Block payment handler install from cross-origin iframes unless allowed by feature policy |
|||
Issue descriptionBlock payment handler install from cross-origin iframes unless allowed by feature policy.
,
Apr 13 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/bba70ff13f4c7808d1a5ce87467b5b93636c2502 commit bba70ff13f4c7808d1a5ce87467b5b93636c2502 Author: Rouslan Solomakhin <rouslan@chromium.org> Date: Fri Apr 13 15:53:12 2018 [Payment Handler] No cross-origin iframe install by default. Before this patch, any iframe could install a Payment Handler by calling `paymentManager.instruments.set()`. This patch checks for the feature policy "payment" before allowing any operations on `paymentManager.instruments`. After this patch, a cross-origin iframe will reject all operations on `paymentManager.instruments` by default. The parent context can explicitly allow the iframe to use the Payment Handler API through feature policy. This can be accomplished via the iframe attribute `allow="payment"`, for example. Note that the same feature policy controls access to Payment Request API as well. Discussion: https://github.com/w3c/payment-handler/issues/281 Spec change: https://github.com/w3c/payment-handler/pull/282 Payment Handlers are behind a flag: chrome://flags/#service-worker-payment-apps Manual test: https://rsolomakhin.github.io/pr/apps/iframe/ Bug: 828948 Change-Id: I0259555692fa0b215d3700c233b3687724e665cb Reviewed-on: https://chromium-review.googlesource.com/1005275 Commit-Queue: Rouslan Solomakhin <rouslan@chromium.org> Reviewed-by: Ganggui Tang <gogerald@chromium.org> Cr-Commit-Position: refs/heads/master@{#550629} [modify] https://crrev.com/bba70ff13f4c7808d1a5ce87467b5b93636c2502/third_party/blink/renderer/modules/payments/payment_instruments.cc
,
Apr 13 2018
,
Apr 17 2018
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/bba70ff13f4c7808d1a5ce87467b5b93636c2502 commit bba70ff13f4c7808d1a5ce87467b5b93636c2502 Author: Rouslan Solomakhin <rouslan@chromium.org> Date: Fri Apr 13 15:53:12 2018 [Payment Handler] No cross-origin iframe install by default. Before this patch, any iframe could install a Payment Handler by calling `paymentManager.instruments.set()`. This patch checks for the feature policy "payment" before allowing any operations on `paymentManager.instruments`. After this patch, a cross-origin iframe will reject all operations on `paymentManager.instruments` by default. The parent context can explicitly allow the iframe to use the Payment Handler API through feature policy. This can be accomplished via the iframe attribute `allow="payment"`, for example. Note that the same feature policy controls access to Payment Request API as well. Discussion: https://github.com/w3c/payment-handler/issues/281 Spec change: https://github.com/w3c/payment-handler/pull/282 Payment Handlers are behind a flag: chrome://flags/#service-worker-payment-apps Manual test: https://rsolomakhin.github.io/pr/apps/iframe/ Bug: 828948 Change-Id: I0259555692fa0b215d3700c233b3687724e665cb Reviewed-on: https://chromium-review.googlesource.com/1005275 Commit-Queue: Rouslan Solomakhin <rouslan@chromium.org> Reviewed-by: Ganggui Tang <gogerald@chromium.org> Cr-Commit-Position: refs/heads/master@{#550629} [modify] https://crrev.com/bba70ff13f4c7808d1a5ce87467b5b93636c2502/third_party/blink/renderer/modules/payments/payment_instruments.cc |
|||
►
Sign in to add a comment |
|||
Comment 1 by rouslan@chromium.org
, Apr 5 2018