New issue
Advanced search Search tips

Issue 857032 link

Starred by 2 users

Issue metadata

Status: Untriaged
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 2
Type: Bug


Show other hotlists

Hotlists containing this issue:
Hotlist-4


Sign in to add a comment

Disable web security stopped working again

Reported by gilpe...@gmail.com, Jun 27 2018

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36

Steps to reproduce the problem:
Start your most recent stable chrome with the command line:

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --user-data-dir --disable-web-security --disable-popup-blocking --allow-running-insecure-content

Then open this veeery simple js fiddle -> https://jsfiddle.net/vocfh0kx/1/

The script will open an external window with the domain https://www.sitepor500.com.br which is different from the opener domain which is https://jsfiddle.net

After 5 seconds the script will try to access the opened window content however chrome will show an error message in the console saying:

"(index):33 Uncaught DOMException: Blocked a frame with origin "https://fiddle.jshell.net" from accessing a cross-origin frame.
    at https://fiddle.jshell.net/_display/:33:24"

What is the expected behavior?
The page should be allowed to access the window content as happened in all previous stable versions of Chrome.

What went wrong?
The script, after opening the window, cant access the opened window content with JS.

Did this work before? Yes 66

Chrome version: 67.0.3396.99  Channel: stable
OS Version: 10.0
Flash Version:
 
Labels: Needs-Bisect Needs-Triage-M67
Components: -Blink Internals>Sandbox>SiteIsolation

Comment 3 by creis@chromium.org, Jun 27 2018

Cc: creis@chromium.org
@Reporter: This sounds like the same as issue 849708, correct?  Except there appears to be a typo in your example, since it doesn't work even with Site Isolation disabled.  I think it should use:
  alert($(janela.window.document.body).html());
instead of:
  alert($(janela.window.document).html());

Is there something else wrong here, beyond what's discussed in issue 849708?

Comment 4 by gilpe...@gmail.com, Jun 27 2018

Thnks @Creis there was a typo, I updated the fiddle -> https://jsfiddle.net/vocfh0kx/4/

Instead of
   alert($(janela.window.document).html());
I replaced by
   alert($(janela.window.document).find("body").html());

Despite that, the browser prevents access to the window if it is in an external domain EVEN using disable-web-security switch/flag.

@Creis the issue reported at https://bugs.chromium.org/p/chromium/issues/detail?id=849708 is regarding a redirect that happens inside the opened page! BUT in the bug report that I am reporting in this current page, you can clearly see there is no redirect! No redirect at all, I am just opening a window with a domain (without any redirect) and trying to access its content!

The bug reported here is different of the other thread cause the bug reported here started happening in the latest stable version of Chrome! When I reported the bug at https://bugs.chromium.org/p/chromium/issues/detail?id=849708 I COULD STILL ACCESS opened window content if it didnt redirect. HOWEVER now I cannot event access the opened window EVEN if it does not redirect.

If I am not being clear please apoligize me, my english is not good. But just to make clear:

1) the bug reported in this page has nothing to do with the bug reported at https://bugs.chromium.org/p/chromium/issues/detail?id=849708 cause the bug reported at that page was clearly happening because of a redirection happening in the opened window;

2) the bug reported at https://bugs.chromium.org/p/chromium/issues/detail?id=849708 would only happen with a redirect in the opened window. If there were no redirect the bug would never happen. Now it does even if there is no redirect!

Comment 5 by creis@chromium.org, Jun 27 2018

I was referring to https://bugs.chromium.org/p/chromium/issues/detail?id=849708#c13.  Specifically, the original error in issue 849708 was happening because Site Isolation puts cross-site pages in different processes, which means you still can't access them even with --disable-web-security.  Instead, you need both of these flags:

--disable-features=IsolateOrigins,site-per-process --disable-web-security

(Alternatively, you can use --disable-site-isolation-trials --disable-web-security, which is a bit shorter.)

It's true that issue 849708 also had the redirect issue which meant that it didn't work without Site Isolation either, but this case should work fine without Site Isolation (with the typo fixed).

As for the stable version, issue 849708 was reported on Chrome 66, where we had a small trial of Site Isolation.  We've turned on Site Isolation in Chrome 67, so the extra flag will now be needed for this case.  Apologies for the need for an extra flag, but we're not currently planning to make --disable-web-security turn off Site Isolation automatically.  There's more discussion about the future of --disable-web-security in issue 327804.

Can you confirm that passing both flags gets this case to work?  (It seems to for me.)

Comment 6 by gilpe...@gmail.com, Jun 27 2018

@Creis thanks for clarifying this thing.

So let me go by steps so I make sure my terrible english will not annoy you:

1) Right now I launched my Chrome with the command below (adding --disable-site-isolation-trials) and tried opening the test case at https://jsfiddle.net/vocfh0kx/4/ and the bug DID NOT HAPPEN \o/ So, using "--disable-site-isolation-trials" made all the difference, it worked perfectly.

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --user-data-dir --disable-web-security --disable-popup-blocking --allow-running-insecure-content --disable-site-isolation-trials

2) Until last week, I could easily use only the flag "--disable-web-security" and it worked simply amazing well. No need for "--disable-site-isolation-trials". I make use of "--disable-web-security" for at least 4 years and it always worked very well (except when the opened window redirects to another domain - bug reported in another thread).

3) In my opinion, "--disable-web-security " should suffice, I mean, this only switch should be enough allow opening a page and acessing its content even from a different domain. Same is true for accessing iframes inside pages with different domains. Why now devs will have to use both flags "--disable-site-isolation-trials --disable-web-security"? Disable web security should implicitly allow opener window to access the opened window, right? I mean, that's the only thing this switch allows: cross domain acessing each other resources. That's the only thing "--disable-web-security" does! So if it cant do that anymore without adding "--disable-site-isolation-trials", what is the point?

Thanks a lot clarifying this thing. I hope more people get to know this cause I am pretty sure many devs trusted for a long time on "--disable-web-security" flag and from now on it will not work anymore without adding another flag!
Labels: -Needs-Bisect -Type-Bug-Regression Triaged-ET M-69 Target-69 FoundIn-69 OS-Linux OS-Mac Type-Bug
Status: Untriaged (was: Unconfirmed)
Able to reproduce the issue on Mac 10.13.3, Win-10 and Ubuntu 17.10 using chrome reported version #67.0.3396.99 and latest canary #69.0.3474.0.
Note: Able to reproduce on os-win after enabling #site-per-process flag and also able to reproduce on mac using M-66 after enabling #site-per-process flag.
This is a non-regression issue as it is observed from M63 old builds from the introduction of #site-per-process flag. 

Hence, marking it as untriaged to get more inputs from dev team.

Thanks...!!
857032.mp4
944 KB View Download

Comment 8 by gilpe...@gmail.com, Jun 28 2018

@krajshree@chromium.org thanks for confirming this problem and testing it! 

Sign in to add a comment