⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 281012 in webkit


Ignore:
Timestamp:
Aug 13, 2021, 3:22:38 AM (5 years ago)
Author:
youenn@apple.com
Message:

Overly verbose catchable fetch error messages lead to cross-origin leaks
​https://bugs.webkit.org/show_bug.cgi?id=228861

Reviewed by Brent Fulgham.

LayoutTests/imported/w3c:

Rebasing tests with new error message.

  • web-platform-tests/FileAPI/url/url-with-fetch.any-expected.txt:
  • web-platform-tests/FileAPI/url/url-with-fetch.any.worker-expected.txt:
  • web-platform-tests/clipboard-apis/async-navigator-clipboard-basics.https-expected.txt:
  • web-platform-tests/content-security-policy/inside-worker/dedicatedworker-report-only-expected.txt:
  • web-platform-tests/content-security-policy/inside-worker/serviceworker-report-only.https.sub-expected.txt:
  • web-platform-tests/fetch/api/cors/cors-cookies.any.worker-expected.txt:
  • web-platform-tests/fetch/api/policies/referrer-origin-when-cross-origin-service-worker.https-expected.txt:
  • web-platform-tests/fetch/http-cache/cc-request.any-expected.txt:
  • web-platform-tests/fetch/http-cache/cc-request.any.worker-expected.txt:
  • web-platform-tests/html/cross-origin-embedder-policy/coep-on-response-from-service-worker.https-expected.txt:
  • web-platform-tests/html/cross-origin-embedder-policy/none-sw-from-none.https-expected.txt:
  • web-platform-tests/html/cross-origin-embedder-policy/none-sw-from-require-corp.https-expected.txt:
  • web-platform-tests/html/cross-origin-embedder-policy/require-corp-sw-from-none.https-expected.txt:
  • web-platform-tests/html/cross-origin-embedder-policy/require-corp-sw-from-require-corp.https-expected.txt:
  • web-platform-tests/html/semantics/scripting-1/the-script-element/css-module/credentials.sub-expected.txt:
  • web-platform-tests/html/semantics/scripting-1/the-script-element/json-module/credentials.sub-expected.txt:
  • web-platform-tests/html/semantics/scripting-1/the-script-element/module/credentials.sub-expected.txt:
  • web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/dynamic-imports-credentials-setTimeout.sub-expected.txt:
  • web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/dynamic-imports-credentials.sub-expected.txt:
  • web-platform-tests/html/semantics/scripting-1/the-script-element/module/integrity-expected.txt:
  • web-platform-tests/service-workers/service-worker/fetch-event-referrer-policy.https-expected.txt:
  • web-platform-tests/service-workers/service-worker/import-scripts-cross-origin.https-expected.txt:
  • web-platform-tests/service-workers/service-worker/redirected-response.https-expected.txt:
  • web-platform-tests/wasm/jsapi/table/constructor-reftypes.tentative.any.worker-expected.txt:
  • web-platform-tests/wasm/jsapi/table/grow-reftypes.tentative.any.worker-expected.txt:
  • web-platform-tests/wasm/jsapi/table/set-reftypes.tentative.any.worker-expected.txt:

Source/WebCore:

Standardize error messages to get more uniform with other browsers.
To continue supporting service worker errors going to page errors,
we add a boolean to ResourceError to control whether sanitizing the error message or not.
This allows to keep error messages from service worker type exceptions to be exposed in window environments through fetch rejection.
Also handle ScriptModuleLoader since it is doing its own SRI checks.
Covered by rebased tests.

  • Modules/fetch/FetchBodyOwner.cpp:

(WebCore::FetchBodyOwner::loadingException const):

  • Modules/fetch/FetchResponse.cpp:

(WebCore::FetchResponse::BodyLoader::didFail):

  • platform/network/ResourceErrorBase.h:

(WebCore::ResourceErrorBase::sanitizedDescription const):
(WebCore::ResourceErrorBase::isSanitized const):
(WebCore::ResourceErrorBase::setAsSanitized):
(WebCore::ResourceErrorBase::ResourceErrorBase):

  • platform/network/cf/ResourceError.h:

(WebCore::ResourceError::ResourceError):

  • platform/network/curl/ResourceError.h:

(WebCore::ResourceError::ResourceError):

  • platform/network/soup/ResourceError.h:

(WebCore::ResourceError::ResourceError):

  • workers/WorkerScriptLoader.cpp:

(WebCore::WorkerScriptLoader::loadSynchronously):

  • workers/service/FetchEvent.cpp:

(WebCore::FetchEvent::createResponseError):
(WebCore::FetchEvent::respondWith):
(WebCore::FetchEvent::promiseIsSettled):

  • workers/service/FetchEvent.h:
  • workers/service/context/ServiceWorkerFetch.cpp:

(WebCore::ServiceWorkerFetch::processResponse):
(WebCore::ServiceWorkerFetch::dispatchFetchEvent):

  • bindings/js/ScriptModuleLoader.cpp:

(WebCore::ScriptModuleLoader::notifyFinished):

Source/WebKit:

  • Shared/WebCoreArgumentCoders.cpp:

(IPC::ArgumentCoder<ResourceError>::encode):
(IPC::ArgumentCoder<ResourceError>::decode):

LayoutTests:

