Bad IPC message to password manager with out-of-process iframes enabled |
|||||
Issue descriptionChrome Version: 57.0.2938.0 (also reproduced on 55.0.2883.59) OS: reproduced on Mac and Linux What steps will reproduce the problem? (1) Navigate to chrome://flags, enable "Out of process iframes", relaunch Chrome. (2) Navigate to http://example.com and open DevTools. (3) In the console, run the following: var i = document.createElement('iframe'); i.srcdoc = "<input type='password'>"; document.body.appendChild(i) What is the expected result? No sad tab What happens instead? Sad tab with the following message: Terminating renderer for bad PasswordManager IPC message, reason 1
,
Dec 2 2016
debugged a repro. url comes in as about:srcdoc, so this may be an issue of the renderer needing to send the origin rather than the url. if so blob and filesystem may also be affected
,
Dec 2 2016
This also seems to happen with an about:blank iframe and an injected <input>. But seems to work fine with data: and blob: URLs.
,
Dec 8 2016
While I could not reproduce on about:blank, I could reproduce on the originally reported example.com. I see ChildProcessSecurityPolicyImpl::SecurityState::CanAccessDataForOrigin return false after seeing origin_lock_=="http://example.com/" and site_gurl=="about:". This leads to the failed bad message check and renderer kill. I have no idea what the method does, though. nick@, do you know?
,
Dec 8 2016
Marking "Polish" because the effect of this bug is user-visible (and also to get it out of the triaging queue for passwords).
,
Oct 23 2017
Seems to work fine on 64.0.3245.0 (GNU/Linux). There is no longer the "Out of process iframes" flag, but I assume this is now the default behaviour? If not, please reopen and try to specify the URL of the flag to use. Thanks!
,
Oct 23 2017
The about:flags feature for --site-per-process changed names from "Out of process iframes" to "Strict site isolation" and it's still experimental, but I agree this doesn't repro anymore when it's enabled. (We're just finishing up a week long trial of having that enabled for a percentage of Canary, FWIW.) I think it was likely fixed by alexmos@ in r503339 for issue 756587. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by nick@chromium.org
, Dec 2 2016