New issue
Advanced search Search tips

Issue 855963 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Jun 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

Module loading for worklets should obey the default referrer policy

Project Member Reported by nhiroki@chromium.org, Jun 25 2018

Issue description

In the current implementation, FetchClientSettingsObjectSnapshot's referrer policy is used for worklets module loading, but this is wrong. The spec requires to use ScriptFetchOptions' referrer policy that defaults to the empty string (i.e., the default referrer policy) for worklets.

  // The "fetch a module worker script graph" algorithm:
  "2. Let options be a script fetch options whose cryptographic nonce is the
  empty string, ..., and referrer policy is the empty string."
  https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-module-worker-script-tree
 
Project Member

Comment 1 by bugdroid1@chromium.org, Jun 25 2018

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/b789471f1773abbbb51d0239475439f5f35b070f

commit b789471f1773abbbb51d0239475439f5f35b070f
Author: Hiroki Nakagawa <nhiroki@chromium.org>
Date: Mon Jun 25 05:14:59 2018

ES Modules: Use an appropriate referrer policy for module script loading

This CL fixes ReferrerPolicy handling in module script loading. Before this CL,
FetchClientSettingsObjectSnapshot's referrer policy is used, but this is wrong.
The spec requires to use ScriptFetchOptions' referrer policy.

  // The "set up the module script request" algorithm:
  "Set request's cryptographic nonce metadata to options's cryptographic nonce,
  ..., and its referrer policy to options's referrer policy."
  https://html.spec.whatwg.org/multipage/webappapis.html#set-up-the-module-script-request

Specifically, this CL introduces |referrer_policy_| field in ScriptFetchOptions
class as spec'ed and propagates it to the entire path of module script loading.

ScriptFetchOptions's referrer policy can be set to following values:

- <script>'s "referrerpolicy" attribute is used for <script type='module'>. This
  hasn't been implemented yet (see  https://crbug.com/841673 ), so the current
  document's referrer policy is used to keep the backward compatibility.

  // The "prepare a script" algorithm:
  "20. Let referrer policy be the current state of the element's referrerpolicy
  content attribute."
  "22. Let options be a script fetch options whose cryptographic nonce is
  cryptographic nonce, ..., and referrer policy is referrer policy."
  https://html.spec.whatwg.org/multipage/scripting.html#prepare-a-script

- <link>'s "referrerpolicy" attribute is used for modulepreload.

  // The "Link type "modulepreload"" algorithm:
  "9. Let referrer policy be the current state of the element's referrerpolicy
  attribute."
  "10. Let options be a script fetch options whose cryptographic nonce is
  cryptographic nonce, ..., and referrer policy is referrer policy."
  https://html.spec.whatwg.org/multipage/links.html#link-type-modulepreload

- The default referrer policy is used for module workers and worklets. This is
  the reason why this CL changes test expectations of workers and worklets.

  // The "fetch a module worker script graph" algorithm:
  "2. Let options be a script fetch options whose cryptographic nonce is the
  empty string, ..., and referrer policy is the empty string."
  https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-module-worker-script-tree

Change-Id: Ic0f9e6667cd1b84f74d86fcc948451c1d2f8191f
Bug:  842553 ,  855963 
Reviewed-on: https://chromium-review.googlesource.com/1111743
Commit-Queue: Hiroki Nakagawa <nhiroki@chromium.org>
Reviewed-by: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Cr-Commit-Position: refs/heads/master@{#569967}
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/WebKit/LayoutTests/external/wpt/workers/modules/dedicated-worker-import-referrer.html
[delete] https://crrev.com/b39bd8924173bd52fa62405efd47e6ba01aaf796/third_party/WebKit/LayoutTests/external/wpt/worklets/animation-worklet-referrer.https-expected.txt
[delete] https://crrev.com/b39bd8924173bd52fa62405efd47e6ba01aaf796/third_party/WebKit/LayoutTests/external/wpt/worklets/layout-worklet-referrer.https-expected.txt
[delete] https://crrev.com/b39bd8924173bd52fa62405efd47e6ba01aaf796/third_party/WebKit/LayoutTests/external/wpt/worklets/paint-worklet-referrer.https-expected.txt
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/WebKit/LayoutTests/external/wpt/worklets/resources/referrer-checker.py
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/WebKit/LayoutTests/external/wpt/worklets/resources/referrer-tests.js
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/WebKit/LayoutTests/external/wpt/worklets/resources/referrer-window.html
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/blink/renderer/bindings/core/v8/referrer_script_info.cc
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/blink/renderer/bindings/core/v8/referrer_script_info.h
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/blink/renderer/bindings/core/v8/referrer_script_info_test.cc
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/blink/renderer/core/loader/link_loader.cc
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/blink/renderer/core/loader/modulescript/module_tree_linker.cc
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/blink/renderer/core/script/dynamic_module_resolver.cc
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/blink/renderer/core/script/script_loader.cc
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.cc
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/blink/renderer/core/workers/worker_or_worklet_global_scope.h
[modify] https://crrev.com/b789471f1773abbbb51d0239475439f5f35b070f/third_party/blink/renderer/platform/loader/fetch/script_fetch_options.h

Status: Fixed (was: Started)

Sign in to add a comment