  • http/tests/contentextensions/block-ping-resource-type-raw-expected.txt:
  • http/tests/contentextensions/fetch-redirect-blocked.html:
  • http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
  • http/tests/subresource-integrity/sri-module-expected.txt:
  • http/tests/workers/service/shift-reload-navigation-expected.txt:
  • http/tests/workers/resources/worker-importScripts.js: changed error logging for better readability.
  • http/tests/workers/worker-importScripts-expected.txt:
  • http/wpt/service-workers/cors-preflight-star.any-serviceworker-expected.txt:
  • js/dom/modules/module-fetch-failure-not-cached-expected.txt:
  • platform/mac-wk1/http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
  • platform/mac-wk1/http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
  • platform/mac-wk1/imported/w3c/web-platform-tests/FileAPI/url/url-with-fetch.any-expected.txt:
  • platform/mac-wk1/imported/w3c/web-platform-tests/FileAPI/url/url-with-fetch.any.worker-expected.txt:
  • platform/mac-wk1/imported/w3c/web-platform-tests/clipboard-apis/async-navigator-clipboard-basics.https-expected.txt:
  • platform/mac-wk1/imported/w3c/web-platform-tests/content-security-policy/inside-worker/dedicatedworker-report-only-expected.txt:
  • platform/mac-wk1/imported/w3c/web-platform-tests/fetch/api/request/request-cache-only-if-cached.any-expected.txt:
  • platform/mac-wk1/imported/w3c/web-platform-tests/fetch/api/request/request-cache-only-if-cached.any.worker-expected.txt:
  • platform/mac-wk1/imported/w3c/web-platform-tests/fetch/http-cache/cc-request.any-expected.txt:
  • platform/mac-wk1/imported/w3c/web-platform-tests/fetch/http-cache/cc-request.any.worker-expected.txt:
Location:
trunk
Files:
62 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r281010 r281012  
     12021-08-13  Youenn Fablet  <youenn@apple.com>
     2
     3        Overly verbose catchable fetch error messages lead to cross-origin leaks
     4        https://bugs.webkit.org/show_bug.cgi?id=228861
     5
     6        Reviewed by Brent Fulgham.
     7
     8        * http/tests/contentextensions/block-ping-resource-type-raw-expected.txt:
     9        * http/tests/contentextensions/fetch-redirect-blocked.html:
     10        * http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     11        * http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     12        * http/tests/subresource-integrity/sri-module-expected.txt:
     13        * http/tests/workers/service/shift-reload-navigation-expected.txt:
     14        * http/tests/workers/resources/worker-importScripts.js: changed error logging for better readability.
     15        * http/tests/workers/worker-importScripts-expected.txt:
     16        * http/wpt/service-workers/cors-preflight-star.any-serviceworker-expected.txt:
     17        * js/dom/modules/module-fetch-failure-not-cached-expected.txt:
     18        * platform/mac-wk1/http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     19        * platform/mac-wk1/http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt:
     20        * platform/mac-wk1/imported/w3c/web-platform-tests/FileAPI/url/url-with-fetch.any-expected.txt:
     21        * platform/mac-wk1/imported/w3c/web-platform-tests/FileAPI/url/url-with-fetch.any.worker-expected.txt:
     22        * platform/mac-wk1/imported/w3c/web-platform-tests/clipboard-apis/async-navigator-clipboard-basics.https-expected.txt:
     23        * platform/mac-wk1/imported/w3c/web-platform-tests/content-security-policy/inside-worker/dedicatedworker-report-only-expected.txt:
     24        * platform/mac-wk1/imported/w3c/web-platform-tests/fetch/api/request/request-cache-only-if-cached.any-expected.txt:
     25        * platform/mac-wk1/imported/w3c/web-platform-tests/fetch/api/request/request-cache-only-if-cached.any.worker-expected.txt:
     26        * platform/mac-wk1/imported/w3c/web-platform-tests/fetch/http-cache/cc-request.any-expected.txt:
     27        * platform/mac-wk1/imported/w3c/web-platform-tests/fetch/http-cache/cc-request.any.worker-expected.txt:
     28
    1292021-08-13  Martin Robinson  <mrobinson@webkit.org>
    230

  • trunk/LayoutTests/http/tests/contentextensions/block-ping-resource-type-raw-expected.txt

    r275204 r281012  
    33CONSOLE MESSAGE: Resource blocked by content blocker
    44CONSOLE MESSAGE: Fetch API cannot load http://127.0.0.1:8000/contentextensions/resources/save-ping.py?test=contentextensions-block-ping-resource-type-raw due to access control checks.
    5 ALERT: PASS:TypeError: Resource blocked by content blocker
     5ALERT: PASS:TypeError: Load failed
    66This test follows a link with a ping attribute where the ping URL matches a 'block' rule.
    77

  • trunk/LayoutTests/http/tests/contentextensions/fetch-redirect-blocked.html

    r275204 r281012  
    88        assert_not_reached("fetch should fail");
    99    }, (e) => {
    10         assert_equals(e.message, "Blocked by Content Security Policy.");
     10        assert_equals(e.message, "Load failed");
    1111    });
    1212}, "Ensure CSP happens before content blocker checks");

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt

    r232032 r281012  
    33This tests that the Content Security Policy of the parent origin (this page) blocks a Web Worker from importing a script from a different origin, not listed in script-src, through a redirect.
    44
    5 PASS threw exception NetworkError: Blocked by Content Security Policy..
     5PASS threw exception NetworkError: Load failed.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt

    r232032 r281012  
    33This tests a Web Worker with Content Security Policy "script-src 'self'" blocks the import of a script from a different origin through a redirect.
    44
    5 PASS threw exception NetworkError: Blocked by Content Security Policy..
     5PASS threw exception NetworkError: Load failed.

  • trunk/LayoutTests/http/tests/subresource-integrity/sri-module-expected.txt

    r273203 r281012  
    1 CONSOLE MESSAGE: TypeError: Cannot load script http://127.0.0.1:8000/subresource-integrity/resources/non-matching-digest-module.js. Failed integrity metadata check. Content length: 33, Expected content length: 33, Expected metadata: sha256-cWh9nPfm7/mRbKhzarnRYlsJWz5XTNcsqPFzKEx+zSU=
    2 CONSOLE MESSAGE: TypeError: Cannot load script http://127.0.0.1:8000/subresource-integrity/resources/matching-digest-module.js. Failed integrity metadata check. Content length: 29, Expected content length: 29, Expected metadata: sha512-deadbeefspbnUnwooKGNNCb39nvg+EW0O9hDScTXeo/9pVZztLSUYU3LNV6H0lZapo8bCJUpyPPLAzE9fDzpxg== sha256-cWh9nPfm7/mRbKhzarnRYlsJWz5XTNcsqPFzKEx+zSU=
    3 CONSOLE MESSAGE: TypeError: Cannot load script http://localhost:8000/subresource-integrity/resources/crossorigin-anon-script-module.js. Failed integrity metadata check. Content length: 37, Expected content length: 37, Expected metadata: sha256-deadbeefcSLlbFZCj1OACLxTxVck2TOrBTEdUbwz1yU=
    4 CONSOLE MESSAGE: TypeError: Cannot load script http://localhost:8000/subresource-integrity/resources/crossorigin-creds-script-module.js. Failed integrity metadata check. Content length: 38, Expected content length: 38, Expected metadata: sha256-deadbeef2S+pTRZgiw3DWrhC6JLDlt2zRyGpwH7unU8=
     1CONSOLE MESSAGE: TypeError: Cannot load script due to integrity mismatch
     2CONSOLE MESSAGE: TypeError: Cannot load script due to integrity mismatch
     3CONSOLE MESSAGE: TypeError: Cannot load script due to integrity mismatch
     4CONSOLE MESSAGE: TypeError: Cannot load script due to integrity mismatch
    55CONSOLE MESSAGE: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
    6 CONSOLE MESSAGE: TypeError: Cannot load script http://127.0.0.1:8000/subresource-integrity/resources/matching-digest-module.js. Failed integrity metadata check. Content length: 29, Expected content length: 29, Expected metadata: sha256-cWh9nPfm7_mRbKhzarnRYlsJWz5XTNcsqPFzKEx+zSU=
    7 CONSOLE MESSAGE: TypeError: Cannot load script http://127.0.0.1:8000/subresource-integrity/resources/matching-digest-module.js. Failed integrity metadata check. Content length: 29, Expected content length: 29, Expected metadata: sha256-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9e=?foo=bar?spam=eggs
     6CONSOLE MESSAGE: TypeError: Cannot load script due to integrity mismatch
     7CONSOLE MESSAGE: TypeError: Cannot load script due to integrity mismatch
    88
    99PASS Module: Same-origin with correct sha256 hash.

  • trunk/LayoutTests/http/tests/workers/resources/worker-importScripts.js

    r272981 r281012  
    101101            importScripts(source1, fakeSource, source2);
    102102        } catch(e) {
    103             postMessage("PASS: Threw " + e + " when load failed");
     103            postMessage("PASS: Threw " + e + " when importing script");
    104104        }
    105105        if (!loadedSource1 && !loadedSource2)

  • trunk/LayoutTests/http/tests/workers/service/shift-reload-navigation-expected.txt

    r231000 r281012  
    33CONSOLE MESSAGE: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
    44CONSOLE MESSAGE: Fetch API cannot load http://localhost:8080/resources/square100.png.fromserviceworker due to access control checks.
    5 PASS: Fetch failed as expected with: TypeError: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
     5PASS: Fetch failed as expected with: TypeError: Load failed
    66PASS: Got response with buffer byte length being 12940
    7 PASS: Fetch failed as expected with: TypeError: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin.
     7PASS: Fetch failed as expected with: TypeError: Load failed
    88

  • trunk/LayoutTests/http/tests/workers/worker-importScripts-expected.txt

    r253102 r281012  
    2525PASS: all resources executed.
    2626Loaded resource 1
    27 PASS: Threw NetworkError: Response is not 2xx when load failed
     27PASS: Threw NetworkError: Load failed when importing script
    2828PASS: some resources were loaded despite the network error
    2929Loaded resource 1

  • trunk/LayoutTests/http/wpt/service-workers/cors-preflight-star.any-serviceworker-expected.txt

    r267644 r281012  
    11
    22PASS Setting up tests
    3 FAIL CORS that succeeds with credentials: false; method: GET (allowed: get); header: X-Test,1 (allowed: x-test) promise_test: Unhandled rejection with value: object "TypeError: Preflight response is not successful"
    4 FAIL CORS that succeeds with credentials: false; method: SUPER (allowed: *); header: X-Test,1 (allowed: x-test) promise_test: Unhandled rejection with value: object "TypeError: Preflight response is not successful"
    5 FAIL CORS that succeeds with credentials: false; method: OK (allowed: *); header: X-Test,1 (allowed: *) promise_test: Unhandled rejection with value: object "TypeError: Preflight response is not successful"
     3FAIL CORS that succeeds with credentials: false; method: GET (allowed: get); header: X-Test,1 (allowed: x-test) promise_test: Unhandled rejection with value: object "TypeError: Load failed"
     4FAIL CORS that succeeds with credentials: false; method: SUPER (allowed: *); header: X-Test,1 (allowed: x-test) promise_test: Unhandled rejection with value: object "TypeError: Load failed"
     5FAIL CORS that succeeds with credentials: false; method: OK (allowed: *); header: X-Test,1 (allowed: *) promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    66PASS CORS that fails with credentials: true; method: OK (allowed: *); header: X-Test,1 (allowed: *)
    77PASS CORS that fails with credentials: true; method: PUT (allowed: *); header:  (allowed: )
    8 FAIL CORS that succeeds with credentials: true; method: PUT (allowed: PUT); header:  (allowed: *) promise_test: Unhandled rejection with value: object "TypeError: Preflight response is not successful"
     8FAIL CORS that succeeds with credentials: true; method: PUT (allowed: PUT); header:  (allowed: *) promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    99PASS CORS that fails with credentials: true; method: PUT (allowed: put); header:  (allowed: *)
    1010PASS CORS that fails with credentials: true; method: GET (allowed: get); header: X-Test,1 (allowed: *)
    1111PASS CORS that fails with credentials: true; method: GET (allowed: *); header: X-Test,1 (allowed: *)
    12 FAIL CORS that succeeds with credentials: true; method: * (allowed: *); header: *,1 (allowed: *) promise_test: Unhandled rejection with value: object "TypeError: Preflight response is not successful"
     12FAIL CORS that succeeds with credentials: true; method: * (allowed: *); header: *,1 (allowed: *) promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1313

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r281009 r281012  
     12021-08-13  Youenn Fablet  <youenn@apple.com>
     2
     3        Overly verbose catchable fetch error messages lead to cross-origin leaks
     4        https://bugs.webkit.org/show_bug.cgi?id=228861
     5
     6        Reviewed by Brent Fulgham.
     7
     8        Rebasing tests with new error message.
     9
     10        * web-platform-tests/FileAPI/url/url-with-fetch.any-expected.txt:
     11        * web-platform-tests/FileAPI/url/url-with-fetch.any.worker-expected.txt:
     12        * web-platform-tests/clipboard-apis/async-navigator-clipboard-basics.https-expected.txt:
     13        * web-platform-tests/content-security-policy/inside-worker/dedicatedworker-report-only-expected.txt:
     14        * web-platform-tests/content-security-policy/inside-worker/serviceworker-report-only.https.sub-expected.txt:
     15        * web-platform-tests/fetch/api/cors/cors-cookies.any.worker-expected.txt:
     16        * web-platform-tests/fetch/api/policies/referrer-origin-when-cross-origin-service-worker.https-expected.txt:
     17        * web-platform-tests/fetch/http-cache/cc-request.any-expected.txt:
     18        * web-platform-tests/fetch/http-cache/cc-request.any.worker-expected.txt:
     19        * web-platform-tests/html/cross-origin-embedder-policy/coep-on-response-from-service-worker.https-expected.txt:
     20        * web-platform-tests/html/cross-origin-embedder-policy/none-sw-from-none.https-expected.txt:
     21        * web-platform-tests/html/cross-origin-embedder-policy/none-sw-from-require-corp.https-expected.txt:
     22        * web-platform-tests/html/cross-origin-embedder-policy/require-corp-sw-from-none.https-expected.txt:
     23        * web-platform-tests/html/cross-origin-embedder-policy/require-corp-sw-from-require-corp.https-expected.txt:
     24        * web-platform-tests/html/semantics/scripting-1/the-script-element/css-module/credentials.sub-expected.txt:
     25        * web-platform-tests/html/semantics/scripting-1/the-script-element/json-module/credentials.sub-expected.txt:
     26        * web-platform-tests/html/semantics/scripting-1/the-script-element/module/credentials.sub-expected.txt:
     27        * web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/dynamic-imports-credentials-setTimeout.sub-expected.txt:
     28        * web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/dynamic-imports-credentials.sub-expected.txt:
     29        * web-platform-tests/html/semantics/scripting-1/the-script-element/module/integrity-expected.txt:
     30        * web-platform-tests/service-workers/service-worker/fetch-event-referrer-policy.https-expected.txt:
     31        * web-platform-tests/service-workers/service-worker/import-scripts-cross-origin.https-expected.txt:
     32        * web-platform-tests/service-workers/service-worker/redirected-response.https-expected.txt:
     33        * web-platform-tests/wasm/jsapi/table/constructor-reftypes.tentative.any.worker-expected.txt:
     34        * web-platform-tests/wasm/jsapi/table/grow-reftypes.tentative.any.worker-expected.txt:
     35        * web-platform-tests/wasm/jsapi/table/set-reftypes.tentative.any.worker-expected.txt:
     36
    1372021-08-12  Alex Christensen  <achristensen@webkit.org>
    238

