New issue
Advanced search Search tips

Issue 828948 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Apr 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac
Pri: 1
Type: Bug



Sign in to add a comment

Block payment handler install from cross-origin iframes unless allowed by feature policy

Project Member Reported by rouslan@chromium.org, Apr 4 2018

Issue description

Block payment handler install from cross-origin iframes unless allowed by feature policy.
 
Project Member

Comment 2 by bugdroid1@chromium.org, Apr 13 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bba70ff13f4c7808d1a5ce87467b5b93636c2502

commit bba70ff13f4c7808d1a5ce87467b5b93636c2502
Author: Rouslan Solomakhin <rouslan@chromium.org>
Date: Fri Apr 13 15:53:12 2018

[Payment Handler] No cross-origin iframe install by default.

Before this patch, any iframe could install a Payment Handler by calling
`paymentManager.instruments.set()`.

This patch checks for the feature policy "payment" before allowing any
operations on `paymentManager.instruments`.

After this patch, a cross-origin iframe will reject all operations on
`paymentManager.instruments` by default. The parent context can
explicitly allow the iframe to use the Payment Handler API through
feature policy. This can be accomplished via the iframe attribute
`allow="payment"`, for example. Note that the same feature policy
controls access to Payment Request API as well.

Discussion:
https://github.com/w3c/payment-handler/issues/281

Spec change:
https://github.com/w3c/payment-handler/pull/282

Payment Handlers are behind a flag:
chrome://flags/#service-worker-payment-apps

Manual test:
https://rsolomakhin.github.io/pr/apps/iframe/

Bug:  828948 
Change-Id: I0259555692fa0b215d3700c233b3687724e665cb
Reviewed-on: https://chromium-review.googlesource.com/1005275
Commit-Queue: Rouslan Solomakhin <rouslan@chromium.org>
Reviewed-by: Ganggui Tang <gogerald@chromium.org>
Cr-Commit-Position: refs/heads/master@{#550629}
[modify] https://crrev.com/bba70ff13f4c7808d1a5ce87467b5b93636c2502/third_party/blink/renderer/modules/payments/payment_instruments.cc

Status: Fixed (was: Assigned)
Project Member

Comment 4 by bugdroid1@chromium.org, Apr 17 2018

Labels: merge-merged-testbranch
The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bba70ff13f4c7808d1a5ce87467b5b93636c2502

commit bba70ff13f4c7808d1a5ce87467b5b93636c2502
Author: Rouslan Solomakhin <rouslan@chromium.org>
Date: Fri Apr 13 15:53:12 2018

[Payment Handler] No cross-origin iframe install by default.

Before this patch, any iframe could install a Payment Handler by calling
`paymentManager.instruments.set()`.

This patch checks for the feature policy "payment" before allowing any
operations on `paymentManager.instruments`.

After this patch, a cross-origin iframe will reject all operations on
`paymentManager.instruments` by default. The parent context can
explicitly allow the iframe to use the Payment Handler API through
feature policy. This can be accomplished via the iframe attribute
`allow="payment"`, for example. Note that the same feature policy
controls access to Payment Request API as well.

Discussion:
https://github.com/w3c/payment-handler/issues/281

Spec change:
https://github.com/w3c/payment-handler/pull/282

Payment Handlers are behind a flag:
chrome://flags/#service-worker-payment-apps

Manual test:
https://rsolomakhin.github.io/pr/apps/iframe/

Bug:  828948 
Change-Id: I0259555692fa0b215d3700c233b3687724e665cb
Reviewed-on: https://chromium-review.googlesource.com/1005275
Commit-Queue: Rouslan Solomakhin <rouslan@chromium.org>
Reviewed-by: Ganggui Tang <gogerald@chromium.org>
Cr-Commit-Position: refs/heads/master@{#550629}
[modify] https://crrev.com/bba70ff13f4c7808d1a5ce87467b5b93636c2502/third_party/blink/renderer/modules/payments/payment_instruments.cc

Sign in to add a comment