New issue
Advanced search Search tips

Issue 879991 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 867834
Owner:
Closed: Sep 4
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug

Blocking:
issue 870173



Sign in to add a comment

OOR-CORS: security/cors-check-for-cached-{image|script}.html fails

Project Member Reported by toyoshim@chromium.org, Sep 3

Issue description

These tests are failing on virtual/outofblink-cors(-ns)
 
Owner: yhirano@chromium.org
Status: Assigned (was: Available)
Mergedinto: 867834
Status: Duplicate (was: Assigned)
This is dup of  issue 867834 . The tests rely on iframe sandboxing which is not working currently.
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 5

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/449e22adadca12253abd8580af2db21963753aec

commit 449e22adadca12253abd8580af2db21963753aec
Author: Takashi Toyoshima <toyoshim@chromium.org>
Date: Wed Sep 05 05:49:26 2018

OOR-CORS: Add navigation and security tests to virtual LayoutTests suites

There are some tests that call testRunner.addOriginAccessAllowListEntry
even in navigation and security test directories.

They are expected to call it to bypass renderer-side security checks,
but let me run them in our outofblink-cors(-ns) virtual environments
just in case.

Also the security directory seems to contain many relevant tests
that rely on CORS check on ResourceFetcher.

Bug:  870172 , 870173,  879991 
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng;luci.chromium.try:linux_mojo
Change-Id: I55c75b6766da6b98c7a2d816fbcfec555d181b68
Reviewed-on: https://chromium-review.googlesource.com/1193524
Reviewed-by: Yutaka Hirano <yhirano@chromium.org>
Commit-Queue: Takashi Toyoshima <toyoshim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#588773}
[modify] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=HeapIncrementalMarkingStress
[modify] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/FlagExpectations/enable-blink-features=LayoutNG
[modify] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/FlagExpectations/enable-browser-side-navigation
[modify] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/FlagExpectations/enable-features=NetworkService
[modify] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/FlagExpectations/site-per-process
[modify] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/LeakExpectations
[modify] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/SlowTests
[modify] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/VirtualTestSuites
[add] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/virtual/outofblink-cors-ns/http/tests/navigation/README.txt
[add] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/virtual/outofblink-cors-ns/http/tests/security/README.txt
[add] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/virtual/outofblink-cors/http/tests/navigation/README.txt
[add] https://crrev.com/449e22adadca12253abd8580af2db21963753aec/third_party/WebKit/LayoutTests/virtual/outofblink-cors/http/tests/security/README.txt

Project Member

Comment 4 by bugdroid1@chromium.org, Sep 25

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/20a34133c595148668a91237dd2b468310aaa336

commit 20a34133c595148668a91237dd2b468310aaa336
Author: Yutaka Hirano <yhirano@chromium.org>
Date: Tue Sep 25 06:55:59 2018

Unify origins on Resource, ResourceRequest and ResourceLoadOptions

blink::ResourceRequest::RequestorOrigin() has ignored iframe
sandboxing, but the reason why doing so is unknown even to OWNERS -
some comments say it's for site-for-cookies, but ResourceRequest
has a dedicated member for the concept, and there is no corresponding
concept of "RequestorOrigin" in the spec. Let's stop doing that, and
make it "request's origin" specified at
https://fetch.spec.whatwg.org/#concept-request-origin .

This CL also unifies ResourceRequest::RequestorOrigin with members that
are corresponding to "request's origin", i.e., Resource::source_origin_
and ResourceLoadOptions::security_origin.

This CL fixes some layout tests for outofblink-cors, because
network::CORSURLLoader uses network::ResourceRequest::request_initiator
which is corresponding to ResourceRequest::RequestorOrigin() as
"request's origin".

Bug:  867834 ,  811669 ,  879991 , 870173
Change-Id: Ie42d38dcfcc16e0a56d8fb1029475b72bd45f2ca
Reviewed-on: https://chromium-review.googlesource.com/1213422
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Reviewed-by: Takashi Toyoshima <toyoshim@chromium.org>
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/master@{#593840}
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/WebKit/LayoutTests/TestExpectations
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/public/platform/web_url_request.h
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/exported/web_associated_url_loader_impl.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/fetch/fetch_manager.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/loader/base_fetch_context.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/loader/base_fetch_context_test.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/loader/frame_fetch_context.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/loader/frame_fetch_context.h
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/loader/frame_fetch_context_test.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/loader/ping_loader.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/loader/resource/image_resource.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/loader/resource/image_resource.h
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/loader/threadable_loader.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/loader/threadable_loader.h
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/loader/worker_fetch_context.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/loader/worker_fetch_context.h
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/core/xmlhttprequest/xml_http_request.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/modules/background_fetch/background_fetch_icon_loader.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/modules/eventsource/event_source.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/modules/notifications/notification_image_loader.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/fetch_parameters.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/memory_cache_correctness_test.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/memory_cache_test.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/raw_resource.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/raw_resource.h
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/raw_resource_test.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/resource.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/resource.h
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/resource_fetcher_test.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/resource_loader.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/resource_loader.h
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/resource_loader_options.h
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/resource_request.cc
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/fetch/resource_request.h
[modify] https://crrev.com/20a34133c595148668a91237dd2b468310aaa336/third_party/blink/renderer/platform/loader/subresource_integrity_test.cc

Sign in to add a comment