  • trunk/LayoutTests/imported/w3c/web-platform-tests/FileAPI/url/url-with-fetch.any-expected.txt

    r270269 r281012  
    1313PASS fetch with method "CUSTOM" should fail
    1414PASS fetch should return Content-Type from Blob
    15 FAIL Revoke blob URL after creating Request, will fetch promise_test: Unhandled rejection with value: object "TypeError: The operation couldn’t be completed. (WebKitBlobResource error 1.)"
     15FAIL Revoke blob URL after creating Request, will fetch promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1616PASS Revoke blob URL after calling fetch, fetch should succeed
    1717

  • trunk/LayoutTests/imported/w3c/web-platform-tests/FileAPI/url/url-with-fetch.any.worker-expected.txt

    r270269 r281012  
    1313PASS fetch with method "CUSTOM" should fail
    1414PASS fetch should return Content-Type from Blob
    15 FAIL Revoke blob URL after creating Request, will fetch promise_test: Unhandled rejection with value: object "TypeError: The operation couldn’t be completed. (WebKitBlobResource error 1.)"
     15FAIL Revoke blob URL after creating Request, will fetch promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1616PASS Revoke blob URL after calling fetch, fetch should succeed
    1717

  • trunk/LayoutTests/imported/w3c/web-platform-tests/clipboard-apis/async-navigator-clipboard-basics.https-expected.txt

    r267651 r281012  
    1212PASS navigator.clipboard.writeText(DOMString) succeeds
    1313PASS navigator.clipboard.writeText() fails (expect DOMString)
    14 FAIL navigator.clipboard.write({string : image/png Blob}) succeeds promise_test: Unhandled rejection with value: object "TypeError: Not allowed to request resource"
     14FAIL navigator.clipboard.write({string : image/png Blob}) succeeds promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1515PASS navigator.clipboard.read() succeeds
    1616PASS navigator.clipboard.readText() succeeds

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inside-worker/dedicatedworker-report-only-expected.txt

    r279838 r281012  
    55PASS Same-origin 'fetch()'.
    66PASS Same-origin XHR.
    7 FAIL Cross-origin 'fetch()'. promise_test: Unhandled rejection with value: object "TypeError: Type error"
     7FAIL Cross-origin 'fetch()'. promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    88FAIL Cross-origin XHR. promise_test: Unhandled rejection with value: "xhr.open should not have thrown."
    9 FAIL Same-origin => cross-origin 'fetch()'. promise_test: Unhandled rejection with value: object "TypeError: cancelled"
     9FAIL Same-origin => cross-origin 'fetch()'. promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1010FAIL connect-src-self-report-only assert_array_equals: Reports do not match lengths differ, expected array ["http://localhost:8800/common/redirect-opt-in.py?status=307&location=https://www.localhost:9444/content-security-policy/support/resource.py?cross-origin-fetch", "https://www.localhost:9444/content-security-policy/support/resource.py?cross-origin-fetch", "https://www.localhost:9444/content-security-policy/support/resource.py?cross-origin-xhr"] length 3, got [] length 0
    1111

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inside-worker/serviceworker-report-only.https.sub-expected.txt

    r279838 r281012  
    22PASS serviceworker-report-only
    33PASS Same-origin 'fetch()'.
    4 FAIL Cross-origin 'fetch()'. promise_test: Unhandled rejection with value: object "TypeError: A server with the specified hostname could not be found."
    5 FAIL Same-origin => cross-origin 'fetch()'. promise_test: Unhandled rejection with value: object "TypeError: A server with the specified hostname could not be found."
     4FAIL Cross-origin 'fetch()'. promise_test: Unhandled rejection with value: object "TypeError: Load failed"
     5FAIL Same-origin => cross-origin 'fetch()'. promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    66FAIL connect-src-self-report-only assert_array_equals: Reports do not match lengths differ, expected array ["https://localhost:9443/common/redirect-opt-in.py?status=307&location=https://www.localhost:9444/content-security-policy/support/resource.py?cross-origin-fetch", "https://www.localhost:9444/content-security-policy/support/resource.py?cross-origin-fetch"] length 2, got [] length 0
    77

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/cors-cookies.any.worker-expected.txt

    r267651 r281012  
    66PASS Include mode: remote cookies are not sent with local request
    77PASS Same-origin mode: cookies are discarded in cors request
    8 FAIL Include mode: remote cookies are not sent with other remote request promise_test: Unhandled rejection with value: object "TypeError: Type error"
     8FAIL Include mode: remote cookies are not sent with other remote request promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    99

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/policies/referrer-origin-when-cross-origin-service-worker.https-expected.txt

    r267651 r281012  
    11
    22PASS Fetch in service worker: referrer with origin-when-cross-origin policy
    3 FAIL Request's referrer is origin promise_test: Unhandled rejection with value: object "TypeError: Not allowed to request resource"
     3FAIL Request's referrer is origin promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    44

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/http-cache/cc-request.any-expected.txt

    r279344 r281012  
    1111PASS HTTP cache validates fresh response with ETag when request contains Cache-Control: no-cache
    1212FAIL HTTP cache doesn't reuse fresh response when request contains Cache-Control: no-store assert_equals: Response 2 comes from cache expected 2 but got 1
    13 FAIL HTTP cache generates 504 status code when nothing is in cache and request contains Cache-Control: only-if-cached promise_test: Unhandled rejection with value: object "TypeError: can’t load from network"
     13FAIL HTTP cache generates 504 status code when nothing is in cache and request contains Cache-Control: only-if-cached promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1414

