Skip to main content

Browse the archive

Revision 4c8580c189ce4501997af80b599bea070b1a7299 authored by Ian Clelland on 13 April 2018, 01:59:02 UTC, committed by Philip Jägenstedt on 13 April 2018, 12:05:15 UTC 
Allow feature policy to be used in opaque origins.
 
Currently, policy-controlled features do not work as expected in
frames with opaque origins, such as isolated sandboxes and data: URLs,
because the eventual opaque origin of the frame is not known when the
HTMLFrameOwnerElement builds the container policy, and so has no way
to tell the browser that a particular origin should be allowed.

This CL adds a new member to the ParsedFeaturePolicyDeclaration, which
indicates that the iframe policy is expected to apply to the origin of
the frame, and is used when that frame has an opaque origin. This can
be triggered with an iframe of the form

<iframe sandbox allow="feature">

or

<iframe sandbox allow="feature src">

This flag is checked when building the feature policy in the new frame,
and ensures that the new feature policy will allow the feature in that
origin.

This is the first part of the eventual solution -- currently this has
the effect of allowing the feature even if a sandboxed frame navigates
to a new page (causing a new opaque origin to be created for it).
Subsequent CLs will add a unique identified to each such origin, and
ensure that the generated policies are properly tied to the specific
origin of the frame.

Bug: 690520
Change-Id: Ie18b9bc3c36be6550baf5a03e355871b9589fd40
Reviewed-on: https://chromium-review.googlesource.com/963382
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Commit-Queue: Ian Clelland <iclelland@chromium.org>
Cr-Commit-Position: refs/heads/master@{#550463}
1 parent 1dd03e7
Raw File
Secure-Send-null.htm 
<!DOCTYPE html>
<html>
<head>
    <title>W3C WebSocket API - Send null data - Secure WebSocket</title>
    <script type="text/javascript" src="/resources/testharness.js"></script>
    <script type="text/javascript" src="/resources/testharnessreport.js"></script>
    <script type="text/javascript" src="websocket.sub.js"></script>
</head>
<body>
    <div id="log"></div>
    <script type="text/javascript">

        var testOpen = async_test("W3C WebSocket API - Send null data on a Secure WebSocket - Connection should be opened");
        var testMessage = async_test("W3C WebSocket API - Send null data on a Secure WebSocket - Message should be received");
        var testClose = async_test("W3C WebSocket API - Send null data on a Secure WebSocket - Connection should be closed");

        var data = null;
        var nullReturned = false;
        var wsocket = CreateWebSocket(true, false, false);
        var isOpenCalled = false;

        wsocket.addEventListener('open', testOpen.step_func(function (evt) {
            wsocket.send(data);
            isOpenCalled = true;
            testOpen.done();
        }), true);

        wsocket.addEventListener('message', testMessage.step_func(function (evt) {
            if ("null" == evt.data || "" == evt.data)
                nullReturned = true;
            assert_true(nullReturned);
            wsocket.close();
            testMessage.done();
        }), true);

        wsocket.addEventListener('close', testClose.step_func(function (evt) {
            assert_true(isOpenCalled, "WebSocket connection should be open");
            assert_equals(evt.wasClean, true, "wasClean should be true");
            testClose.done();
        }), true);
    </script>
</body>
</html>
back to top