Disable web security stopped working again
Reported by
gilpe...@gmail.com,
Jun 27 2018
|
||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36 Steps to reproduce the problem: Start your most recent stable chrome with the command line: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --user-data-dir --disable-web-security --disable-popup-blocking --allow-running-insecure-content Then open this veeery simple js fiddle -> https://jsfiddle.net/vocfh0kx/1/ The script will open an external window with the domain https://www.sitepor500.com.br which is different from the opener domain which is https://jsfiddle.net After 5 seconds the script will try to access the opened window content however chrome will show an error message in the console saying: "(index):33 Uncaught DOMException: Blocked a frame with origin "https://fiddle.jshell.net" from accessing a cross-origin frame. at https://fiddle.jshell.net/_display/:33:24" What is the expected behavior? The page should be allowed to access the window content as happened in all previous stable versions of Chrome. What went wrong? The script, after opening the window, cant access the opened window content with JS. Did this work before? Yes 66 Chrome version: 67.0.3396.99 Channel: stable OS Version: 10.0 Flash Version:
,
Jun 27 2018
,
Jun 27 2018
@Reporter: This sounds like the same as issue 849708, correct? Except there appears to be a typo in your example, since it doesn't work even with Site Isolation disabled. I think it should use: alert($(janela.window.document.body).html()); instead of: alert($(janela.window.document).html()); Is there something else wrong here, beyond what's discussed in issue 849708?
,
Jun 27 2018
Thnks @Creis there was a typo, I updated the fiddle -> https://jsfiddle.net/vocfh0kx/4/ Instead of alert($(janela.window.document).html()); I replaced by alert($(janela.window.document).find("body").html()); Despite that, the browser prevents access to the window if it is in an external domain EVEN using disable-web-security switch/flag. @Creis the issue reported at https://bugs.chromium.org/p/chromium/issues/detail?id=849708 is regarding a redirect that happens inside the opened page! BUT in the bug report that I am reporting in this current page, you can clearly see there is no redirect! No redirect at all, I am just opening a window with a domain (without any redirect) and trying to access its content! The bug reported here is different of the other thread cause the bug reported here started happening in the latest stable version of Chrome! When I reported the bug at https://bugs.chromium.org/p/chromium/issues/detail?id=849708 I COULD STILL ACCESS opened window content if it didnt redirect. HOWEVER now I cannot event access the opened window EVEN if it does not redirect. If I am not being clear please apoligize me, my english is not good. But just to make clear: 1) the bug reported in this page has nothing to do with the bug reported at https://bugs.chromium.org/p/chromium/issues/detail?id=849708 cause the bug reported at that page was clearly happening because of a redirection happening in the opened window; 2) the bug reported at https://bugs.chromium.org/p/chromium/issues/detail?id=849708 would only happen with a redirect in the opened window. If there were no redirect the bug would never happen. Now it does even if there is no redirect!
,
Jun 27 2018
I was referring to https://bugs.chromium.org/p/chromium/issues/detail?id=849708#c13. Specifically, the original error in issue 849708 was happening because Site Isolation puts cross-site pages in different processes, which means you still can't access them even with --disable-web-security. Instead, you need both of these flags: --disable-features=IsolateOrigins,site-per-process --disable-web-security (Alternatively, you can use --disable-site-isolation-trials --disable-web-security, which is a bit shorter.) It's true that issue 849708 also had the redirect issue which meant that it didn't work without Site Isolation either, but this case should work fine without Site Isolation (with the typo fixed). As for the stable version, issue 849708 was reported on Chrome 66, where we had a small trial of Site Isolation. We've turned on Site Isolation in Chrome 67, so the extra flag will now be needed for this case. Apologies for the need for an extra flag, but we're not currently planning to make --disable-web-security turn off Site Isolation automatically. There's more discussion about the future of --disable-web-security in issue 327804. Can you confirm that passing both flags gets this case to work? (It seems to for me.)
,
Jun 27 2018
@Creis thanks for clarifying this thing. So let me go by steps so I make sure my terrible english will not annoy you: 1) Right now I launched my Chrome with the command below (adding --disable-site-isolation-trials) and tried opening the test case at https://jsfiddle.net/vocfh0kx/4/ and the bug DID NOT HAPPEN \o/ So, using "--disable-site-isolation-trials" made all the difference, it worked perfectly. "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --user-data-dir --disable-web-security --disable-popup-blocking --allow-running-insecure-content --disable-site-isolation-trials 2) Until last week, I could easily use only the flag "--disable-web-security" and it worked simply amazing well. No need for "--disable-site-isolation-trials". I make use of "--disable-web-security" for at least 4 years and it always worked very well (except when the opened window redirects to another domain - bug reported in another thread). 3) In my opinion, "--disable-web-security " should suffice, I mean, this only switch should be enough allow opening a page and acessing its content even from a different domain. Same is true for accessing iframes inside pages with different domains. Why now devs will have to use both flags "--disable-site-isolation-trials --disable-web-security"? Disable web security should implicitly allow opener window to access the opened window, right? I mean, that's the only thing this switch allows: cross domain acessing each other resources. That's the only thing "--disable-web-security" does! So if it cant do that anymore without adding "--disable-site-isolation-trials", what is the point? Thanks a lot clarifying this thing. I hope more people get to know this cause I am pretty sure many devs trusted for a long time on "--disable-web-security" flag and from now on it will not work anymore without adding another flag!
,
Jun 28 2018
Able to reproduce the issue on Mac 10.13.3, Win-10 and Ubuntu 17.10 using chrome reported version #67.0.3396.99 and latest canary #69.0.3474.0. Note: Able to reproduce on os-win after enabling #site-per-process flag and also able to reproduce on mac using M-66 after enabling #site-per-process flag. This is a non-regression issue as it is observed from M63 old builds from the introduction of #site-per-process flag. Hence, marking it as untriaged to get more inputs from dev team. Thanks...!!
,
Jun 28 2018
@krajshree@chromium.org thanks for confirming this problem and testing it! |
||||
►
Sign in to add a comment |
||||
Comment 1 by viswa.karala@chromium.org
, Jun 27 2018