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/http-cache/cc-request.any.worker-expected.txt

    r279344 r281012  
    1111PASS HTTP cache validates fresh response with ETag when request contains Cache-Control: no-cache
    1212FAIL HTTP cache doesn't reuse fresh response when request contains Cache-Control: no-store assert_equals: Response 2 comes from cache expected 2 but got 1
    13 FAIL HTTP cache generates 504 status code when nothing is in cache and request contains Cache-Control: only-if-cached promise_test: Unhandled rejection with value: object "TypeError: can’t load from network"
     13FAIL HTTP cache generates 504 status code when nothing is in cache and request contains Cache-Control: only-if-cached promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1414

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/coep-on-response-from-service-worker.https-expected.txt

    r280953 r281012  
    1 CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Cancelled load to https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt because it violates the resource's Cross-Origin-Resource-Policy response header.
     1CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Load failed
    22CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt.
    33CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/common/blank.html because it violates the resource's Cross-Origin-Resource-Policy response header.
    … …  
    77CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/common/blank.html?passthrough because it violates the resource's Cross-Origin-Resource-Policy response header.
    88CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/common/blank.html?passthrough due to access control checks.
    9 CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Origin https://localhost:9443 is not allowed by Access-Control-Allow-Origin.
     9CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Load failed
    1010CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/common/blank.html.
    1111

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/none-sw-from-none.https-expected.txt

    r279427 r281012  
    1 CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Cancelled load to https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt because it violates the resource's Cross-Origin-Resource-Policy response header.
     1CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Load failed
    22CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt.
    33CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt?passthrough because it violates the resource's Cross-Origin-Resource-Policy response header.
    44CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt?passthrough due to access control checks.
    5 CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Origin https://localhost:9443 is not allowed by Access-Control-Allow-Origin.
     5CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Load failed
    66CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/common/blank.html.
    77

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/none-sw-from-require-corp.https-expected.txt

    r280953 r281012  
    1 CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Cancelled load to https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt because it violates the resource's Cross-Origin-Resource-Policy response header.
     1CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Load failed
    22CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt.
    33CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/common/blank.html because it violates the resource's Cross-Origin-Resource-Policy response header.
    … …  
    77CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/common/blank.html?passthrough because it violates the resource's Cross-Origin-Resource-Policy response header.
    88CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/common/blank.html?passthrough due to access control checks.
    9 CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Origin https://localhost:9443 is not allowed by Access-Control-Allow-Origin.
     9CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Load failed
    1010CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/common/blank.html.
    1111

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-sw-from-none.https-expected.txt

    r280953 r281012  
    1 CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Cancelled load to https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt because it violates the resource's Cross-Origin-Resource-Policy response header.
     1CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Load failed
    22CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt.
    3 CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Cancelled load to https://127.0.0.1:9443/common/blank.html because it violates the resource's Cross-Origin-Resource-Policy response header.
     3CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Load failed
    44CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/common/blank.html.
    55CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt?passthrough because it violates the resource's Cross-Origin-Resource-Policy response header.
    66CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt?passthrough due to access control checks.
    7 CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Origin https://localhost:9443 is not allowed by Access-Control-Allow-Origin.
     7CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Load failed
    88CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/common/blank.html.
    99

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-sw-from-require-corp.https-expected.txt

    r280953 r281012  
    1 CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Cancelled load to https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt because it violates the resource's Cross-Origin-Resource-Policy response header.
     1CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Load failed
    22CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt.
    3 CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Cancelled load to https://127.0.0.1:9443/common/blank.html because it violates the resource's Cross-Origin-Resource-Policy response header.
     3CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Load failed
    44CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/common/blank.html.
    55CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/nothing-same-origin-corp.txt?passthrough because it violates the resource's Cross-Origin-Resource-Policy response header.
    … …  
    77CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/common/blank.html?passthrough because it violates the resource's Cross-Origin-Resource-Policy response header.
    88CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/common/blank.html?passthrough due to access control checks.
    9 CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Origin https://localhost:9443 is not allowed by Access-Control-Allow-Origin.
     9CONSOLE MESSAGE: FetchEvent.respondWith received an error: TypeError: Load failed
    1010CONSOLE MESSAGE: Fetch API cannot load https://127.0.0.1:9443/common/blank.html.
    1111

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/css-module/credentials.sub-expected.txt

    r279427 r281012  
    22CONSOLE MESSAGE: Fetch API cannot load http://www2.localhost:8800/cookies/resources/set-cookie.py?name=milk&path=/html/semantics/scripting-1/the-script-element/css-module/ due to access control checks.
    33
    4 FAIL CSS Modules should be loaded with or without the credentials based on the same-origin-ness and the crossOrigin attribute promise_test: Unhandled rejection with value: object "TypeError: Type error"
     4FAIL CSS Modules should be loaded with or without the credentials based on the same-origin-ness and the crossOrigin attribute promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    55

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/json-module/credentials.sub-expected.txt

    r279427 r281012  
    22CONSOLE MESSAGE: Fetch API cannot load http://www2.localhost:8800/cookies/resources/set-cookie.py?name=milk&path=/html/semantics/scripting-1/the-script-element/json-module/ due to access control checks.
    33
    4 FAIL JSON Modules should be loaded with or without the credentials based on the same-origin-ness and the crossOrigin attribute promise_test: Unhandled rejection with value: object "TypeError: Type error"
     4FAIL JSON Modules should be loaded with or without the credentials based on the same-origin-ness and the crossOrigin attribute promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    55

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/credentials.sub-expected.txt

    r259900 r281012  
    22CONSOLE MESSAGE: Fetch API cannot load http://www2.localhost:8800/cookies/resources/set-cookie.py?name=cross&path=/html/semantics/scripting-1/the-script-element/module/ due to access control checks.
    33
    4 FAIL Modules should be loaded with or without the credentials based on the same-origin-ness and the crossOrigin attribute promise_test: Unhandled rejection with value: object "TypeError: Type error"
     4FAIL Modules should be loaded with or without the credentials based on the same-origin-ness and the crossOrigin attribute promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    55

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/dynamic-imports-credentials-setTimeout.sub-expected.txt

    r269598 r281012  
    11Blocked access to external URL http://www2.localhost:8800/cookies/resources/set-cookie.py?name=cross&path=/html/semantics/scripting-1/the-script-element/module/
    22CONSOLE MESSAGE: Fetch API cannot load http://www2.localhost:8800/cookies/resources/set-cookie.py?name=cross&path=/html/semantics/scripting-1/the-script-element/module/ due to access control checks.
    3 CONSOLE MESSAGE: Unhandled Promise Rejection: TypeError: Type error
     3CONSOLE MESSAGE: Unhandled Promise Rejection: TypeError: Load failed
    44
    5 Harness Error (FAIL), message = Unhandled rejection: Type error
     5Harness Error (FAIL), message = Unhandled rejection: Load failed
    66
    77

