New issue
Advanced search Search tips

Issue 742589 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Aug 2017
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 2
Type: Bug



Sign in to add a comment

Limit canMakePayment rate limiting to iFrame+Parent Frame

Project Member Reported by zkoch@chromium.org, Jul 13 2017

Issue description

Right now canMakePayment is rate limited to an iFrame. This is problematic for gateways who use the same iFrame across different parent websites.

How about instead of rate limiting to just iFrame origin or just parent origin, we do a concatenation of them? 

e.g.
alice.com:bob.com -> ["basic-card"]
 
Will do!
Status: Started (was: Assigned)
Project Member

Comment 3 by bugdroid1@chromium.org, Aug 1 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/115f723900c543655bd4b9993d022be8f7bb54ee

commit 115f723900c543655bd4b9993d022be8f7bb54ee
Author: Rouslan Solomakhin <rouslan@chromium.org>
Date: Tue Aug 01 15:24:38 2017

[Payments] canMakePayment() rate limit to iframe + top level origin.

Before this patch, if a payment service provider https://checkout.com
was being used in iframes for both https://momsshop.com and
https://popsshop.com, but with different sets of supported payment
methods, then canMakePayment() would be rejected with "NotAllowedError"
due to the rate limit on the iframe origin.

This patch changes the rate limiting to be based on the concatenation of
both iframe and top level origins instead of only iframe origin.

After this patch, if a payment service provider https://checkout.com is
being used in iframes for both https://momsshop.com and
https://bobsshop.com with different sets of supported payment methods,
then canMakePayment() will resolve with "true" or "false" according to
the user state instead of rejecting with "NotAllowedError".

This patch changes behavior for desktop and Android only, because iOS
implementation of PaymentRequest does not support iframes.

Bug:  742589 
Change-Id: I08e15c325fc6027e82be7fddc047312235c82f51
Reviewed-on: https://chromium-review.googlesource.com/591747
Reviewed-by: Mathieu Perreault <mathp@chromium.org>
Reviewed-by: mahmadi <mahmadi@chromium.org>
Commit-Queue: Rouslan Solomakhin <rouslan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#490998}
[modify] https://crrev.com/115f723900c543655bd4b9993d022be8f7bb54ee/chrome/android/java/src/org/chromium/chrome/browser/payments/PaymentRequestImpl.java
[modify] https://crrev.com/115f723900c543655bd4b9993d022be8f7bb54ee/components/payments/content/payment_request.cc
[modify] https://crrev.com/115f723900c543655bd4b9993d022be8f7bb54ee/components/payments/content/payment_request.h
[modify] https://crrev.com/115f723900c543655bd4b9993d022be8f7bb54ee/components/payments/core/can_make_payment_query.cc
[modify] https://crrev.com/115f723900c543655bd4b9993d022be8f7bb54ee/components/payments/core/can_make_payment_query.h
[modify] https://crrev.com/115f723900c543655bd4b9993d022be8f7bb54ee/ios/chrome/browser/ui/payments/payment_request_manager.mm

Status: Fixed (was: Started)
Project Member

Comment 5 by bugdroid1@chromium.org, Aug 30 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d

commit 6e979ab01432c29a6dd83f7c20675c8c2e3fd39d
Author: Rouslan Solomakhin <rouslan@chromium.org>
Date: Wed Aug 30 17:30:39 2017

[Payments] Throttle canMakePayment() on security formatted URL.

url::Origin serialization should not be used for security checks,
according to url/origin.h. This patch switches desktop and iOS from
url::Origin to url_formatter::FormatUrlForSecurityDisplay(), which is
also used on Android. GURL::GetOrigin() should not be used because it
strips the path from file:// scheme URLs.

In addition, this patch replaces iOS hostname display with
url_formatter::FormatUrlForSecurityDisplay() as well to match the
Android behavior. Desktop PaymentRequest UI does not show the URL,
because the omnibox is visible during payment.

Bug:  742589 
Change-Id: I617b742c2e44bf5f31f4dba8795e9ca4cea10e4b
TEST: payment_request_can_make_payment_browsertest.cc
TEST: PaymentRequestCanMakePaymentQueryTest.java
TEST: page_info_item_unittest.mm
Reviewed-on: https://chromium-review.googlesource.com/596790
Commit-Queue: Rouslan Solomakhin <rouslan@chromium.org>
Reviewed-by: mahmadi (Moe) <mahmadi@chromium.org>
Reviewed-by: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Rohit Rao (ping after 24h) <rohitrao@chromium.org>
Reviewed-by: Mathieu Perreault <mathp@chromium.org>
Cr-Commit-Position: refs/heads/master@{#498523}
[modify] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/components/payments/content/BUILD.gn
[modify] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/components/payments/content/DEPS
[modify] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/components/payments/content/payment_request.cc
[modify] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/components/payments/content/payment_request.h
[modify] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/components/payments/core/BUILD.gn
[modify] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/components/payments/core/can_make_payment_query.cc
[modify] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/components/payments/core/can_make_payment_query.h
[add] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/components/payments/core/can_make_payment_query_unittest.cc
[modify] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/components/payments/core/currency_formatter_unittest.cc
[modify] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/ios/chrome/browser/ui/payments/BUILD.gn
[modify] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/ios/chrome/browser/ui/payments/cells/page_info_item.mm
[modify] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/ios/chrome/browser/ui/payments/cells/page_info_item_unittest.mm
[modify] https://crrev.com/6e979ab01432c29a6dd83f7c20675c8c2e3fd39d/ios/chrome/browser/ui/payments/payment_request_manager.mm

Sign in to add a comment