Skip to content

Commit 4b36a44

Browse files
domenicchromium-wpt-export-bot
domenic
authored and
chromium-wpt-export-bot
committed
Origin isolation: report that opaque origins are origin-isolated
This reports data: and sandboxed iframes as always origin-isolated, according to the window.originIsolationRestricted property. This is done regardless of the process isolation state or the presence/absence of the Origin-Isolation header. The web platform tests were revamped in the following ways: * Sandboxed iframes and data: URL tests were split into -yes and -no variants, to ensure that the parent frame didn't influence the result. For sandboxed iframes in particular, the -no variant was not tested previously, and was failing until after the code changes here. * Additional tests for javascript: URLs were introduced, as an earlier version of this CL would trigger a DCHECK on opaque-origin pages navigating to javascript: URLs. * Shared code was factored out. The .html files are now just wrappers that delegate to resources/*-test.mjs files. Bug: 1095653 Change-Id: I69a1f388250d1364dd33c365c936a76546add5b2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2334103 Reviewed-by: Nate Chapin <[email protected]> Reviewed-by: Alex Moshchuk <[email protected]> Reviewed-by: Arthur Sonzogni <[email protected]> Commit-Queue: Domenic Denicola <[email protected]> Cr-Commit-Position: refs/heads/master@{#798741}
1 parent cc7af32 commit 4b36a44

27 files changed

+285
-72
lines changed

‎origin-isolation/getter-special-cases/csp-sandbox-no.https.html

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>window.originIsolationRestricted for a top-level frame sandboxed by CSP with no Origin-Isolation header</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
7+
<div id="log"></div>
8+
9+
<script type="module">
10+
import { testOriginIsolationRestricted } from "../resources/helpers.mjs";
11+
12+
// Even without the header, sandboxing makes this page have an opaque origin,
13+
// so it is origin-isolated.
14+
testOriginIsolationRestricted(self, true);
15+
</script>

‎origin-isolation/getter-special-cases/csp-sandbox-no.https.html.headers

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Content-Security-Policy: sandbox allow-scripts;

‎origin-isolation/getter-special-cases/csp-sandbox-yes.https.html

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>window.originIsolationRestricted for a top-level frame sandboxed by CSP with an Origin-Isolation header</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
7+
<div id="log"></div>
8+
9+
<script type="module">
10+
import { testOriginIsolationRestricted } from "../resources/helpers.mjs";
11+
12+
// We're definitely origin-isolated: both the CSP sandboxing and the
13+
// Origin-Isolation header should ensure this.
14+
testOriginIsolationRestricted(self, true);
15+
</script>

‎origin-isolation/getter-special-cases/csp-sandbox-yes.https.html.headers

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Content-Security-Policy: sandbox allow-scripts;
2+
Origin-Isolation: ?1

‎origin-isolation/getter-special-cases/data-to-javascript-no.https.html

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>window.originIsolationRestricted for a javascript: URL navigated to from a data: URL on a non-isolated page</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
7+
<div id="log"></div>
8+
9+
<script type="module">
10+
import runTest from "./resources/data-to-javascript-test.mjs";
11+
runTest();
12+
</script>

‎origin-isolation/getter-special-cases/data-to-javascript-yes.https.html

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>window.originIsolationRestricted for a javascript: URL navigated to from a data: URL on an isolated page</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
7+
<div id="log"></div>
8+
9+
<script type="module">
10+
import runTest from "./resources/data-to-javascript-test.mjs";
11+
runTest();
12+
</script>

‎origin-isolation/getter-special-cases/data-url.https.html.headers renamed to ‎origin-isolation/getter-special-cases/data-to-javascript-yes.https.html.headers

File renamed without changes.

‎origin-isolation/getter-special-cases/data-url-no.https.html

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>window.originIsolationRestricted for a data: URL on a non-isolated page</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
7+
<div id="log"></div>
8+
9+
<script type="module">
10+
import runTest from "./resources/data-url-test.mjs";
11+
runTest();
12+
</script>

‎origin-isolation/getter-special-cases/data-url-yes.https.html

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>window.originIsolationRestricted for a data: URL on an isolated page</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
7+
<div id="log"></div>
8+
9+
<script type="module">
10+
import runTest from "./resources/data-url-test.mjs";
11+
runTest();
12+
</script>

‎origin-isolation/getter-special-cases/sandboxed-iframe.sub.https.html.headers renamed to ‎origin-isolation/getter-special-cases/data-url-yes.https.html.headers

File renamed without changes.