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/dynamic-import/dynamic-imports-credentials.sub-expected.txt

    r269598 r281012  
    11Blocked access to external URL http://www2.localhost:8800/cookies/resources/set-cookie.py?name=cross&path=/html/semantics/scripting-1/the-script-element/module/
    22CONSOLE MESSAGE: Fetch API cannot load http://www2.localhost:8800/cookies/resources/set-cookie.py?name=cross&path=/html/semantics/scripting-1/the-script-element/module/ due to access control checks.
    3 CONSOLE MESSAGE: Unhandled Promise Rejection: TypeError: Type error
     3CONSOLE MESSAGE: Unhandled Promise Rejection: TypeError: Load failed
    44
    5 Harness Error (FAIL), message = Unhandled rejection: Type error
     5Harness Error (FAIL), message = Unhandled rejection: Load failed
    66
    77

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/module/integrity-expected.txt

    r267646 r281012  
    1 CONSOLE MESSAGE: TypeError: Cannot load script http://localhost:8800/html/semantics/scripting-1/the-script-element/module/integrity-mismatches.js. Failed integrity metadata check. Content length: 93, Expected content length: -1, Expected metadata: sha384-doesnotmatch
     1CONSOLE MESSAGE: TypeError: Cannot load script due to integrity mismatch
    22
    33PASS The integrity attribute must have no affect on inline module scripts

  • trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/fetch-event-referrer-policy.https-expected.txt

    r280081 r281012  
    11
    22
    3 FAIL Service Worker responds to fetch event with the referrer policy promise_test: Unhandled rejection with value: object "TypeError: Not allowed to request resource"
     3FAIL Service Worker responds to fetch event with the referrer policy promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    44PASS Service Worker should respond to fetch with the default referrer policy
    55PASS Service Worker should respond to fetch with the referrer URL when a member of RequestInit is present - Default Referrer

  • trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/import-scripts-cross-origin.https-expected.txt

    r279389 r281012  
    11
    2 FAIL importScripts() supports cross-origin requests promise_test: Unhandled rejection with value: object "TypeError: NetworkError: A server with the specified hostname could not be found."
     2FAIL importScripts() supports cross-origin requests promise_test: Unhandled rejection with value: object "TypeError: NetworkError: Load failed"
    33

  • trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/redirected-response.https-expected.txt

    r279389 r281012  
    2020PASS mode: "follow", generated relative redirect response
    2121PASS mode: "error", generated relative redirect response
    22 FAIL mode: "manual", generated relative redirect response promise_test: Unhandled rejection with value: object "TypeError: The URL can’t be shown"
     22FAIL mode: "manual", generated relative redirect response promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    2323PASS Fetch should follow the redirect response 20 times
    2424PASS Fetch should not follow the redirect response 21 times.

  • trunk/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/table/constructor-reftypes.tentative.any.worker-expected.txt

    r271774 r281012  
    1 CONSOLE MESSAGE: NetworkError: Response is not 2xx
     1CONSOLE MESSAGE: NetworkError: Load failed
    22
    3 Harness Error (FAIL), message = NetworkError: Response is not 2xx
     3Harness Error (FAIL), message = NetworkError: Load failed
    44
    55

  • trunk/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/table/grow-reftypes.tentative.any.worker-expected.txt

    r260690 r281012  
    1 CONSOLE MESSAGE: NetworkError: Response is not 2xx
     1CONSOLE MESSAGE: NetworkError: Load failed
    22
    3 Harness Error (FAIL), message = NetworkError: Response is not 2xx
     3Harness Error (FAIL), message = NetworkError: Load failed
    44
    55

  • trunk/LayoutTests/imported/w3c/web-platform-tests/wasm/jsapi/table/set-reftypes.tentative.any.worker-expected.txt

    r271774 r281012  
    1 CONSOLE MESSAGE: NetworkError: Response is not 2xx
     1CONSOLE MESSAGE: NetworkError: Load failed
    22
    3 Harness Error (FAIL), message = NetworkError: Response is not 2xx
     3Harness Error (FAIL), message = NetworkError: Load failed
    44
    55

  • trunk/LayoutTests/js/dom/modules/module-fetch-failure-not-cached-expected.txt

    r267644 r281012  
    1 CONSOLE MESSAGE: TypeError: Cannot load script module-fetch-failure-not-cached.js. Failed integrity metadata check. Content length: 30, Expected content length: 30, Expected metadata: sha256-badbeef
     1CONSOLE MESSAGE: TypeError: Cannot load script due to integrity mismatch
    22
    33PASS Module fetch failure is not cached in module pipeline

  • trunk/LayoutTests/platform/mac-wk1/http/tests/security/contentSecurityPolicy/worker-blob-inherits-csp-importScripts-redirect-cross-origin-blocked-expected.txt

    r232032 r281012  
    11This tests that the Content Security Policy of the parent origin (this page) blocks a Web Worker from importing a script from a different origin, not listed in script-src, through a redirect.
    22
    3 PASS threw exception NetworkError: Blocked by Content Security Policy..
     3PASS threw exception NetworkError: Load failed.

  • trunk/LayoutTests/platform/mac-wk1/http/tests/security/contentSecurityPolicy/worker-csp-importScripts-redirect-cross-origin-blocked-expected.txt

    r232032 r281012  
    11This tests a Web Worker with Content Security Policy "script-src 'self'" blocks the import of a script from a different origin through a redirect.
    22
    3 PASS threw exception NetworkError: Blocked by Content Security Policy..
     3PASS threw exception NetworkError: Load failed.

  • trunk/LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/FileAPI/url/url-with-fetch.any-expected.txt

    r270269 r281012  
    1313PASS fetch with method "CUSTOM" should fail
    1414PASS fetch should return Content-Type from Blob
    15 FAIL Revoke blob URL after creating Request, will fetch promise_test: Unhandled rejection with value: object "TypeError: Type error"
     15FAIL Revoke blob URL after creating Request, will fetch promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1616PASS Revoke blob URL after calling fetch, fetch should succeed
    1717

  • trunk/LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/FileAPI/url/url-with-fetch.any.worker-expected.txt

    r270269 r281012  
    1313PASS fetch with method "CUSTOM" should fail
    1414PASS fetch should return Content-Type from Blob
    15 FAIL Revoke blob URL after creating Request, will fetch promise_test: Unhandled rejection with value: object "TypeError: Type error"
     15FAIL Revoke blob URL after creating Request, will fetch promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1616PASS Revoke blob URL after calling fetch, fetch should succeed
    1717

