I have a WIP CL (https://crrev.com/2507223003) for automating the scenario of dragging between 2 frames, but I estimate that this CL is 1+ week away from being landable... :-/

 issue 59081  has a regression test in layout tests (http/tests/security/drag-drop-different-origin.html), but this test unfortunately is not able to catch the regression (because AFAICT today it is not possible to use test_runner::EventSender from tests to support a drag-and-drop that goes over OOPIFs).

I forgot to note - the regression only happens in presence of OOPIFs:

- In --isolate-extensions mode (90% on dev, 50% on beta, planning to launch to stable with M56) the regression doesn't affect web pages (because they are kept in the same process/widget), but does affect dragging between extension and web pages.

- There is no regression in absence of OOPIFs (i.e. without --isolate-extension switch).

Can we plus note what OS's this affects in the bug information? Thank.

In theory this affects all OS-es, but we are considering launching --isolate-extensions in M56 only for desktop OS-es - so let me mark only them.

Noting that we'll need this for M56 to launch --isolate-extensions.  Paul mentioned that he has a CL in progress.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d4d9b103a38ebe19ef10fd894920081009f086a9

commit d4d9b103a38ebe19ef10fd894920081009f086a9
Author: lukasza <lukasza@chromium.org>
Date: Sat Dec 10 03:38:12 2016

Automated test for dragging between same-page, cross-site frames.

BUG= 666858 

Review-Url: https://codereview.chromium.org/2549023003
Cr-Commit-Position: refs/heads/master@{#437739}

[modify] https://crrev.com/d4d9b103a38ebe19ef10fd894920081009f086a9/chrome/browser/ui/views/drag_and_drop_interactive_uitest.cc
[modify] https://crrev.com/d4d9b103a38ebe19ef10fd894920081009f086a9/content/public/test/browser_test_utils.cc
[modify] https://crrev.com/d4d9b103a38ebe19ef10fd894920081009f086a9/content/public/test/browser_test_utils.h
[modify] https://crrev.com/d4d9b103a38ebe19ef10fd894920081009f086a9/testing/buildbot/filters/site-per-process.interactive_ui_tests.filter

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7dfa247951db2ccb10b8b5276eb58a33cda4728f

commit 7dfa247951db2ccb10b8b5276eb58a33cda4728f
Author: paulmeyer <paulmeyer@chromium.org>
Date: Wed Dec 14 20:34:02 2016

Prevent drag-and-drop events from firing over cross-site, same-page frames.

This is done by storing the source RenderViewHost and RenderProcessHost for each dragstart. Then, for other drag events (like dragover), if the target frame for that event is in the same RenderViewHost, but different RenderProcessHost, than the source, then the event is not fired.

Note that this patch will not affect behavior on Mac, and a subsequent CL will enforce the same thing for Mac.

BUG= 666858 

Review-Url: https://codereview.chromium.org/2568893002
Cr-Commit-Position: refs/heads/master@{#438609}

[modify] https://crrev.com/7dfa247951db2ccb10b8b5276eb58a33cda4728f/chrome/browser/ui/views/drag_and_drop_interactive_uitest.cc
[modify] https://crrev.com/7dfa247951db2ccb10b8b5276eb58a33cda4728f/content/browser/web_contents/web_contents_view_aura.cc
[modify] https://crrev.com/7dfa247951db2ccb10b8b5276eb58a33cda4728f/content/browser/web_contents/web_contents_view_aura.h
[modify] https://crrev.com/7dfa247951db2ccb10b8b5276eb58a33cda4728f/testing/buildbot/filters/site-per-process.interactive_ui_tests.filter

Looks like the Mac CL for this landed in r438911 (https://codereview.chromium.org/2580843003/), which is in today's canary (57.0.2953.0).  Thanks!

Paul, can this be marked fixed now?  Please request a merge to M56 once we're able to verify the fixes on both Windows and Mac.

Fix is verified in Canary for Windows and Mac.

Your change meets the bar and is auto-approved for M56 (branch: 2924)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/13b936546c5148df17caa25ee744d94307ff9e94

commit 13b936546c5148df17caa25ee744d94307ff9e94
Author: Paul Meyer <paulmeyer@chromium.org>
Date: Mon Dec 19 20:31:34 2016

Prevent drag-and-drop events from firing over cross-site, same-page frames.

This is done by storing the source RenderViewHost and RenderProcessHost for each dragstart. Then, for other drag events (like dragover), if the target frame for that event is in the same RenderViewHost, but different RenderProcessHost, than the source, then the event is not fired.

Note that this patch will not affect behavior on Mac, and a subsequent CL will enforce the same thing for Mac.

BUG= 666858 

Review-Url: https://codereview.chromium.org/2568893002
Cr-Commit-Position: refs/heads/master@{#438609}
(cherry picked from commit 7dfa247951db2ccb10b8b5276eb58a33cda4728f)

Review-Url: https://codereview.chromium.org/2590613002 .
Cr-Commit-Position: refs/branch-heads/2924@{#554}
Cr-Branched-From: 3a87aecc31cd1ffe751dd72c04e5a96a1fc8108a-refs/heads/master@{#433059}

[modify] https://crrev.com/13b936546c5148df17caa25ee744d94307ff9e94/content/browser/web_contents/web_contents_view_aura.cc
[modify] https://crrev.com/13b936546c5148df17caa25ee744d94307ff9e94/content/browser/web_contents/web_contents_view_aura.h
[modify] https://crrev.com/13b936546c5148df17caa25ee744d94307ff9e94/testing/buildbot/filters/site-per-process.interactive_ui_tests.filter

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/4ac976937b9c8c65e6eeb34678d7a7031fc0fdc3

commit 4ac976937b9c8c65e6eeb34678d7a7031fc0fdc3
Author: Paul Meyer <paulmeyer@chromium.org>
Date: Mon Dec 19 20:40:12 2016

Prevent drag-and-drop events from firing over cross-site, same-page frames.

This is a follow-up to https://codereview.chromium.org/2568893002/,
enabling the same behavior on Mac.

Review-Url: https://codereview.chromium.org/2580843003
Cr-Commit-Position: refs/heads/master@{#438911}
(cherry picked from commit 0678253f9e9c12a1cc704721ae6e013860bb909e)

BUG= 666858 

Review-Url: https://codereview.chromium.org/2589963002 .
Cr-Commit-Position: refs/branch-heads/2924@{#555}
Cr-Branched-From: 3a87aecc31cd1ffe751dd72c04e5a96a1fc8108a-refs/heads/master@{#433059}

[modify] https://crrev.com/4ac976937b9c8c65e6eeb34678d7a7031fc0fdc3/content/browser/web_contents/web_contents_view_mac.mm
[modify] https://crrev.com/4ac976937b9c8c65e6eeb34678d7a7031fc0fdc3/content/browser/web_contents/web_drag_dest_mac.h
[modify] https://crrev.com/4ac976937b9c8c65e6eeb34678d7a7031fc0fdc3/content/browser/web_contents/web_drag_dest_mac.mm

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot