PlzNavigate: BlockCredentialedSubresources doesn't work. |
||||
Issue descriptionSince M59, chrome blocks subresource requests whose URLs include credentials (i.e. http://username:password@example.com/resource.png). This feature is enabled by default and is behing the blink feature flags: BlockCredentialedSubresources It is broken with PlzNavigate(--enable-browser-side-navigation) when the subresource is a frame. The page is still blocked, but only **after** the request has been submitted. It should be blocked before instead.
,
Aug 18 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/98218acf1f7c8c5c2b02a82cff7d10276fc53d27 commit 98218acf1f7c8c5c2b02a82cff7d10276fc53d27 Author: arthursonzogni <arthursonzogni@chromium.org> Date: Fri Aug 18 20:05:04 2017 PlzNavigate: make BlockCredentialedSubresources work. Chrome blocks subresource requests whose URLs include credentials (i.e. http://username:password@example.com/resource.png). It was broken with PlzNavigate(--enable-browser-side-navigation) when the subresource was a frame. The page was blocked, but only after the request had been sent to the server. This CL makes chrome block requests before they are submitted. Test: NavigationHandleImplBrowserTest.BlockCredentialedSubresources Bug: 755892 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_site_isolation Change-Id: Ibce9555e0cd4f83d206c0fff8a8c8267bd9fb5b6 Reviewed-on: https://chromium-review.googlesource.com/619086 Reviewed-by: Nasko Oskov <nasko@chromium.org> Reviewed-by: Mike West <mkwst@chromium.org> Commit-Queue: Nasko Oskov <nasko@chromium.org> Cr-Commit-Position: refs/heads/master@{#495659} [modify] https://crrev.com/98218acf1f7c8c5c2b02a82cff7d10276fc53d27/content/browser/frame_host/navigation_handle_impl_browsertest.cc [modify] https://crrev.com/98218acf1f7c8c5c2b02a82cff7d10276fc53d27/content/browser/frame_host/navigation_request.cc [modify] https://crrev.com/98218acf1f7c8c5c2b02a82cff7d10276fc53d27/content/browser/frame_host/navigation_request.h [modify] https://crrev.com/98218acf1f7c8c5c2b02a82cff7d10276fc53d27/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp
,
Aug 21 2017
,
Aug 22 2017
Discussed with jam@ offline, this is the final PlzNavigate change that will be merged to M61, but we can take the patch. Approved for M61 branch 3163.
,
Aug 22 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/31ca337dc58684f9abe527411e7dbc1b81a93f3c commit 31ca337dc58684f9abe527411e7dbc1b81a93f3c Author: John Abd-El-Malek <jam@chromium.org> Date: Tue Aug 22 18:18:12 2017 e go# Enter a description of the change. PlzNavigate: make BlockCredentialedSubresources work. Chrome blocks subresource requests whose URLs include credentials (i.e. http://username:password@example.com/resource.png). It was broken with PlzNavigate(--enable-browser-side-navigation) when the subresource was a frame. The page was blocked, but only after the request had been sent to the server. This CL makes chrome block requests before they are submitted. TBR=arthursonzogni@chromium.org (cherry picked from commit 98218acf1f7c8c5c2b02a82cff7d10276fc53d27) Test: NavigationHandleImplBrowserTest.BlockCredentialedSubresources Bug: 755892 Cq-Include-Trybots: master.tryserver.chromium.linux:linux_site_isolation Change-Id: Ibce9555e0cd4f83d206c0fff8a8c8267bd9fb5b6 Reviewed-on: https://chromium-review.googlesource.com/619086 Reviewed-by: Nasko Oskov <nasko@chromium.org> Reviewed-by: Mike West <mkwst@chromium.org> Commit-Queue: Nasko Oskov <nasko@chromium.org> Cr-Original-Commit-Position: refs/heads/master@{#495659} Reviewed-on: https://chromium-review.googlesource.com/626621 Reviewed-by: John Abd-El-Malek <jam@chromium.org> Cr-Commit-Position: refs/branch-heads/3163@{#762} Cr-Branched-From: ff259bab28b35d242e10186cd63af7ed404fae0d-refs/heads/master@{#488528} [modify] https://crrev.com/31ca337dc58684f9abe527411e7dbc1b81a93f3c/content/browser/frame_host/navigation_handle_impl_browsertest.cc [modify] https://crrev.com/31ca337dc58684f9abe527411e7dbc1b81a93f3c/content/browser/frame_host/navigation_request.cc [modify] https://crrev.com/31ca337dc58684f9abe527411e7dbc1b81a93f3c/content/browser/frame_host/navigation_request.h [modify] https://crrev.com/31ca337dc58684f9abe527411e7dbc1b81a93f3c/third_party/WebKit/Source/core/loader/FrameFetchContext.cpp |
||||
►
Sign in to add a comment |
||||
Comment 1 by jam@chromium.org
, Aug 16 2017