  • trunk/LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/clipboard-apis/async-navigator-clipboard-basics.https-expected.txt

    r264544 r281012  
    1212FAIL navigator.clipboard.writeText(DOMString) succeeds promise_test: Unhandled rejection with value: object "TypeError: undefined is not an object (evaluating 'navigator.clipboard.writeText')"
    1313FAIL navigator.clipboard.writeText() fails (expect DOMString) promise_test: Unhandled rejection with value: object "TypeError: undefined is not an object (evaluating 'navigator.clipboard.writeText')"
    14 FAIL navigator.clipboard.write({string : image/png Blob}) succeeds promise_test: Unhandled rejection with value: object "TypeError: Not allowed to request resource"
     14FAIL navigator.clipboard.write({string : image/png Blob}) succeeds promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1515FAIL navigator.clipboard.read() succeeds promise_test: Unhandled rejection with value: object "TypeError: undefined is not an object (evaluating 'navigator.clipboard.read')"
    1616FAIL navigator.clipboard.readText() succeeds promise_test: Unhandled rejection with value: object "TypeError: undefined is not an object (evaluating 'navigator.clipboard.readText')"

  • trunk/LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/content-security-policy/inside-worker/dedicatedworker-report-only-expected.txt

    r279838 r281012  
    55PASS Same-origin 'fetch()'.
    66PASS Same-origin XHR.
    7 FAIL Cross-origin 'fetch()'. promise_test: Unhandled rejection with value: object "TypeError: Type error"
     7FAIL Cross-origin 'fetch()'. promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    88FAIL Cross-origin XHR. promise_test: Unhandled rejection with value: "xhr.open should not have thrown."
    9 FAIL Same-origin => cross-origin 'fetch()'. promise_test: Unhandled rejection with value: object "TypeError: Type error"
     9FAIL Same-origin => cross-origin 'fetch()'. promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1010FAIL connect-src-self-report-only assert_array_equals: Reports do not match lengths differ, expected array ["http://localhost:8800/common/redirect-opt-in.py?status=307&location=https://www.localhost:9444/content-security-policy/support/resource.py?cross-origin-fetch", "https://www.localhost:9444/content-security-policy/support/resource.py?cross-origin-fetch", "https://www.localhost:9444/content-security-policy/support/resource.py?cross-origin-xhr"] length 3, got [] length 0
    1111

  • trunk/LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/fetch/api/request/request-cache-only-if-cached.any-expected.txt

    r279344 r281012  
    66PASS RequestCache "only-if-cached" mode checks the cache for previously cached content and does not go to the network if a cached response is not found with Etag and fresh response
    77PASS RequestCache "only-if-cached" mode checks the cache for previously cached content and does not go to the network if a cached response is not found with Last-Modified and fresh response
    8 FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Etag and fresh response promise_test: Unhandled rejection with value: object "TypeError: resource unavailable"
    9 FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Last-Modified and fresh response promise_test: Unhandled rejection with value: object "TypeError: resource unavailable"
    10 FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Etag and stale response promise_test: Unhandled rejection with value: object "TypeError: resource unavailable"
    11 FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Last-Modified and stale response promise_test: Unhandled rejection with value: object "TypeError: resource unavailable"
     8FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Etag and fresh response promise_test: Unhandled rejection with value: object "TypeError: Load failed"
     9FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Last-Modified and fresh response promise_test: Unhandled rejection with value: object "TypeError: Load failed"
     10FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Etag and stale response promise_test: Unhandled rejection with value: object "TypeError: Load failed"
     11FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Last-Modified and stale response promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1212PASS RequestCache "only-if-cached" (with "same-origin") does not follow redirects across origins and rejects with Etag and fresh response
    1313PASS RequestCache "only-if-cached" (with "same-origin") does not follow redirects across origins and rejects with Last-Modified and fresh response

  • trunk/LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/fetch/api/request/request-cache-only-if-cached.any.worker-expected.txt

    r279344 r281012  
    66PASS RequestCache "only-if-cached" mode checks the cache for previously cached content and does not go to the network if a cached response is not found with Etag and fresh response
    77PASS RequestCache "only-if-cached" mode checks the cache for previously cached content and does not go to the network if a cached response is not found with Last-Modified and fresh response
    8 FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Etag and fresh response promise_test: Unhandled rejection with value: object "TypeError: resource unavailable"
    9 FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Last-Modified and fresh response promise_test: Unhandled rejection with value: object "TypeError: resource unavailable"
    10 FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Etag and stale response promise_test: Unhandled rejection with value: object "TypeError: resource unavailable"
    11 FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Last-Modified and stale response promise_test: Unhandled rejection with value: object "TypeError: resource unavailable"
     8FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Etag and fresh response promise_test: Unhandled rejection with value: object "TypeError: Load failed"
     9FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Last-Modified and fresh response promise_test: Unhandled rejection with value: object "TypeError: Load failed"
     10FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Etag and stale response promise_test: Unhandled rejection with value: object "TypeError: Load failed"
     11FAIL RequestCache "only-if-cached" (with "same-origin") uses cached same-origin redirects to same-origin content with Last-Modified and stale response promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1212PASS RequestCache "only-if-cached" (with "same-origin") does not follow redirects across origins and rejects with Etag and fresh response
    1313PASS RequestCache "only-if-cached" (with "same-origin") does not follow redirects across origins and rejects with Last-Modified and fresh response

  • trunk/LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/fetch/http-cache/cc-request.any-expected.txt

    r279344 r281012  
    1111PASS HTTP cache validates fresh response with ETag when request contains Cache-Control: no-cache
    1212PASS HTTP cache doesn't reuse fresh response when request contains Cache-Control: no-store
    13 FAIL HTTP cache generates 504 status code when nothing is in cache and request contains Cache-Control: only-if-cached promise_test: Unhandled rejection with value: object "TypeError: can’t load from network"
     13FAIL HTTP cache generates 504 status code when nothing is in cache and request contains Cache-Control: only-if-cached promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1414

  • trunk/LayoutTests/platform/mac-wk1/imported/w3c/web-platform-tests/fetch/http-cache/cc-request.any.worker-expected.txt

    r279344 r281012  
    1111PASS HTTP cache validates fresh response with ETag when request contains Cache-Control: no-cache
    1212PASS HTTP cache doesn't reuse fresh response when request contains Cache-Control: no-store
    13 FAIL HTTP cache generates 504 status code when nothing is in cache and request contains Cache-Control: only-if-cached promise_test: Unhandled rejection with value: object "TypeError: can’t load from network"
     13FAIL HTTP cache generates 504 status code when nothing is in cache and request contains Cache-Control: only-if-cached promise_test: Unhandled rejection with value: object "TypeError: Load failed"
    1414

