AppCache can fallback beyond SW's scope
Reported by
s.h.h.n....@gmail.com,
Oct 21 2017
|
|||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.62 Safari/537.36 Steps to reproduce the problem: 1. Go to https://test.shhnjk.com/images/pwa.html (SW registration) 2. Go to https://test.shhnjk.com/images/appca.html (AppCache registration) 3. Now go to https://test.shhnjk.com/image and observe fallback from Appcache What is the expected behavior? AppCache fallback is disabled since AppCache's registration page, manifest file, and fallback file are all under the scope of Service Worker. What went wrong? AppCache fallback triggers when user navigates beyond SW's scope. Did this work before? N/A Chrome version: 62.0.3202.62 Channel: stable OS Version: OS X 10.13.0 Flash Version:
,
Oct 31 2017
falken, any chance you could take a look at this, or pick a better person to handle it? Thanks! Also, I'm not entirely sure what the security implications of this would be. It would certainly seem likely to lead to unexpected app behavior, but not necessarily to enable any attacks. However, I am not an expert in this area, obviously. Please feel free to CC anyone else on this bug who can help! Thanks, all.
,
Oct 31 2017
jsbell: Can you help look at this? I am not really familiar with AppCache. This does not sound like a security bug though? Even if we are doing something weird mixing AppCache and service workers, everything is coming from the same-origin. Finally is this bug different to issue 410665? Seems similar if not the same.
,
Oct 31 2017
issue 410665 only suggests when manigest navigation is covered by SW's scope. This issue is about manifest navigation which is beyound SW's scope, but all fallbacks and caches are in scope of SW.
,
Oct 31 2017
+pwnall@ (I'll be OOO for a bit)
,
Nov 2 2017
pwnall -- can you please take a look at this security bug? thanks.
,
Nov 2 2017
I still don't really think it's a security bug. Scope isn't a hard security boundary, only origins are.
,
Nov 7 2017
I agree with comment 7, removing security labels |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by elawrence@chromium.org
, Oct 22 2017Labels: OS-Android OS-Chrome OS-Linux OS-Windows