New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 755892 link

Starred by 3 users

Issue metadata

Status: Fixed
Owner:
Closed: Aug 2017
Cc:
Components:
EstimatedDays: 3
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 2
Type: Bug-Regression



Sign in to add a comment

PlzNavigate: BlockCredentialedSubresources doesn't work.

Project Member Reported by arthurso...@chromium.org, Aug 16 2017

Issue description

Since M59, chrome blocks subresource requests whose URLs include credentials (i.e. http://username:password@example.com/resource.png).

This feature is enabled by default and is behing the blink feature flags: BlockCredentialedSubresources

It is broken with PlzNavigate(--enable-browser-side-navigation) when the subresource is a frame.
The page is still blocked, but only **after** the request has been submitted. It should be blocked before instead.
 

Comment 1 by jam@chromium.org, Aug 16 2017

Labels: Proj-PlzNavigate-Blocking
tentatively adding Proj-PlzNavigate-Blocking if we can get a mergeable fix to M61
Project Member

Comment 2 by bugdroid1@chromium.org, Aug 18 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/98218acf1f7c8c5c2b02a82cff7d10276fc53d27

commit 98218acf1f7c8c5c2b02a82cff7d10276fc53d27
Author: arthursonzogni <arthursonzogni@chromium.org>
Date: Fri Aug 18 20:05:04 2017

PlzNavigate: make BlockCredentialedSubresources work.

Chrome blocks subresource requests whose URLs include credentials (i.e.
http://username:password@example.com/resource.png).

It was broken with PlzNavigate(--enable-browser-side-navigation) when
the subresource was a frame. The page was blocked, but only after the request
had been sent to the server.
This CL makes chrome block requests before they are submitted.

Test: NavigationHandleImplBrowserTest.BlockCredentialedSubresources
Bug:  755892 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_site_isolation
Change-Id: Ibce9555e0cd4f83d206c0fff8a8c8267bd9fb5b6
Reviewed-on: https://chromium-review.googlesource.com/619086
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Nasko Oskov <nasko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#495659}
[modify] https://crrev.com/98218acf1f7c8c5c2b02a82cff7d10276fc53d27/content/browser/frame_host/navigation_handle_impl_browsertest.cc
[modify] https://crrev.com/98218acf1f7c8c5c2b02a82cff7d10276fc53d27/content/browser/frame_host/navigation_request.cc
[modify] https://crrev.com/98218acf1f7c8c5c2b02a82cff7d10276fc53d27/content/browser/frame_host/navigation_request.h
[modify] https://crrev.com/98218acf1f7c8c5c2b02a82cff7d10276fc53d27/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp

Status: Fixed (was: Started)
Labels: Merge-Approved-61
Discussed with jam@ offline, this is the final PlzNavigate change that will be merged to M61, but we can take the patch.  Approved for M61 branch 3163.
Project Member

Comment 5 by bugdroid1@chromium.org, Aug 22 2017

Labels: -merge-approved-61 merge-merged-3163
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/31ca337dc58684f9abe527411e7dbc1b81a93f3c

commit 31ca337dc58684f9abe527411e7dbc1b81a93f3c
Author: John Abd-El-Malek <jam@chromium.org>
Date: Tue Aug 22 18:18:12 2017

e go# Enter a description of the change.
PlzNavigate: make BlockCredentialedSubresources work.

Chrome blocks subresource requests whose URLs include credentials (i.e.
http://username:password@example.com/resource.png).

It was broken with PlzNavigate(--enable-browser-side-navigation) when
the subresource was a frame. The page was blocked, but only after the request
had been sent to the server.
This CL makes chrome block requests before they are submitted.

TBR=arthursonzogni@chromium.org

(cherry picked from commit 98218acf1f7c8c5c2b02a82cff7d10276fc53d27)

Test: NavigationHandleImplBrowserTest.BlockCredentialedSubresources
Bug:  755892 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_site_isolation
Change-Id: Ibce9555e0cd4f83d206c0fff8a8c8267bd9fb5b6
Reviewed-on: https://chromium-review.googlesource.com/619086
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Nasko Oskov <nasko@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#495659}
Reviewed-on: https://chromium-review.googlesource.com/626621
Reviewed-by: John Abd-El-Malek <jam@chromium.org>
Cr-Commit-Position: refs/branch-heads/3163@{#762}
Cr-Branched-From: ff259bab28b35d242e10186cd63af7ed404fae0d-refs/heads/master@{#488528}
[modify] https://crrev.com/31ca337dc58684f9abe527411e7dbc1b81a93f3c/content/browser/frame_host/navigation_handle_impl_browsertest.cc
[modify] https://crrev.com/31ca337dc58684f9abe527411e7dbc1b81a93f3c/content/browser/frame_host/navigation_request.cc
[modify] https://crrev.com/31ca337dc58684f9abe527411e7dbc1b81a93f3c/content/browser/frame_host/navigation_request.h
[modify] https://crrev.com/31ca337dc58684f9abe527411e7dbc1b81a93f3c/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp

Sign in to add a comment