[Resource-Timing] Detect ServiceWorker generated Response as same-origin |
|||||
Issue descriptionIn https://chromium-review.googlesource.com/c/chromium/src/+/1038229 I changed the response URL being used in the PassesTimingAllowCheck to account for Service Workers. However, a generated Response has a ResourceResponse with an empty URL. I believe we shouldn't allow the check to pass for an arbitrary empty URL. An empty URL is not really same origin. Also, this may cause Navigation Timing bugs (if the method is called before the ResourceResponse has populated its cross-origin URL, it would leak some information). We want to consider Service Worker generated responses as same-origin. However, we don't want to consider any empty URL response as same-origin.
,
Aug 24
IIRC the bug is that we consider empty responses generated by ServiceWorker to be cross-origin after fixing a security bug. It's arguable that an SW empty response does not leak any information so it should be considered same-origin, but I'll need go over specs to check if that's specified anywhere... It's a low priority bug IMO, but I'll try to get to it soon.
,
Dec 9
CSM triage ping :)
,
Dec 11
Looks like web_tests associated with this issue are now passing. falken@: I guess this was fixed by your recent change on response URLs. Can you confirm it? - https://chromium-review.googlesource.com/c/1366464 - https://test-results.appspot.com/dashboards/flakiness_dashboard.html#testType=webkit_layout_tests&tests=external%2Fwpt%2Fservice-workers%2Fservice-worker%2Fresource-timing.https.html
,
Dec 11
Yep, thanks it's fixed by that CL. I'll change the test expectation.
,
Dec 11
,
Dec 11
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/4860ebe6332c280e746869167c3e10dfbaeeb907 commit 4860ebe6332c280e746869167c3e10dfbaeeb907 Author: Matt Falkenhagen <falken@chromium.org> Date: Tue Dec 11 04:43:41 2018 Gardening: resource-timing.https.html now passes. The 'generated response' test used to fail. Fixed by r615063. Bug: 840881 Change-Id: Ia5773ee28ac4d9b2195f98f8dedd731fa166502e TBR: npm No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/1370159 Reviewed-by: Matt Falkenhagen <falken@chromium.org> Commit-Queue: Matt Falkenhagen <falken@chromium.org> Cr-Commit-Position: refs/heads/master@{#615430} [modify] https://crrev.com/4860ebe6332c280e746869167c3e10dfbaeeb907/third_party/blink/web_tests/TestExpectations |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by charliea@chromium.org
, Aug 24