New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 792154 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 811669
Owner: ----
Closed: Mar 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Chrome , Mac
Pri: 2
Type: Bug

Blocked on:
issue 736308



Sign in to add a comment

Formalize how to track requests from isolated world origins

Project Member Reported by creis@chromium.org, Dec 5 2017

Issue description

In https://chromium-review.googlesource.com/c/chromium/src/+/783826/, we're changing ResourceFetcher.cpp to call ResourceRequest::SetRequestorOrigin with the origin of an isolated world if it differs from the document's origin.

This allows the browser process to make policy decisions (e.g., cross-site document blocking in  issue 786505  and issue 268640) based on whether the request was made from an isolated world.  This is important for content scripts, which are not subject to the same rules as the document.

The current change affects the URLRequest::initiator() for the cases below:
 - Whitelisted origins (e.g., content scripts)
 - HTML imports
 - ISOLATED_WORLD_ID_APPLESCRIPT 
 - ISOLATED_WORLD_ID_CHROME_INTERNAL  (DOM distiller and offline pages)
 - ISOLATED_WORLD_ID_TRANSLATE

dcheng@ thinks the current check may be fragile against future changes, and we should look into a formal way to detect requests from isolated worlds.  I think nick@ was interested in that anyway for future document blocking plans.

For more discussion, see this thread:
https://chromium-review.googlesource.com/c/chromium/src/+/783826/26/third_party/WebKit/Source/platform/loader/fetch/ResourceFetcher.cpp#617
 
Cc: yhirano@chromium.org
Blockedon: 736308
Mergedinto: 811669
Status: Duplicate (was: Available)
Let me merge this to 811669.

Sign in to add a comment