossorigin` }); }), [], diff --git a/testing/web-platform/tests/fetch/sec-metadata/object.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/object.tentative.https.sub.html index 0b9839470d1d..2a0e8de85568 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/object.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/object.tentative.https.sub.html @@ -13,7 +13,7 @@ let e = document.createElement('object'); e.data = "https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; e.onload = e => { - let expected = {"dest":"object", "site":"same-origin", "user":"?F"}; + let expected = {"dest":"object", "site":"same-origin", "user":"?F", "mode":"no-cors"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) @@ -32,7 +32,7 @@ let e = document.createElement('object'); e.data = "https://{{hosts[][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; e.onload = e => { - let expected = {"dest":"object", "site":"same-site", "user":"?F"}; + let expected = {"dest":"object", "site":"same-site", "user":"?F", "mode":"no-cors"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) @@ -51,7 +51,7 @@ let e = document.createElement('object'); e.data = "https://{{hosts[alt][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; e.onload = e => { - let expected = {"dest":"object", "site":"cross-site", "user":"?F"}; + let expected = {"dest":"object", "site":"cross-site", "user":"?F", "mode":"no-cors"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) diff --git a/testing/web-platform/tests/fetch/sec-metadata/redirect/cross-site-redirect.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/redirect/cross-site-redirect.tentative.https.sub.html index 56d88d9156c7..f88cf140d4e3 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/redirect/cross-site-redirect.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/redirect/cross-site-redirect.tentative.https.sub.html @@ -12,7 +12,7 @@ promise_test(t => { let e = document.createElement('img'); e.src = "https://{{hosts[alt][www]}}:{{ports[https][0]}}/xhr/resources/redirect.py?location=https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; - let expected = {"dest":"image", "site":"cross-site", "user":"?F"}; + let expected = {"dest":"image", "site":"cross-site", "user":"?F", "mode": "no-cors"}; e.onload = e => { fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) @@ -38,7 +38,7 @@ promise_test(t => { let e = document.createElement('img'); e.src = "https://{{hosts[alt][www]}}:{{ports[https][0]}}/xhr/resources/redirect.py?location=https://{{hosts[][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; - let expected = {"dest":"image", "site":"cross-site", "user":"?F"}; + let expected = {"dest":"image", "site":"cross-site", "user":"?F", "mode": "no-cors"}; e.onload = e => { fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) @@ -64,7 +64,7 @@ promise_test(t => { let e = document.createElement('img'); e.src = "https://{{hosts[alt][www]}}:{{ports[https][0]}}/xhr/resources/redirect.py?location=https://{{hosts[alt][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; - let expected = {"dest":"image", "site":"cross-site", "user":"?F"}; + let expected = {"dest":"image", "site":"cross-site", "user":"?F", "mode": "no-cors"}; e.onload = e => { fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) diff --git a/testing/web-platform/tests/fetch/sec-metadata/redirect/multiple-redirect-cross-site.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/redirect/multiple-redirect-cross-site.tentative.https.sub.html index f6d18f568f1a..688c697ac931 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/redirect/multiple-redirect-cross-site.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/redirect/multiple-redirect-cross-site.tentative.https.sub.html @@ -14,7 +14,7 @@ promise_test(t => { e.src = "https://{{host}}:{{ports[https][0]}}/xhr/resources/redirect.py?location=" +// same-origin "https://{{hosts[alt][www]}}:{{ports[https][0]}}/xhr/resources/redirect.py?location=" +// cross-site "https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key;// same-origin - let expected = {"dest":"image", "site":"cross-site", "user":"?F"}; + let expected = {"dest":"image", "site":"cross-site", "user":"?F", "mode": "no-cors"}; e.onload = e => { fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) diff --git a/testing/web-platform/tests/fetch/sec-metadata/redirect/multiple-redirect-same-site.