New issue
Advanced search Search tips

Issue 750452 link

Starred by 5 users

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows , Mac
Pri: 2
Type: Bug



Sign in to add a comment

Database storage not cleared on exit with the "Keep local data only until you quit your browser" setting

Project Member Reported by zoya@google.com, Jul 29 2017

Issue description

UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36

Steps to reproduce the problem:
1. Go to chrome://settings/content/cookies, make sure "Keep local data only until you quit your browser" is enabled. Clear all cookies and site data.

2. Navigate to youtube.com. 

3. Close the browser.

4. Open the browser and go to chrome://settings/content/cookies again.

Actual result: 
In the "All cookies and site data", see www.youtube.com listed as having Database storage.

What is the expected behavior?
Expected result:
Nothing listed in "All cookies and site data", because all data was supposed to be cleared upon exit.

What went wrong?
"Database storage" from youtube.com was not cleared on browser exit.

Did this work before? No 

Chrome version: 60.0.3112.78  Channel: stable
OS Version: 7
Flash Version:
 
Components: Blink>Storage>IndexedDB Privacy
Labels: OS-Mac
Status: Untriaged (was: Unconfirmed)
Repros for me on Mac 60.0.3112.78. More of a Privacy issue than a Security issue.
Screen Shot 2017-07-30 at 1.28.00 PM.png
52.8 KB View Download

Comment 2 by vakh@chromium.org, Jul 31 2017

Cc: pwnall@chromium.org
Owner: dmu...@chromium.org
Status: Assigned (was: Untriaged)

Comment 3 by vakh@chromium.org, Jul 31 2017

dmurph@ -- assigning you as the owner based on other bugs in that component.
If you're not the right owner, please help triage and find them. Thanks.
Labels: Security_Severity-Low Security_Impact-Stable

Comment 5 by zoya@google.com, Nov 9 2017

Any estimate for when this will be fixed? Thanks.

Comment 6 by dmu...@chromium.org, May 15 2018

Cc: cmumford@chromium.org
ccing some more cookie people - we might have a bug in general with the session-only handling in storage partition?
Cc: dullweber@chromium.org jsb...@chromium.org
Ping. dmurph@, can you follow up on this?

+jsbell@ for storage generally, and dullweber@ for clearing data.
Cc: asvitk...@chromium.org
+asvitkine@, FYI.
Repro steps from duplicated bug...

1. Navigate to chrome://settings/content/cookies
2. Next to "Clear on exit", click "Add", and add "https://rawgit.com" 
3. Visit https://rawgit.com/xchrdw/862c013b03edfa4ac43d44424f1bbeff/raw/886ed56b42f6b96b6d66986d4879521263457062/site_data_tester.html
4. Click 'Write"
5. Quit Chrome
6. Restart Chrome, visit the url from step 3

In tip-of-tree debug build I see cookies and cacheStorage. Given the variety of reports citing different storage types, maybe racy at shutdown?

Labels: -Restrict-View-SecurityTeam -Security_Severity-Low -Security_Impact-Stable
Data deletion bugs are usually not treated as security issues, so I will remove the restriction.
Labels: -Type-Bug-Security Type-Bug
Labels: allpublic
CacheStorage was just missing the code entirely. WIP fix at https://chromium-review.googlesource.com/c/chromium/src/+/1288890

Project Member

Comment 15 by bugdroid1@chromium.org, Oct 19

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/71626e0809d357a802049c0c82c0287ce4625772

commit 71626e0809d357a802049c0c82c0287ce4625772
Author: Joe Downing <joedow@chromium.org>
Date: Fri Oct 19 17:22:26 2018

Revert "Cache Storage: Clear session-only origins on shutdown"

This reverts commit ba9595ea44ba3642804f90c072fd0976e8c68278.

