From 61df7ef8b9093d46cd6cb76022583b49e6da6e35 Mon Sep 17 00:00:00 2001 From: Camillia Smith Barnes Date: Mon, 20 May 2024 16:29:13 -0700 Subject: [PATCH] Shared Storage: Allow writes from headers in all sandboxed frames Previously, writing to shared storage via response headers by way of a fetch or image request would work inside a sandboxed iframe only if the iframe had sandbox flag "allow-same-origin". We remove this unnecessary restriction by correcting the origin used for the opaqueness check for sharedStorageWritable image and fetch requests: instead of checking the environment's origin for opaqueness, we now check the request's origin for opaqueness in order to determine eligibility for the 'Sec-Shared-Storage-Writable' request header. See https://github.com/WICG/shared-storage/pull/155 for the related specification fix. Bug: 339172115 Change-Id: Ia3d048c8441bb99ea48d3943c55fe83c943bcadf Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5527770 Reviewed-by: Nate Chapin Reviewed-by: Yao Xiao Commit-Queue: Cammie Smith Barnes Cr-Commit-Position: refs/heads/main@{#1303509} --- ...uest-for-data-url.tentative.https.sub.html | 18 +++++ ...quest-in-data-url.tentative.https.sub.html | 69 +++++++++++++++++++ ...st-in-sandboxed-frame.tentative.https.html | 2 +- ...quest-in-data-url.tentative.https.sub.html | 64 +++++++++++++++++ ...quest-in-data-url.tentative.https.sub.html | 62 +++++++++++++++++ ...st-in-sandboxed-frame.tentative.https.html | 2 +- ...ble-opaque-origin.tentative.https.sub.html | 41 ----------- 7 files changed, 215 insertions(+), 43 deletions(-) create mode 100644 shared-storage/shared-storage-writable-fetch-request-for-data-url.tentative.https.sub.html create mode 100644 shared-storage/shared-storage-writable-fetch-request-in-data-url.tentative.https.sub.html create mode 100644 shared-storage/shared-storage-writable-iframe-request-in-data-url.tentative.https.sub.html create mode 100644 shared-storage/shared-storage-writable-img-request-in-data-url.tentative.https.sub.html delete mode 100644 shared-storage/shared-storage-writable-opaque-origin.tentative.https.sub.html diff --git a/shared-storage/shared-storage-writable-fetch-request-for-data-url.tentative.https.sub.html b/shared-storage/shared-storage-writable-fetch-request-for-data-url.tentative.https.sub.html new file mode 100644 index 00000000000000..51283579d9210a --- /dev/null +++ b/shared-storage/shared-storage-writable-fetch-request-for-data-url.tentative.https.sub.html @@ -0,0 +1,18 @@ + + + + + + diff --git a/shared-storage/shared-storage-writable-fetch-request-in-data-url.tentative.https.sub.html b/shared-storage/shared-storage-writable-fetch-request-in-data-url.tentative.https.sub.html new file mode 100644 index 00000000000000..1ebfdbc96f8db1 --- /dev/null +++ b/shared-storage/shared-storage-writable-fetch-request-in-data-url.tentative.https.sub.html @@ -0,0 +1,69 @@ + + + + + + + + + diff --git a/shared-storage/shared-storage-writable-fetch-request-in-sandboxed-frame.tentative.https.html b/shared-storage/shared-storage-writable-fetch-request-in-sandboxed-frame.tentative.https.html index de935b22fe080e..cb0f8fb7c81ef8 100644 --- a/shared-storage/shared-storage-writable-fetch-request-in-sandboxed-frame.tentative.https.html +++ b/shared-storage/shared-storage-writable-fetch-request-in-sandboxed-frame.tentative.https.html @@ -79,7 +79,7 @@ /*key=*/'c', /*value=*/'d', /*sandbox_flags=*/'allow-scripts', - /*expect_success=*/false); + /*expect_success=*/true); }, 'test sharedStorageWritable fetch request in sandboxed iframe without ' + '"allow-same-origin"'); diff --git a/shared-storage/shared-storage-writable-iframe-request-in-data-url.tentative.https.sub.html b/shared-storage/shared-storage-writable-iframe-request-in-data-url.tentative.https.sub.html new file mode 100644 index 00000000000000..1833e842b00a94 --- /dev/null +++ b/shared-storage/shared-storage-writable-iframe-request-in-data-url.tentative.https.sub.html @@ -0,0 +1,64 @@ + + + + + + + + + diff --git a/shared-storage/shared-storage-writable-img-request-in-data-url.tentative.https.sub.html b/shared-storage/shared-storage-writable-img-request-in-data-url.tentative.https.sub.html new file mode 100644 index 00000000000000..75d6b514a82c29 --- /dev/null +++ b/shared-storage/shared-storage-writable-img-request-in-data-url.tentative.https.sub.html @@ -0,0 +1,62 @@ + + + + + + + + + diff --git a/shared-storage/shared-storage-writable-img-request-in-sandboxed-frame.tentative.https.html b/shared-storage/shared-storage-writable-img-request-in-sandboxed-frame.tentative.https.html index a901500d66a4e4..8e33c68e8ca0cf 100644 --- a/shared-storage/shared-storage-writable-img-request-in-sandboxed-frame.tentative.https.html +++ b/shared-storage/shared-storage-writable-img-request-in-sandboxed-frame.tentative.https.html @@ -72,7 +72,7 @@ /*key=*/'c', /*value=*/'d', /*sandbox_flags=*/'allow-scripts', - /*expect_success=*/false); + /*expect_success=*/true); }, 'test sharedStorageWritable img request in sandboxed iframe without ' + '"allow-same-origin"'); diff --git a/shared-storage/shared-storage-writable-opaque-origin.tentative.https.sub.html b/shared-storage/shared-storage-writable-opaque-origin.tentative.https.sub.html deleted file mode 100644 index 4829af0e0c17c0..00000000000000 --- a/shared-storage/shared-storage-writable-opaque-origin.tentative.https.sub.html +++ /dev/null @@ -1,41 +0,0 @@ - - - - - -