‎origin-isolation/getter-special-cases/data-url.https.html

-40
This file was deleted.

‎origin-isolation/getter-special-cases/javascript-url-no.https.html

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>window.originIsolationRestricted for a javascript: URL on a non-isolated page</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
7+
<div id="log"></div>
8+
9+
<script type="module">
10+
import runTest from "./resources/data-url-test.mjs";
11+
runTest({ expected: false });
12+
</script>

‎origin-isolation/getter-special-cases/javascript-url-yes.https.html

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>window.originIsolationRestricted for a javascript: URL on an isolated page</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
7+
<div id="log"></div>
8+
9+
<script type="module">
10+
import runTest from "./resources/data-url-test.mjs";
11+
runTest({ expected: true });
12+
</script>

‎origin-isolation/getter-special-cases/javascript-url-yes.https.html.headers

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Origin-Isolation: ?1

‎origin-isolation/getter-special-cases/resources/data-to-javascript-test.mjs

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
import { insertCustomIframe, testSupportScript } from "./helpers.mjs";
2+
import { waitForIframe, testOriginIsolationRestricted } from "../../resources/helpers.mjs";
3+
4+
const testSupportScriptSuitableForNesting =
5+
testSupportScript.replace('</script>', '</scri` + `pt>');
6+
7+
export default () => {
8+
promise_setup(async () => {
9+
const jsURL = `javascript:'${testSupportScript}'`;
10+
const iframe = await insertCustomIframe(`data:text/html,
11+
Start page
12+
<script>
13+
window.onmessage = () => {
14+
location.href = \`javascript:'End page${testSupportScriptSuitableForNesting}'\`;
15+
};
16+
</script>
17+
`);
18+
19+
const waitPromise = waitForIframe(iframe, "javascript: URL");
20+
21+
// Kick off the navigation. We can't do it directly because only same-origin
22+
// pages can navigate to a javascript: URL, and we're not same-origin with
23+
// a data: URL.
24+
iframe.contentWindow.postMessage(undefined, "*");
25+
26+
await waitPromise;
27+
});
28+
29+
// The javascript: URL iframe inherits its origin from the previous occupant
30+
// of the iframe, which is a data: URL, so it should always be true.
31+
32+
testOriginIsolationRestricted(0, true);
33+
};

‎origin-isolation/getter-special-cases/resources/data-url-test.mjs

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
import { insertCustomIframe, testSupportScript } from "./helpers.mjs";
2+
import { testOriginIsolationRestricted } from "../../resources/helpers.mjs";
3+
4+
export default () => {
5+
promise_setup(() => {
6+
return insertCustomIframe(`data:text/html,${testSupportScript}`);
7+
});
8+
9+
// The data: URL iframe has an opaque origin, so it should return true, since
10+
// for them site === origin so they are always "origin-isolated".
11+
12+
testOriginIsolationRestricted(0, true, "data: URL child");
13+
};

‎origin-isolation/getter-special-cases/resources/helpers.mjs

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
import { waitForIframe } from "../../resources/helpers.mjs";
2+
3+
/**
4+
* Inserts an iframe, not specialized for origin-isolation testing, pointing to
5+
* a custom URL. This is just a wrapper to remove some boilerplate.
6+
* @param {string} src - The src="" value for the iframe
7+
*/
8+
export async function insertCustomIframe(src) {
9+
const iframe = document.createElement("iframe");
10+
iframe.src = src;
11+
12+
const waitPromise = waitForIframe(iframe);
13+
document.body.append(iframe);
14+
await waitPromise;
15+
16+
return iframe;
17+
}
18+
19+
/**
20+
* This is the part of send-origin-isolation-header.py that allows
21+
* us to reuse testOriginIsolationRestricted.
22+
*/
23+
export const testSupportScript = `
24+
<script>
25+
window.onmessage = () => {
26+
parent.postMessage(self.originIsolationRestricted, "*");
27+
};
28+
</script>
29+
`;

