Origin isolation: add various navigation WPTs

This adds web platform tests covering various navigation scenarios for origin isolation. The intention is to cover at least all the non-popup navigation cases in isolated_origin_browsertest.cc. We also want to approach the same coverage for navigation as we have for two-iframe scenarios (i.e. the various parent-child1-child2 tests), but we avoid doubling the size of the test suite by focusing on the more important or tricky scenarios instead of just copying all of those. Bug: 1042415 Change-Id: Ifb937f183af2610f348e4fea036d96aa0504ddab Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2285258 Commit-Queue: Domenic Denicola <domenic@chromium.org> Reviewed-by: James MacLean <wjmaclean@chromium.org> Cr-Commit-Position: refs/heads/master@{#786945}
web-platform-tests · Jul 9, 2020 · 9d71a04 · 9d71a04
1 parent fd21e75
commit 9d71a04
Show file tree

Hide file tree

Showing 10 changed files with 326 additions and 0 deletions.
diff --git a/origin-isolation/navigation-parent-no-1-same-no-2-ports-yes.sub.https.html b/origin-isolation/navigation-parent-no-1-same-no-2-ports-yes.sub.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Parent is not isolated, navigate a frame from same-origin non-isolated to different-origin (different-port) isolated</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<div id="log"></div>
+
+<script type="module">
+import {
+  insertIframe,
+  navigateIframe,
+  setBothDocumentDomains,
+  testSameAgentCluster,
+  testDifferentAgentClusters,
+  testOriginIsolationRestricted
+} from "./resources/helpers.mjs";
+
+let frame1;
+promise_setup(async () => {
+  frame1 = await insertIframe("{{hosts[][]}}");
+});
+
+// Nobody requested isolation yet.
+
+testSameAgentCluster([self, 0], "Before: parent to child");
+testOriginIsolationRestricted(self, false, "before parent");
+testOriginIsolationRestricted(0, false, "before child");
+
+promise_test(async () => {
+  await navigateIframe(frame1, "{{hosts[][]}}:{{ports[https][1]}}", "?1");
+  await setBothDocumentDomains(frames[0]);
+}, "Navigation");
+
+// Since the new page is different-origin, it should be isolated.
+
+testDifferentAgentClusters([self, 0], "After: parent to child");
+testOriginIsolationRestricted(self, false, "after parent");
+testOriginIsolationRestricted(0, true, "after child");
+</script>
diff --git a/origin-isolation/navigation-parent-no-1-same-no-2-subdomain-yes.sub.https.html b/origin-isolation/navigation-parent-no-1-same-no-2-subdomain-yes.sub.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Parent is not isolated, navigate a frame from same-origin non-isolated to different-origin (subdomain) isolated</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<div id="log"></div>
+
+<script type="module">
+import {
+  insertIframe,
+  navigateIframe,
+  setBothDocumentDomains,
+  testSameAgentCluster,
+  testDifferentAgentClusters,
+  testOriginIsolationRestricted
+} from "./resources/helpers.mjs";
+
+let frame1;
+promise_setup(async () => {
+  frame1 = await insertIframe("{{hosts[][]}}");
+});
+
+// Nobody requested isolation yet.
+
+testSameAgentCluster([self, 0], "Before: parent to child");
+testOriginIsolationRestricted(self, false, "before parent");
+testOriginIsolationRestricted(0, false, "before child");
+
+promise_test(async () => {
+  await navigateIframe(frame1, "{{hosts[][www]}}", "?1");
+  await setBothDocumentDomains(frames[0]);
+}, "Navigation");
+
+// Since the new page is different-origin, it should be isolated.
+
+testDifferentAgentClusters([self, 0], "After: parent to child");
+testOriginIsolationRestricted(self, false, "after parent");
+testOriginIsolationRestricted(0, true, "after child");
+</script>
diff --git a/origin-isolation/navigation-parent-no-1-subdomain-no-2-subdomain-yes.sub.https.html b/origin-isolation/navigation-parent-no-1-subdomain-no-2-subdomain-yes.sub.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Parent is not isolated, navigate a frame from a subdomain non-isolated to the same subdomain isolated</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<div id="log"></div>
+
+<script type="module">
+import {
+  insertIframe,
+  navigateIframe,
+  setBothDocumentDomains,
+  testSameAgentCluster,
+  testOriginIsolationRestricted
+} from "./resources/helpers.mjs";
+
+let frame1;
+promise_setup(async () => {
+  frame1 = await insertIframe("{{hosts[][www]}}");
+});
+
+// Nobody requested isolation yet.
