[Presentation API] Prevent other-Document top-level navigations in offscreen presentations |
|||||||||||
Issue descriptionTo match spec, we need to prevent presentations from top-level navigation of the Document that was loaded to create the presentation. Same-document navigation is okay (for example used for in-app routing) and window.location.reload() should be okay. It should be a straightforward change in offscreen_tab.cc by implementing the navigation observers. The spec is still getting refined - so we should hold off until the behavior is clarified.
,
Mar 2 2017
Blocked pending spec change. Please punt back to Untriaged once that's resolved.
,
Mar 23 2017
Spec change has landed: https://github.com/w3c/presentation-api/pull/415 Other follow-on items: - Ensure sandboxed modals flag is implemented - Check behavior of HTTP Auth dialogs
,
Mar 24 2017
,
Apr 19 2017
,
May 31 2017
,
Jun 16 2017
,
Jun 19 2017
,
Jul 13 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/7b73a6fa3c3c712a3ee135d224a7cc09ee473882 commit 7b73a6fa3c3c712a3ee135d224a7cc09ee473882 Author: mark a. foltz <mfoltz@chromium.org> Date: Thu Jul 13 23:53:13 2017 [chrome.tabCapture] Close presentations that attempt to navigate. Presentations have the sandboxed-top-level-navigation-browsing-context-flag set [1], so they should not be able to start top-level navigations that cross documents. This patch allows this navigation policy to be enforced for offscreen tabs that are started as presentations. A companion change in Blink, https://chromium-review.googlesource.com/c/540498, sets the appropriate flags on the Document for the presentation; this adds additional enforcement in the WebContents layer. [1] https://www.w3.org/TR/html51/browsers.html#sandboxed-top-level-navigation-browsing-context-flag Bug: 697526 Change-Id: Ic1f797b408df82c226d6023966afe2f972d6d159 Reviewed-on: https://chromium-review.googlesource.com/538975 Commit-Queue: mark a. foltz <mfoltz@chromium.org> Reviewed-by: Yuri Wiitala <miu@chromium.org> Cr-Commit-Position: refs/heads/master@{#486547} [modify] https://crrev.com/7b73a6fa3c3c712a3ee135d224a7cc09ee473882/chrome/browser/extensions/api/tab_capture/offscreen_tab.cc [modify] https://crrev.com/7b73a6fa3c3c712a3ee135d224a7cc09ee473882/chrome/browser/extensions/api/tab_capture/offscreen_tab.h [modify] https://crrev.com/7b73a6fa3c3c712a3ee135d224a7cc09ee473882/chrome/test/data/extensions/api_test/tab_capture/max_offscreen_tabs.js [modify] https://crrev.com/7b73a6fa3c3c712a3ee135d224a7cc09ee473882/chrome/test/data/extensions/api_test/tab_capture/offscreen_evil_tests.js
,
Jul 25 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/01ff34a1422231334ff3c9d4177000a88cee0f67 commit 01ff34a1422231334ff3c9d4177000a88cee0f67 Author: mark a. foltz <mfoltz@chromium.org> Date: Tue Jul 25 23:33:47 2017 [Presentation API] Adds content switch to test Presentation API receiver pages. This adds a switch, --force-presentation-receiver-for-testing, that loads pages as presentation receivers. This will simplify testing of sandboxing flags for these pages, which are set at main frame creation time. It also creates a virtual LayoutTest suite that enables this flag, and moves the existing layout test for presentation receiver to it. Bug: 697526 Change-Id: I3fa6df0547533c31348c434855e42ae3189acdf7 Reviewed-on: https://chromium-review.googlesource.com/581575 Commit-Queue: mark a. foltz <mfoltz@chromium.org> Reviewed-by: Avi Drissman <avi@chromium.org> Cr-Commit-Position: refs/heads/master@{#489482} [modify] https://crrev.com/01ff34a1422231334ff3c9d4177000a88cee0f67/content/public/common/content_switches.cc [modify] https://crrev.com/01ff34a1422231334ff3c9d4177000a88cee0f67/content/public/common/content_switches.h [modify] https://crrev.com/01ff34a1422231334ff3c9d4177000a88cee0f67/content/shell/renderer/layout_test/blink_test_helpers.cc [modify] https://crrev.com/01ff34a1422231334ff3c9d4177000a88cee0f67/third_party/WebKit/LayoutTests/VirtualTestSuites [delete] https://crrev.com/1b95a6b71a19bf68866bf63a8199e68e21f76a4c/third_party/WebKit/LayoutTests/presentation/presentation-receiver.html [add] https://crrev.com/01ff34a1422231334ff3c9d4177000a88cee0f67/third_party/WebKit/LayoutTests/virtual/presentation/receiver/README.txt [add] https://crrev.com/01ff34a1422231334ff3c9d4177000a88cee0f67/third_party/WebKit/LayoutTests/virtual/presentation/receiver/presentation-receiver.html
,
Aug 14 2017
,
Sep 11 2017
,
