Bug 1988751 - Forbid notification permission in nested first party iframes r=asuth

Differential Revision: https://phabricator.services.mozilla.com/D265282

Author: saschanaz

dom/notification/NotificationUtils.cpp

@@ -97,7 +97,8 @@ bool IsNotificationForbiddenFor(nsIPrincipal* aPrincipal,
   if (outForeignByAncestorContext) {
     // nested first party
     ReportTelemetry(GleanLabel::eNestedFirstParty, aPurpose);
-    return false;
+    return StaticPrefs::
+        dom_webnotifications_forbid_nested_first_party_enabled();
   }
 
   // third party

modules/libpref/init/StaticPrefList.yaml

@@ -5646,6 +5646,11 @@
   value: false
   mirror: always
 
+- name: dom.webnotifications.forbid_nested_first_party.enabled
+  type: RelaxedAtomicBool
+  value: true
+  mirror: always
+
 - name: dom.webnotifications.enabled
   type: RelaxedAtomicBool
   value: true

testing/web-platform/tests/notifications/cross-origin-nested.tentative.https.sub.html

@@ -56,11 +56,11 @@
 
 promise_test(async t => {
   const result = await promises.get("child");
-  assert_equals(result.permission, "granted", `should grant the permission`);
-  assert_true(result.shown, `notification should be shown`);
+  assert_equals(result.permission, "denied", `should deny the permission`);
+  assert_false(result.shown, `notification should not be shown`);
 
   const childRequestResult = await promises.get("childRequest");
-  assert_equals(childRequestResult.permission, "granted", "should accept the permission request");
+  assert_equals(childRequestResult.permission, "denied", "should deny the permission request");
 }, "nested first party iframe");
 
 promise_test(async t => {
@@ -71,7 +71,7 @@
 
 promise_test(async t => {
   const result = await promises.get("childWorker");
-  assert_equals(result.permission, "granted", `should grant the permission`);
-  assert_true(result.shown, `notification should be shown`);
+  assert_equals(result.permission, "denied", `should deny the permission`);
+  assert_false(result.shown, `notification should not be shown`);
 }, "nested first party worker");
 </script>