+
+testSameAgentCluster([self, 0], "Before: parent to child");
+testOriginIsolationRestricted(self, false, "before parent");
+testOriginIsolationRestricted(0, false, "before child");
+
+promise_test(async () => {
+  await navigateIframe(frame1, "{{hosts[][www]}}", "?1");
+  await setBothDocumentDomains(frames[0]);
+}, "Navigation");
+
+// Because this subdomain was previously non-isolated, the second load's
+// isolation request is ignored; instead we continue isolating.
+
+testSameAgentCluster([self, 0], "After: parent to child");
+testOriginIsolationRestricted(self, false, "after parent");
+testOriginIsolationRestricted(0, false, "after child");
+</script>
diff --git a/origin-isolation/navigation-parent-no-1-subdomain-no-2-subdomain2-yes.sub.https.html b/origin-isolation/navigation-parent-no-1-subdomain-no-2-subdomain2-yes.sub.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Parent is not isolated, navigate a frame from a subdomain non-isolated to a second-subdomain isolated</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<div id="log"></div>
+
+<script type="module">
+import {
+  insertIframe,
+  navigateIframe,
+  setBothDocumentDomains,
+  testSameAgentCluster,
+  testDifferentAgentClusters,
+  testOriginIsolationRestricted
+} from "./resources/helpers.mjs";
+
+let frame1;
+promise_setup(async () => {
+  frame1 = await insertIframe("{{hosts[][www]}}");
+});
+
+// Nobody requested isolation yet.
+
+testSameAgentCluster([self, 0], "Before: parent to child");
+testOriginIsolationRestricted(self, false, "before parent");
+testOriginIsolationRestricted(0, false, "before child");
+
+promise_test(async () => {
+  await navigateIframe(frame1, "{{hosts[][www1]}}", "?1");
+  await setBothDocumentDomains(frames[0]);
+}, "Navigation");
+
+// Because we're going to a different subdomain (and thus different origin), the
+// isolation request is respected.
+
+testDifferentAgentClusters([self, 0], "After: parent to child");
+testOriginIsolationRestricted(self, false, "after parent");
+testOriginIsolationRestricted(0, true, "after child");
+</script>
diff --git a/origin-isolation/navigation-parent-no-1-subdomain-yes-2-subdomain-no.sub.https.html b/origin-isolation/navigation-parent-no-1-subdomain-yes-2-subdomain-no.sub.https.html
@@ -0,0 +1,40 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Parent is not isolated, navigate a frame from a subdomain isolated to the same subdomain non-isolated</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<div id="log"></div>
+
+<script type="module">
+import {
+  insertIframe,
+  navigateIframe,
+  setBothDocumentDomains,
+  testDifferentAgentClusters,
+  testOriginIsolationRestricted
+} from "./resources/helpers.mjs";
+
+let frame1;
+promise_setup(async () => {
+  frame1 = await insertIframe("{{hosts[][www]}}", "?1");
+});
+
+// Since they are different-origin, the child's isolation request is respected.
+
+testDifferentAgentClusters([self, 0], "Before: parent to child");
+testOriginIsolationRestricted(self, false, "before parent");
+testOriginIsolationRestricted(0, true, "before child");
+
+promise_test(async () => {
+  await navigateIframe(frame1, "{{hosts[][www]}}");
+  await setBothDocumentDomains(frames[0]);
+}, "Navigation");
+
+// Because this subdomain was previously isolated, the second load's
+// non-isolation request is ignored; instead we continue isolating.
+
+testDifferentAgentClusters([self, 0], "After: parent to child");
+testOriginIsolationRestricted(self, false, "after parent");
+testOriginIsolationRestricted(0, true, "after child");
+</script>
diff --git a/origin-isolation/navigation-parent-no-1-subdomain-yes-2-subdomain2-no.sub.https.html b/origin-isolation/navigation-parent-no-1-subdomain-yes-2-subdomain2-no.sub.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Parent is not isolated, navigate a frame from a subdomain isolated to a second-subdomain non-isolated</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<div id="log"></div>
+
+<script type="module">
+import {
+  insertIframe,
+  navigateIframe,
+  setBothDocumentDomains,
+  testSameAgentCluster,
+  testDifferentAgentClusters,
+  testOriginIsolationRestricted
+} from "./resources/helpers.mjs";
+
+let frame1;
+promise_setup(async () => {
+  frame1 = await insertIframe("{{hosts[][www]}}", "?1");
+});
+
+// Since they are different-origin, the child's isolation request is respected.
