New issue
Advanced search Search tips

Issue 904878 link

Starred by 1 user
Status: Fixed
Owner:
iclell...@chromium.org
Closed: Nov 20
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac , Fuchsia
Pri: 3
Type: Bug

Blocked on:
issue 904880
Blocking:
issue 867471



Sign in to add a comment

Implement Report-Only mode for Feature Policy

Project Member Reported by iclell...@chromium.org, Nov 13 
Feature Policy should allow potential violations to be reported through the reporting API, even when the actual action is not blocked.

This is set up by the page's feature policy by using features with the suffix "-report-only". Any features so tagged become part of the "reporting policy". When a feature is not blocked by the main (enforcing) policy, the reporting policy is then checked. If use of the feature would violate that policy, then a report is queued, but use of the feature is allowed.

Explainer:
https://github.com/WICG/feature-policy/blob/master/reporting.md

(Spec in progress)

Comment 1 by iclell...@chromium.org, Nov 13

Blockedon: 904880
Project Member

Comment 2 by bugdroid1@chromium.org, Nov 14 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/f482e77e59ef0a506e745182ca6843080cd8d1ea

commit f482e77e59ef0a506e745182ca6843080cd8d1ea
Author: Ian Clelland <iclelland@chromium.org>
Date: Wed Nov 14 16:42:47 2018

Add report-only mode to Feature Policy

This change adds a "report-only" policy to each security context, which
is local to that context (not replicated across processes) and is used
to determine whether a report should be sent even if a feature is
enabled, when the feature is used.

Reports are now augmented with a "disposition" field, which is either
"enforce", if the feature usage was actually blocked, or "report", if
it was not.

Feature policy directives are placed in the report-only policy if the
feature name is suffixed with "-report-only", otherwise, they affect
the regular (enforcing) policy.

Explainer at
https://github.com/WICG/feature-policy/blob/master/reporting.md

Existing tests are updated, and new tests for report-only mode are
added to ensure that reports are sent even when the feature is used
successfully.

Bug:  904878 
Change-Id: I27bc42729c5ab5560160f3d993431e606a8a3a47
Reviewed-on: https://chromium-review.googlesource.com/c/1178811
Commit-Queue: Ian Clelland <iclelland@chromium.org>
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#608004}
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/content/browser/frame_host/render_frame_host_feature_policy_unittest.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/content/browser/frame_host/render_frame_host_impl.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/content/browser/net/reporting_service_proxy.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/content/browser/site_per_process_browsertest.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/content/common/frame_messages.h
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/content/test/test_render_frame_host.cc
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/camera-report-only.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/camera-report-only.https.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/camera-reporting.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/document-write-report-only.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/document-write-report-only.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/document-write-reporting.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/encrypted-media-report-only.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/encrypted-media-report-only.https.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/encrypted-media-reporting.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/fullscreen-report-only.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/fullscreen-report-only.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/fullscreen-reporting.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/generic-sensor-report-only.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/generic-sensor-report-only.https.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/generic-sensor-reporting.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/geolocation-report-only.https-expected.txt
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/geolocation-report-only.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/geolocation-report-only.https.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/geolocation-reporting.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/microphone-report-only.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/microphone-report-only.https.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/microphone-reporting.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/midi-report-only-expected.txt
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/midi-report-only.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/midi-report-only.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/midi-reporting.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/payment-report-only.https-expected.txt
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/payment-report-only.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/payment-report-only.https.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/payment-reporting.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/picture-in-picture-report-only.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/picture-in-picture-report-only.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/picture-in-picture-reporting.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/sync-xhr-report-only.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/sync-xhr-report-only.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/sync-xhr-reporting.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/usb-report-only.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/usb-report-only.https.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/usb-reporting.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/vr-report-only.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/vr-report-only.https.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/vr-reporting.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/xr-report-only.https.html
[add] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/xr-report-only.https.html.headers
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/WebKit/LayoutTests/external/wpt/feature-policy/reporting/xr-reporting.https.html
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/common/feature_policy/feature_policy.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/common/feature_policy/feature_policy_mojom_traits.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/common/feature_policy/feature_policy_mojom_traits.h
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/common/feature_policy/feature_policy_unittest.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/public/common/feature_policy/feature_policy.h
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/public/mojom/feature_policy/feature_policy.mojom
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/public/platform/reporting.mojom
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/core/dom/document.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/core/dom/document.h
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/core/execution_context/security_context.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/core/execution_context/security_context.h
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/core/feature_policy/feature_policy.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/core/feature_policy/feature_policy_test.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/core/feature_policy/iframe_policy.h
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/core/frame/feature_policy_violation_report_body.h
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/core/frame/feature_policy_violation_report_body.idl
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/core/html/html_frame_element.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/core/html/html_plugin_element.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/core/html/media/media_element_parser_helpers.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/modules/webusb/usb.cc
[modify] https://crrev.com/f482e77e59ef0a506e745182ca6843080cd8d1ea/third_party/blink/renderer/modules/webusb/usb.h

Comment 3 by iclell...@chromium.org, Nov 20

Status: Fixed (was: Started)
►

Sign in to add a comment