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/redirect/multiple-redirect-same-site.tentative.https.sub.html index 4756a79ab258..bc79f7810a1b 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/redirect/multiple-redirect-same-site.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/redirect/multiple-redirect-same-site.tentative.https.sub.html @@ -14,7 +14,7 @@ promise_test(t => { e.src = "https://{{host}}:{{ports[https][0]}}/xhr/resources/redirect.py?location=" +// same-origin "https://{{hosts[][www]}}:{{ports[https][0]}}/xhr/resources/redirect.py?location=" +// same-site "https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key;// same-origin - let expected = {"dest":"image", "site":"same-site", "user":"?F"}; + let expected = {"dest":"image", "site":"same-site", "user":"?F", "mode": "no-cors"}; e.onload = e => { fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) diff --git a/testing/web-platform/tests/fetch/sec-metadata/redirect/same-origin-redirect.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/redirect/same-origin-redirect.tentative.https.sub.html index 8558d6890e6f..a5323921c26b 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/redirect/same-origin-redirect.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/redirect/same-origin-redirect.tentative.https.sub.html @@ -12,7 +12,7 @@ promise_test(t => { let e = document.createElement('img'); e.src = "/xhr/resources/redirect.py?location=https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; - let expected = {"dest":"image", "site":"same-origin", "user":"?F"}; + let expected = {"dest":"image", "site":"same-origin", "user":"?F", "mode": "no-cors"}; e.onload = e => { fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) @@ -39,7 +39,7 @@ promise_test(t => { let e = document.createElement('img'); e.src = "/xhr/resources/redirect.py?location=https://{{hosts[][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; - let expected = {"dest":"image", "site":"same-site", "user":"?F"}; + let expected = {"dest":"image", "site":"same-site", "user":"?F", "mode": "no-cors"}; e.onload = e => { fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) @@ -66,7 +66,7 @@ promise_test(t => { let e = document.createElement('img'); e.src = "/xhr/resources/redirect.py?location=https://{{hosts[alt][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; - let expected = {"dest":"image", "site":"cross-site", "user":"?F"}; + let expected = {"dest":"image", "site":"cross-site", "user":"?F", "mode": "no-cors"}; e.onload = e => { fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) diff --git a/testing/web-platform/tests/fetch/sec-metadata/redirect/same-site-redirect.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/redirect/same-site-redirect.tentative.https.sub.html index 8e05b255b88d..92749ae0b80c 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/redirect/same-site-redirect.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/redirect/same-site-redirect.tentative.https.sub.html @@ -12,7 +12,7 @@ promise_test(t => { let e = document.createElement('img'); e.src = "https://{{hosts[][www]}}:{{ports[https][0]}}/xhr/resources/redirect.py?location=https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; - let expected = {"dest":"image", "site":"same-site", "user":"?F"}; + let expected = {"dest":"image", "site":"same-site", "user":"?F", "mode": "no-cors"}; e.onload = e => { fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) @@ -39,7 +39,7 @@ promise_test(t => { let e = document.createElement('img'); e.src = "https://{{hosts[][www]}}:{{ports[https][0]}}/xhr/resources/redirect.py?location=https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; - let expected = {"dest":"image", "site":"same-site", "user":"?F"}; + let expected = {"dest":"image", "site":"same-site", "user":"?F", "mode": "no-cors"}; e.onload = e => { fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) @@ -66,7 +66,7 @@ promise_test(t => { let e = document.createElement('img'); e.src = "https://{{hosts[][www]}}:{{ports[https][0]}}/xhr/resources/redirect.py?location=https://{{hosts[alt][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; - let expected = {"dest":"image", "site":"cross-site", "user":"?F"}; + let expected = {"dest":"image", "site":"cross-site", "user":"?F", "mode": "no-cors"}; e.onload = e => { fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) diff --git a/testing/web-platform/tests/fetch/sec-metadata/report.