‎origin-isolation/getter-special-cases/resources/javascript-url-test.mjs

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
import { insertCustomIframe, testSupportScript } from "./helpers.mjs";
2+
import { testOriginIsolationRestricted } from "../../resources/helpers.mjs";
3+
4+
export default ({ expected }) => {
5+
promise_setup(() => {
6+
return insertCustomIframe(`javascript:'${testSupportScript}'`);
7+
});
8+
9+
// The javascript: URL iframe inherits its origin from the previous occupant
10+
// of the iframe, which is about:blank, which in turn inherits from the
11+
// parent. So, the caller needs to tell us what to expect.
12+
13+
testOriginIsolationRestricted(0, expected);
14+
};

‎origin-isolation/getter-special-cases/resources/sandboxed-iframe-test.sub.mjs

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
import {
2+
navigateIframe,
3+
testOriginIsolationRestricted
4+
} from "../../resources/helpers.mjs";
5+
6+
export default () => {
7+
// We do this manually instead of using insertIframe because we want to add a
8+
// sandbox="" attribute and we don't want to set both document.domains.
9+
promise_setup(() => {
10+
const iframe = document.createElement("iframe");
11+
iframe.sandbox = "allow-scripts";
12+
const navigatePromise = navigateIframe(iframe, "{{hosts[][]}}", "?1");
13+
document.body.append(iframe);
14+
return navigatePromise;
15+
});
16+
17+
// Sandboxed iframes have an opaque origin, so it should return true, since
18+
// for them site === origin so they are always "origin-isolated".
19+
testOriginIsolationRestricted(0, true);
20+
};

‎origin-isolation/getter-special-cases/resources/sandboxed-same-origin-iframe-test.sub.mjs

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
import {
2+
navigateIframe,
3+
testOriginIsolationRestricted
4+
} from "../../resources/helpers.mjs";
5+
6+
export default ({ expected }) => {
7+
// We do this manually instead of using insertIframe because we want to add a
8+
// sandbox="" attribute and we don't want to set both document.domains.
9+
promise_setup(() => {
10+
const iframe = document.createElement("iframe");
11+
iframe.sandbox = "allow-scripts allow-same-origin";
12+
const navigatePromise = navigateIframe(iframe, "{{hosts[][]}}", "?1");
13+
document.body.append(iframe);
14+
return navigatePromise;
15+
});
16+
17+
// Since the allow-same-origin token is set, this should behave like a normal
18+
// iframe, and follow the embedder.
19+
testOriginIsolationRestricted(0, expected);
20+
};

‎origin-isolation/getter-special-cases/sandboxed-iframe-no.https.html

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>window.originIsolationRestricted for a sandboxed iframe on a non-isolated page</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
7+
<div id="log"></div>
8+
9+
<script type="module">
10+
import runTest from "./resources/sandboxed-iframe-test.sub.mjs";
11+
runTest();
12+
</script>

‎origin-isolation/getter-special-cases/sandboxed-iframe-yes.https.html

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>window.originIsolationRestricted for a sandboxed iframe on an isolated page</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
7+
<div id="log"></div>
8+
9+
<script type="module">
10+
import runTest from "./resources/sandboxed-iframe-test.sub.mjs";
11+
runTest();
12+
</script>

‎origin-isolation/getter-special-cases/sandboxed-iframe-yes.https.html.headers

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Origin-Isolation: ?1

‎origin-isolation/getter-special-cases/sandboxed-iframe.sub.https.html

-32
This file was deleted.

‎origin-isolation/getter-special-cases/sandboxed-same-origin-iframe-no.https.html

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>window.originIsolationRestricted for a sandboxed, but same-origin, iframe on a non-isolated page</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
7+
<div id="log"></div>
8+
9+
<script type="module">
10+
import runTest from "./resources/sandboxed-same-origin-iframe-test.sub.mjs";
11+
runTest({ expected: false });
12+
</script>

‎origin-isolation/getter-special-cases/sandboxed-same-origin-iframe-yes.https.html

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<!DOCTYPE html>
2+
<meta charset="utf-8">
3+
<title>window.originIsolationRestricted for a sandboxed, but same-origin, iframe on an isolated page</title>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
7+
<div id="log"></div>
8+
9+
<script type="module">
10+
import runTest from "./resources/sandboxed-same-origin-iframe-test.sub.mjs";
11+
runTest({ expected: true });
12+
</script>

‎origin-isolation/getter-special-cases/sandboxed-same-origin-iframe-yes.https.html.headers

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Origin-Isolation: ?1

0 commit comments

Comments
 (0)