"Load unsafe scripts" not working with OOPIFs
Reported by
dan...@orodu.net,
Jan 7 2018
|
|||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 Example URL: https://chuo.fm/show/rockers/ Steps to reproduce the problem: 1. Go to https://chuo.fm/show/rockers/ 2. Scroll down, click on one of the dates on the left. 3. Nothing appears to happen, until you notice a tiny icon appeared in the omnibox right side 4. Click said icon, the popup appears 5. Click "Load unsafe scripts", the page reloads 6. Scroll down again and click on one of the dates on the left. What is the expected behavior? A media player appears below and lets you play music. What went wrong? Either nothing appears, or eventually some html buttons appear that do not work. Does it occur on multiple sites: N/A Is it a problem with a plugin? No Did this work before? Yes I believe this worked in M62 Does this work in other browsers? Yes Chrome version: 63.0.3239.132 Channel: stable OS Version: 10.0 Flash Version: 28.0.0.126 I will attach screenshots. This reproduces with and without OOPIF (top documenot isolation) enabled. In edge the document has an <audio> tag and a number of <divs> and <buttons> to make up the player.
,
Jan 7 2018
,
Jan 8 2018
danakj@ Thanks for the issue. Tested this issue on Windows 10, Mac OS 10.12.6 on the latest Stable 63.0.3239.132 and Canary 65.0.3314.0 and unable to reproduce the issue by following the steps mentioned in original comment. On Navigating to the given website and loading the site with unsafe scripts, a media player is appearing and music is playing without any issues. Attached is the screen cast for reference. Request you to please retry the issue on a new chrome profile without any flags/extensions and update the thread with the observations. Thanks..
,
Jan 8 2018
Thanks, you're right. My command line looks like Command Line "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --enable-features=top-document-isolation --flag-switches-begin --flag-switches-end Even though I have put OOPIF back to "default" state in chrome://flags. When I force it off then the page behaves. So this is a bug in top-document-isolation/OOPIF.
,
Jan 8 2018
Thank you for providing more feedback. Adding requester "sc00335628@techmahindra.com" to the cc list and removing "Needs-Feedback" label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jan 9 2018
Able to reproduce the issue on Windows 10, mac 10.12.6 and Ubuntu 14.04 using chrome reported version #63.0.3239.132 and latest canary #65.0.3315.3. But unable to provide bisect results as on digging to get the good and bad range, at chrome version #60.0.3112.0 and upper builds till M-62 on performing the 5th and 6th steps from comment #0, again a tiny icon appeared in the omnibox right side to load unsafe scripts and nothing happened. Loaded the unsafe scripts 2-3 times, still it remained the same and media player was not seen. Attaching screen cast of M-60 for reference Hence, marking it as untriaged for further inputs from dev team. Thanks...!!
,
Jan 10 2018
,
Jan 11 2018
Nasko: Can you triage this in your team? Based on #4 above, it sounds like the mixed content opt-out is broken in some way related to site isolation. (Lowering this to P3, as we're kinda thinking about removing that mechanism altogether: +estark@ for opinions)
,
Jan 11 2018
alexmos@: We have another bug about this, right? Is it issue 496670, or is there something more recent?
,
Jan 11 2018
Sorry, I was getting content settings and mixed content confused in comment 9. (Content settings was found to be working as intended in issue 767539 .) This is about mixed content instead.
,
Jan 11 2018
Yes, this is indeed problem with mixed content settings not propagating to out-of-process iframes (OOPIFs). The conclusion about mixed content in issue 496670 comment 3 is not correct. The problem is that after "Load unsafe scripts" is clicked, the main frame reloads and all its child frames are gone. When an iframe is then navigated to a new process, that new process does not get the correct value for allow_running_insecure_content_ inside ContentSettingsObserver. I'll resolve this one as duplicate of issue 496670 and add more details there with potentially a simplified repro.
,
Jan 13 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/72c8c945f44b515aa30ac9f6a34f46314eb9dd92 commit 72c8c945f44b515aa30ac9f6a34f46314eb9dd92 Author: Nasko Oskov <nasko@chromium.org> Date: Sat Jan 13 01:01:26 2018 Set correct value for allowing mixed content in out-of-process iframes. When mixed content is detected, it is blocked by default. The user can chose to allow it, in which case the browser tells the renderer to set its value for "allow mixed content" to true. Within a single renderer process, frames inherit this value from the main frame, but in the face of out-of-process iframes, this does not work. This CL adds an observer for new frames being created and if mixed content is allowed, it sets the proper value on its RenderFrame. Bug: 496670, 799770 Change-Id: Ica7e2f4122d54b14b2186e2941f59c93d7738e51 Reviewed-on: https://chromium-review.googlesource.com/862700 Commit-Queue: Nasko Oskov <nasko@chromium.org> Reviewed-by: Martin Šrámek <msramek@chromium.org> Cr-Commit-Position: refs/heads/master@{#529126} [modify] https://crrev.com/72c8c945f44b515aa30ac9f6a34f46314eb9dd92/chrome/browser/content_settings/mixed_content_settings_tab_helper.cc [modify] https://crrev.com/72c8c945f44b515aa30ac9f6a34f46314eb9dd92/chrome/browser/content_settings/mixed_content_settings_tab_helper.h [modify] https://crrev.com/72c8c945f44b515aa30ac9f6a34f46314eb9dd92/chrome/browser/ui/content_settings/content_setting_bubble_model_browsertest.cc [modify] https://crrev.com/72c8c945f44b515aa30ac9f6a34f46314eb9dd92/chrome/test/data/content_setting_bubble/mixed_script.html [add] https://crrev.com/72c8c945f44b515aa30ac9f6a34f46314eb9dd92/chrome/test/data/content_setting_bubble/mixed_script.js [add] https://crrev.com/72c8c945f44b515aa30ac9f6a34f46314eb9dd92/chrome/test/data/content_setting_bubble/mixed_script_in_cross_site_iframe.html |
|||||||||
►
Sign in to add a comment |
|||||||||
Comment 1 by dan...@orodu.net
, Jan 7 201824.1 KB
24.1 KB View Download
13.1 KB
13.1 KB View Download
31.5 KB
31.5 KB View Download