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/report.tentative.https.sub.html index 1cfa8641ba87..f1d8e06e50e2 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/report.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/report.tentative.https.sub.html @@ -22,9 +22,9 @@ document.addEventListener("securitypolicyviolation", (e) => { counter++; if (counter == 3) { - generate_test({"dest":"report", "site":"same-origin", "user":"?F"}, "same-origin"); - generate_test({"dest":"report", "site":"same-site", "user":"?F"}, "same-site"); - generate_test({"dest":"report", "site":"cross-site", "user":"?F"}, "cross-site"); + generate_test({"dest":"report", "site":"same-origin", "user":"?F", "mode": "no-cors"}, "same-origin"); + generate_test({"dest":"report", "site":"same-site", "user":"?F", "mode": "no-cors"}, "same-site"); + generate_test({"dest":"report", "site":"cross-site", "user":"?F", "mode": "no-cors"}, "cross-site"); } }); }, "Initialization."); diff --git a/testing/web-platform/tests/fetch/sec-metadata/resources/helper.js b/testing/web-platform/tests/fetch/sec-metadata/resources/helper.js index 1a9ec154e02b..4bee68996e86 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/resources/helper.js +++ b/testing/web-platform/tests/fetch/sec-metadata/resources/helper.js @@ -4,8 +4,7 @@ function assert_header_equals(value, expected) { value = JSON.parse(value); } assert_equals(value.dest, expected.dest, "dest"); - // Mode is commented out as no test cases have been filled out yet - // assert_equals(value.mode, expected.mode, "mode"); + assert_equals(value.mode, expected.mode, "mode"); assert_equals(value.site, expected.site, "site"); assert_equals(value.user, expected.user, "user"); } diff --git a/testing/web-platform/tests/fetch/sec-metadata/script.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/script.tentative.https.sub.html index d76378f1dd8d..a35e753c7898 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/script.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/script.tentative.https.sub.html @@ -12,7 +12,8 @@ assert_header_equals(header, { "dest": "script", "site": "same-origin", - "user":"?F" + "user": "?F", + "mode": "no-cors", }); }, "Same-origin script"); @@ -26,7 +27,8 @@ assert_header_equals(header, { "dest": "script", "site": "same-site", - "user":"?F" + "user": "?F", + "mode": "no-cors", }); }, "Same-site script"); @@ -40,7 +42,23 @@ assert_header_equals(header, { "dest": "script", "site": "cross-site", - "user":"?F" + "user": "?F", + "mode": "no-cors", }); }, "Cross-site script"); + + + + diff --git a/testing/web-platform/tests/fetch/sec-metadata/script.tentative.sub.html b/testing/web-platform/tests/fetch/sec-metadata/script.tentative.sub.html index 482f4b98f9e8..3218a40abded 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/script.tentative.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/script.tentative.sub.html @@ -12,7 +12,8 @@ assert_header_equals(header, { "dest": "", "site": "", - "user": "" + "user": "", + "mode": "", }); }, "Non-secure same-origin script => No headers"); @@ -26,7 +27,8 @@ assert_header_equals(header, { "dest": "", "site": "", - "user": "" + "user": "", + "mode": "", }); }, "Non-secure same-site script => No headers"); @@ -40,7 +42,8 @@ assert_header_equals(header, { "dest": "", "site": "", - "user": "" + "user": "", + "mode": "", }); }, "Non-secure cross-site script => No headers"); diff --git a/testing/web-platform/tests/fetch/sec-metadata/serviceworker.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/serviceworker.tentative.https.sub.html index d0b86d2d9a8c..5b7ee772b617 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/serviceworker.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/serviceworker.tentative.https.sub.html @@ -35,7 +35,7 @@ promise_test(t => { return new Promise((resolve, reject) => { let key = "serviceworker-same-origin"; - let expected = {"dest":"serviceworker", "site":"same-origin", "user":"?F"}; + let expected = {"dest":"serviceworker", "site":"same-origin", "user":"?F", "mode": "same-origin"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) diff --git a/testing/web-platform/tests/fetch/sec-metadata/sharedworker.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/sharedworker.tentative.https.sub.html index 66f7d5b9d8dc..cfeadd8d8e20 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/sharedworker.