+
+testDifferentAgentClusters([self, 0], "Before: parent to child");
+testOriginIsolationRestricted(self, false, "before parent");
+testOriginIsolationRestricted(0, true, "before child");
+
+promise_test(async () => {
+  await navigateIframe(frame1, "{{hosts[][www1]}}");
+  await setBothDocumentDomains(frames[0]);
+}, "Navigation");
+
+// Make sure that the different-subdomain page (which doesn't request isolation)
+// doesn't somehow get isolated just because its predecessor was.
+
+testSameAgentCluster([self, 0], "After: parent to child");
+testOriginIsolationRestricted(self, false, "after parent");
+testOriginIsolationRestricted(0, false, "after child");
+</script>
diff --git a/origin-isolation/navigation-parent-yes-1-same-no-2-ports-no.sub.https.html b/origin-isolation/navigation-parent-yes-1-same-no-2-ports-no.sub.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Parent is isolated, navigate a frame from same-origin non-isolated to different-origin (different-port) isolated</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<div id="log"></div>
+
+<script type="module">
+import {
+  insertIframe,
+  navigateIframe,
+  setBothDocumentDomains,
+  testSameAgentCluster,
+  testDifferentAgentClusters,
+  testOriginIsolationRestricted
+} from "./resources/helpers.mjs";
+
+let frame1;
+promise_setup(async () => {
+  frame1 = await insertIframe("{{hosts[][]}}");
+});
+
+// Since the parent is isolated, the same-origin child's non-request is ignored,
+// so it gets isolated too.
+
+testSameAgentCluster([self, 0], "Before: parent to child");
+testOriginIsolationRestricted(self, true, "before parent");
+testOriginIsolationRestricted(0, true, "before child");
+
+promise_test(async () => {
+  await navigateIframe(frame1, "{{hosts[][]}}:{{ports[https][1]}}");
+  await setBothDocumentDomains(frames[0]);
+}, "Navigation");
+
+// Since the new page is different-origin, its non-request should be respected.
+
+testDifferentAgentClusters([self, 0], "After: parent to child");
+testOriginIsolationRestricted(self, true, "after parent");
+testOriginIsolationRestricted(0, false, "after child");
+</script>
diff --git a/origin-isolation/navigation-parent-yes-1-same-no-2-ports-no.sub.https.html.headers b/origin-isolation/navigation-parent-yes-1-same-no-2-ports-no.sub.https.html.headers
@@ -0,0 +1 @@
+Origin-Isolation: ?1
diff --git a/origin-isolation/navigation-parent-yes-1-same-no-2-subdomain-no.sub.https.html b/origin-isolation/navigation-parent-yes-1-same-no-2-subdomain-no.sub.https.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>Parent is isolated, navigate a frame from same-origin non-isolated to different-origin (subdomain) isolated</title>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+
+<div id="log"></div>
+
+<script type="module">
+import {
+  insertIframe,
+  navigateIframe,
+  setBothDocumentDomains,
+  testSameAgentCluster,
+  testDifferentAgentClusters,
+  testOriginIsolationRestricted
+} from "./resources/helpers.mjs";
+
+let frame1;
+promise_setup(async () => {
+  frame1 = await insertIframe("{{hosts[][]}}");
+});
+
+// Since the parent is isolated, the same-origin child's non-request is ignored,
+// so it gets isolated too.
+
+testSameAgentCluster([self, 0], "Before: parent to child");
+testOriginIsolationRestricted(self, true, "before parent");
+testOriginIsolationRestricted(0, true, "before child");
+
+promise_test(async () => {
+  await navigateIframe(frame1, "{{hosts[][www]}}");
+  await setBothDocumentDomains(frames[0]);
+}, "Navigation");
+
+// Since the new page is different-origin, its non-request should be respected.
+
+testDifferentAgentClusters([self, 0], "After: parent to child");
+testOriginIsolationRestricted(self, true, "after parent");
+testOriginIsolationRestricted(0, false, "after child");
+</script>
diff --git a/origin-isolation/navigation-parent-yes-1-same-no-2-subdomain-no.sub.https.html.headers b/origin-isolation/navigation-parent-yes-1-same-no-2-subdomain-no.sub.https.html.headers
@@ -0,0 +1 @@
+Origin-Isolation: ?1