Reason for revert: Suspected of causing persistent BrowsingDataRemoverBrowserTest failure:
https://logs.chromium.org/logs/chromium/buildbucket/cr-buildbucket.appspot.com/8932222237758099792/+/steps/browser_tests_on_Windows-10-15063/0/logs/BrowsingDataRemoverBrowserTest.SessionOnlyStorageRemoved/0

This failure started after this CL was checked in and appears to be in the same area of code.  The failure is being seen on the Win10 Tests x64 builder:
https://ci.chromium.org/p/chromium/builders/luci.chromium.ci/Win10%20Tests%20x64/28682

Original change's description:
> Cache Storage: Clear session-only origins on shutdown
> 
> Bug: 824533,750452
> Change-Id: I103d6b6a3bd106a6a38de03f9ff14d2766c7b269
> Reviewed-on: https://chromium-review.googlesource.com/c/1288890
> Reviewed-by: John Abd-El-Malek <jam@chromium.org>
> Reviewed-by: Ben Kelly <wanderview@chromium.org>
> Reviewed-by: Victor Costan <pwnall@chromium.org>
> Commit-Queue: Joshua Bell <jsbell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#601141}

TBR=jsbell@chromium.org,jam@chromium.org,pwnall@chromium.org,wanderview@chromium.org

Change-Id: Ia41455e70e5e89598fb1296cc539f143bda8295e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: 824533, 750452
Reviewed-on: https://chromium-review.googlesource.com/c/1291781
Reviewed-by: Joe Downing <joedow@chromium.org>
Commit-Queue: Joe Downing <joedow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#601202}
[modify] https://crrev.com/71626e0809d357a802049c0c82c0287ce4625772/chrome/browser/browsing_data/browsing_data_remover_browsertest.cc
[modify] https://crrev.com/71626e0809d357a802049c0c82c0287ce4625772/content/browser/cache_storage/cache_storage_context_impl.cc
[modify] https://crrev.com/71626e0809d357a802049c0c82c0287ce4625772/content/browser/cache_storage/cache_storage_context_impl.h
[modify] https://crrev.com/71626e0809d357a802049c0c82c0287ce4625772/content/browser/storage_partition_impl.cc

Project Member

Comment 16 by bugdroid1@chromium.org, Nov 13

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d2cde601aae103875e231309861d9bde0754e8b0

commit d2cde601aae103875e231309861d9bde0754e8b0
Author: Joshua Bell <jsbell@chromium.org>
Date: Tue Nov 13 02:48:21 2018

Indexed DB: Avoid race in shutdown in clearing Session Only origins

Origins set to "clear on exit" need to get wiped when the storage
partition is shutting down. This was wired into the context's
destructor, but needed to be triggered earlier. Introduce an explicit
Shutdown() call invoked by the storage partition, similar to other
storage backends.

Bug: 750452, 824533
Change-Id: I353c183f842da0016fa35f7d48c462c5e85b67ab
Reviewed-on: https://chromium-review.googlesource.com/c/1289435
Reviewed-by: Daniel Murphy <dmurph@chromium.org>
Reviewed-by: John Abd-El-Malek <jam@chromium.org>
Commit-Queue: Joshua Bell <jsbell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#607455}
[modify] https://crrev.com/d2cde601aae103875e231309861d9bde0754e8b0/chrome/browser/browsing_data/browsing_data_remover_browsertest.cc
[modify] https://crrev.com/d2cde601aae103875e231309861d9bde0754e8b0/content/browser/indexed_db/indexed_db_context_impl.cc
[modify] https://crrev.com/d2cde601aae103875e231309861d9bde0754e8b0/content/browser/indexed_db/indexed_db_context_impl.h
[modify] https://crrev.com/d2cde601aae103875e231309861d9bde0754e8b0/content/browser/indexed_db/indexed_db_unittest.cc
[modify] https://crrev.com/d2cde601aae103875e231309861d9bde0754e8b0/content/browser/storage_partition_impl.cc

Cc: dmu...@chromium.org
Owner: ----
Status: Available (was: Assigned)

Sign in to add a comment