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/sharedworker.tentative.https.sub.html @@ -26,7 +26,7 @@ promise_test(t => { return new Promise((resolve, reject) => { let key = "sharedworker-same-origin"; - let expected = {"dest":"sharedworker", "site":"same-origin", "user":"?F"}; + let expected = {"dest":"sharedworker", "site":"same-origin", "user":"?F", "mode": "same-origin"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) diff --git a/testing/web-platform/tests/fetch/sec-metadata/style.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/style.tentative.https.sub.html index 9697db75c82f..4ae12662a293 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/style.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/style.tentative.https.sub.html @@ -14,7 +14,7 @@ e.rel = "stylesheet"; e.href = "https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; e.onload = e => { - let expected = {"dest":"style", "site":"same-origin", "user":"?F"}; + let expected = {"dest":"style", "site":"same-origin", "user":"?F", "mode": "no-cors"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) @@ -34,7 +34,7 @@ e.rel = "stylesheet"; e.href = "https://{{hosts[][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; e.onload = e => { - let expected = {"dest":"style", "site":"same-site", "user":"?F"}; + let expected = {"dest":"style", "site":"same-site", "user":"?F", "mode": "no-cors"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) @@ -54,7 +54,7 @@ e.rel = "stylesheet"; e.href = "https://{{hosts[alt][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; e.onload = e => { - let expected = {"dest":"style", "site":"cross-site", "user":"?F"}; + let expected = {"dest":"style", "site":"cross-site", "user":"?F", "mode": "no-cors"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) @@ -65,6 +65,27 @@ document.body.appendChild(e); }) }, "Cross-Site style"); + + promise_test(t => { + return new Promise((resolve, reject) => { + let key = "style-same-origin"; + + let e = document.createElement('link'); + e.rel = "stylesheet"; + e.href = "https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=" + key; + e.crossOrigin = "anonymous"; + e.onload = e => { + let expected = {"dest":"style", "site":"same-origin", "user":"?F", "mode": "cors"}; + fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) + .then(response => response.text()) + .then(text => assert_header_equals(text, expected)) + .then(_ => resolve()) + .catch(e => reject(e)); + }; + + document.body.appendChild(e); + }) + }, "Same-Origin, cors style"); diff --git a/testing/web-platform/tests/fetch/sec-metadata/track.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/track.tentative.https.sub.html index b9dfabf97397..89933f22c393 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/track.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/track.tentative.https.sub.html @@ -29,7 +29,12 @@ let el = createTrack(); el.src = "https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=track-same-origin"; el.onload = t.step_func(_ => { - expected = {"dest":"track", "site":"same-origin", "user":"?F"}; + expected = { + "dest": "track", + "site": "same-origin", + "user": "?F", + "mode": "cors" // Because the `video` element has `crossorigin` + }; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=track-same-origin") .then(response => response.text()) .then(text => assert_header_equals(text, expected)) @@ -46,7 +51,12 @@ let el = createTrack(); el.src = "https://{{hosts[][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=track-same-site"; el.onload = t.step_func(_ => { - expected = {"dest":"track", "site":"same-site", "user":"?F"}; + expected = { + "dest": "track", + "site": "same-site", + "user": "?F", + "mode": "cors" // Because the `video` element has `crossorigin` + }; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=track-same-site") .then(response => response.text()) .then(text => assert_header_equals(text, expected)) @@ -65,7 +75,12 @@ let el = createTrack(); el.src = "https://{{hosts[alt][www]}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=track-cross-site"; el.onload = t.step_func(_ => { - expected = {"dest":"track", "site":"cross-site", "user":"?F"}; + expected = { + "dest": "track", + "site": "cross-site", + "user": "?F", + "mode": "cors" // Because the `video` element has `crossorigin` + }; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=track-cross-site") .then(response => response.text()) .then(text => assert_header_equals(text, expected)) @@ -76,4 +91,30 @@ document.body.appendChild(video); }); }, "Cross-Site track"); + + promise_test(t => { + return new Promise((resolve, reject) => { + let video = createVideoElement(); + + // Unset `crossorigin` to change the CORS mode: + video.crossOrigin = undefined; + + let el = createTrack(); + el.src = "https://{{host}}:{{ports[https][0]}}/fetch/sec-metadata/resources/record-header.py?file=track-same-origin"; + el.onload = t.step_func(_ => { + expected = { + "dest":"track", + "site":"same-origin", + "user":"?F", + "mode": "same-origin" + }; + fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=track-same-origin") + .then(response => response.text()) + .then(text => assert_header_equals(text, expected)) + .then(_ => resolve()); + }); + video.appendChild(el); + document.body.appendChild(video); + }); + }, "Same-Origin, CORS track"); diff --git a/testing/web-platform/tests/fetch/sec-metadata/window-open.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/window-open.tentative.https.sub.html index 236268e17740..2957dad40a43 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/window-open.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/window-open.tentative.https.sub.html @@ -17,7 +17,8 @@ assert_header_equals(e.data, { "dest": "document", "site": "same-origin", - "user":"?F" + "user": "?F", + "mode": "navigate", }); t.done(); })); @@ -33,7 +34,8 @@ assert_header_equals(e.data, { "dest": "document", "site": "same-site", - "user":"?F" + "user": "?F", + "mode": "navigate", }); t.done(); })); @@ -49,7 +51,8 @@ assert_header_equals(e.data, { "dest": "document", "site": "cross-site", - "user":"?F" + "user": "?F", + "mode": "navigate", }); t.done(); })); @@ -68,7 +71,8 @@ assert_header_equals(e.data, { "dest": "document", "site": "same-origin", - "user": "?T" + "user": "?T", + "mode": "navigate", }); t.done(); })); @@ -89,7 +93,8 @@ assert_header_equals(e.data, { "dest": "document", "site": "same-site", - "user": "?T" + "user": "?T", + "mode": "navigate", }); t.done(); })); @@ -110,7 +115,8 @@ assert_header_equals(e.data, { "dest": "document", "site": "cross-site", - "user": "?T" + "user": "?T", + "mode": "navigate", }); t.done(); })); diff --git a/testing/web-platform/tests/fetch/sec-metadata/worker.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/worker.tentative.https.sub.html index fcffe91dbf70..89be6f0b5a1b 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/worker.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/worker.tentative.https.sub.html @@ -10,7 +10,7 @@ let key = "worker-same-origin"; let w = new Worker("/fetch/sec-metadata/resources/record-header.py?file=" + key); w.onmessage = e => { - let expected = {"dest":"worker", "site":"same-origin", "user":"?F"}; + let expected = {"dest":"worker", "site":"same-origin", "user":"?F", "mode": "same-origin"}; fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=" + key) .then(response => response.text()) .then(text => assert_header_equals(text, expected)) diff --git a/testing/web-platform/tests/fetch/sec-metadata/xslt.tentative.https.sub.html b/testing/web-platform/tests/fetch/sec-metadata/xslt.tentative.https.sub.html index 32349c9598e8..eea2329900e0 100644 --- a/testing/web-platform/tests/fetch/sec-metadata/xslt.tentative.https.sub.html +++ b/testing/web-platform/tests/fetch/sec-metadata/xslt.tentative.https.sub.html @@ -12,21 +12,21 @@ return; promise_test(t => { - let expected = {"dest":"xslt", "site":"same-origin", "user":"?F"}; + let expected = {"dest":"xslt", "site":"same-origin", "user":"?F", "mode": "same-origin"}; return fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=xslt-same-origin") .then(response => response.text()) .then(text => assert_header_equals(text, expected)); }, "Same-Origin xslt"); promise_test(t => { - let expected = {"dest":"xslt", "site":"same-site", "user":"?F"}; + let expected = {"dest":"xslt", "site":"same-site", "user":"?F", "mode": "no-cors"}; return fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=xslt-same-site") .then(response => response.text()) .then(text => assert_header_equals(text, expected)); }, "Same-site xslt"); promise_test(t => { - let expected = {"dest":"xslt", "site":"cross-site", "user":"?F"}; + let expected = {"dest":"xslt", "site":"cross-site", "user":"?F", "mode": "no-cors"}; return fetch("/fetch/sec-metadata/resources/record-header.py?retrieve=true&file=xslt-cross-site") .then(response => response.text()) .then(text => assert_header_equals(text, expected));