Oct 21 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/ef394fce1aedb8db58821242eadd70720b125153 commit ef394fce1aedb8db58821242eadd70720b125153 Author: mark a. foltz <mfoltz@chromium.org> Date: Sat Oct 21 09:11:02 2017 [Presentation API] Enforce sandboxing flags for presentations. This enforces sandboxing flags for pages loaded as presentations via the Presentation API, following step 3 of the steps to create a receiving browsing context [1]. Although top navigation is blocked in the implementation of OffscreenTab [2], we also set the kTopNavigation flag to be inherited by iframes. This patch adds layout tests. Web Platform Tests are available as well, but require manually starting a presentation. This patch also updates WebSandboxFlags to reflect the current set of sandboxing flags. [1] https://w3c.github.io/presentation-api/#creating-a-receiving-browsing-context [2] https://chromium-review.googlesource.com/c/538975/ Bug: 697526 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_site_isolation Change-Id: Idb0b8c51c03ef504767a7fc6c483c0909dc240fc Reviewed-on: https://chromium-review.googlesource.com/540498 Commit-Queue: mark a. foltz <mfoltz@chromium.org> Reviewed-by: Yuri Wiitala <miu@chromium.org> Reviewed-by: Daniel Cheng <dcheng@chromium.org> Reviewed-by: Alex Moshchuk <alexmos@chromium.org> Reviewed-by: Derek Cheng <imcheng@chromium.org> Reviewed-by: John Abd-El-Malek <jam@chromium.org> Cr-Commit-Position: refs/heads/master@{#510675} [modify] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/chrome/browser/DEPS [modify] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/chrome/browser/extensions/api/tab_capture/offscreen_tab.cc [modify] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/content/browser/web_contents/web_contents_impl.cc [modify] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/content/browser/web_contents/web_contents_impl_unittest.cc [modify] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/content/public/browser/web_contents.cc [modify] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/content/public/browser/web_contents.h [modify] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/content/shell/browser/shell.cc [add] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/third_party/WebKit/LayoutTests/virtual/presentation/receiver/presentation-receiver-iframe-sandboxing.html [add] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/third_party/WebKit/LayoutTests/virtual/presentation/receiver/presentation-receiver-sandboxing.html [add] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/third_party/WebKit/LayoutTests/virtual/presentation/receiver/resources/iframe-sandbox.html [modify] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/third_party/WebKit/public/BUILD.gn [add] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/third_party/WebKit/public/web/WebPresentationReceiverFlags.h [modify] https://crrev.com/ef394fce1aedb8db58821242eadd70720b125153/third_party/WebKit/public/web/WebSandboxFlags.h
,
Oct 23 2017
A followon item is to check the Web Platform Tests for this requirement.
,
Oct 25 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/236ce87af1a2fcc09075b2ec7ead68549c2e9e94 commit 236ce87af1a2fcc09075b2ec7ead68549c2e9e94 Author: mark a. foltz <mfoltz@chromium.org> Date: Wed Oct 25 18:26:54 2017 [Presentation API] Rename kPresentation sandbox flag. Followup to https://chromium-review.googlesource.com/540498. Renames the sandboxing flag for the PresentationRequest to kPresentationController to better reflect its effect on the controller role in the API, and to distinguish it from receiver sandboxing flags. Also adds a missing STATIC_ASSERT_ENUM in SandboxingFlags.cpp. Bug: 697526 Change-Id: Iaebf6575b91c9ea4dc38501d8e48323eb2e59e2e Reviewed-on: https://chromium-review.googlesource.com/734326 Commit-Queue: mark a. foltz <mfoltz@chromium.org> Reviewed-by: Daniel Cheng <dcheng@chromium.org> Reviewed-by: Derek Cheng <imcheng@chromium.org> Cr-Commit-Position: refs/heads/master@{#511523} [modify] https://crrev.com/236ce87af1a2fcc09075b2ec7ead68549c2e9e94/third_party/WebKit/Source/core/dom/SandboxFlags.cpp [modify] https://crrev.com/236ce87af1a2fcc09075b2ec7ead68549c2e9e94/third_party/WebKit/Source/core/dom/SandboxFlags.h [modify] https://crrev.com/236ce87af1a2fcc09075b2ec7ead68549c2e9e94/third_party/WebKit/Source/modules/presentation/PresentationRequest.cpp [modify] https://crrev.com/236ce87af1a2fcc09075b2ec7ead68549c2e9e94/third_party/WebKit/public/web/WebSandboxFlags.h |
|||||||||||
►
Sign in to add a comment |
|||||||||||
Comment 1 by mfo...@chromium.org
, Mar 1 2017