  • trunk/Source/WebCore/ChangeLog

    r281011 r281012  
     12021-08-13  Youenn Fablet  <youenn@apple.com>
     2
     3        Overly verbose catchable fetch error messages lead to cross-origin leaks
     4        https://bugs.webkit.org/show_bug.cgi?id=228861
     5
     6        Reviewed by Brent Fulgham.
     7
     8        Standardize error messages to get more uniform with other browsers.
     9        To continue supporting service worker errors going to page errors,
     10        we add a boolean to ResourceError to control whether sanitizing the error message or not.
     11        This allows to keep error messages from service worker type exceptions to be exposed in window environments through fetch rejection.
     12        Also handle ScriptModuleLoader since it is doing its own SRI checks.
     13        Covered by rebased tests.
     14
     15        * Modules/fetch/FetchBodyOwner.cpp:
     16        (WebCore::FetchBodyOwner::loadingException const):
     17        * Modules/fetch/FetchResponse.cpp:
     18        (WebCore::FetchResponse::BodyLoader::didFail):
     19        * platform/network/ResourceErrorBase.h:
     20        (WebCore::ResourceErrorBase::sanitizedDescription const):
     21        (WebCore::ResourceErrorBase::isSanitized const):
     22        (WebCore::ResourceErrorBase::setAsSanitized):
     23        (WebCore::ResourceErrorBase::ResourceErrorBase):
     24        * platform/network/cf/ResourceError.h:
     25        (WebCore::ResourceError::ResourceError):
     26        * platform/network/curl/ResourceError.h:
     27        (WebCore::ResourceError::ResourceError):
     28        * platform/network/soup/ResourceError.h:
     29        (WebCore::ResourceError::ResourceError):
     30        * workers/WorkerScriptLoader.cpp:
     31        (WebCore::WorkerScriptLoader::loadSynchronously):
     32        * workers/service/FetchEvent.cpp:
     33        (WebCore::FetchEvent::createResponseError):
     34        (WebCore::FetchEvent::respondWith):
     35        (WebCore::FetchEvent::promiseIsSettled):
     36        * workers/service/FetchEvent.h:
     37        * workers/service/context/ServiceWorkerFetch.cpp:
     38        (WebCore::ServiceWorkerFetch::processResponse):
     39        (WebCore::ServiceWorkerFetch::dispatchFetchEvent):
     40        * bindings/js/ScriptModuleLoader.cpp:
     41        (WebCore::ScriptModuleLoader::notifyFinished):
     42
    1432021-08-13  Sergio Villar Senin  <svillar@igalia.com>
    244

  • trunk/Source/WebCore/Modules/fetch/FetchBodyOwner.cpp

    r280046 r281012  
    390390{
    391391    return WTF::switchOn(m_loadingError, [](const ResourceError& error) {
    392         return Exception { TypeError, error.localizedDescription().isEmpty() ? "Loading failed"_s : error.localizedDescription() };
     392        return Exception { TypeError, error.sanitizedDescription() };
    393393    }, [](const Exception& exception) {
    394394        return Exception { exception };

  • trunk/Source/WebCore/Modules/fetch/FetchResponse.cpp

    r278714 r281012  
    299299
    300300    if (auto responseCallback = WTFMove(m_responseCallback))
    301         responseCallback(Exception { TypeError, error.localizedDescription() });
     301        responseCallback(Exception { TypeError, error.sanitizedDescription() });
    302302
    303303    if (auto consumeDataCallback = WTFMove(m_consumeDataCallback))
    304         consumeDataCallback(Exception { TypeError, error.localizedDescription() });
     304        consumeDataCallback(Exception { TypeError, error.sanitizedDescription() });
    305305
    306306    if (m_response.m_readableStreamSource) {

  • trunk/Source/WebCore/bindings/js/ScriptModuleLoader.cpp

    r279178 r281012  
    402402        if (auto* parameters = loader.parameters()) {
    403403            if (!matchIntegrityMetadata(cachedScript, parameters->integrity())) {
    404                 promise->reject(TypeError, makeString("Cannot load script ", integrityMismatchDescription(cachedScript, parameters->integrity())));
     404                promise->reject(TypeError, "Cannot load script due to integrity mismatch"_s);
    405405                return;
    406406            }

  • trunk/Source/WebCore/platform/network/ResourceErrorBase.h

    r264021 r281012  
    4848    const String& localizedDescription() const { lazyInit(); return m_localizedDescription; }
    4949
     50    String sanitizedDescription() const { return m_isSanitized  == IsSanitized::Yes ? m_localizedDescription : "Load failed"_s; }
     51
    5052    enum class Type : uint8_t {
    5153        Null,
    … …  
    5557        Timeout
    5658    };
     59    enum class IsSanitized : bool { No, Yes };
    5760
    5861    bool isNull() const { return m_type == Type::Null; }
    … …  
    6770    Type type() const { return m_type; }
    6871
     72    bool isSanitized() const { return m_isSanitized == IsSanitized::Yes; }
     73    void setAsSanitized() { m_isSanitized = IsSanitized::Yes; }
     74
    6975protected:
    7076    ResourceErrorBase(Type type) : m_type(type) { }
    7177
    72     ResourceErrorBase(const String& domain, int errorCode, const URL& failingURL, const String& localizedDescription, Type type)
     78    ResourceErrorBase(const String& domain, int errorCode, const URL& failingURL, const String& localizedDescription, Type type, IsSanitized isSanitized)
    7379        : m_domain(domain)
    7480        , m_failingURL(failingURL)
    … …  
    7682        , m_errorCode(errorCode)
    7783        , m_type(type)
     84        , m_isSanitized(isSanitized)
    7885    {
    7986    }
    … …  
    9299    int m_errorCode { 0 };
    93100    Type m_type { Type::General };
     101    IsSanitized m_isSanitized { IsSanitized::No };
    94102
    95103private:

  • trunk/Source/WebCore/platform/network/cf/ResourceError.h

    r238298 r281012  
    5151    }
    5252
    53     ResourceError(const String& domain, int errorCode, const URL& failingURL, const String& localizedDescription, Type type = Type::General)
    54         : ResourceErrorBase(domain, errorCode, failingURL, localizedDescription, type)
     53    ResourceError(const String& domain, int errorCode, const URL& failingURL, const String& localizedDescription, Type type = Type::General, IsSanitized isSanitized = IsSanitized::No)
     54        : ResourceErrorBase(domain, errorCode, failingURL, localizedDescription, type, isSanitized)
    5555        , m_dataIsUpToDate(true)
    5656    {

  • trunk/Source/WebCore/platform/network/curl/ResourceError.h

    r233481 r281012  
    4040    }
    4141
    42     ResourceError(const String& domain, int errorCode, const URL& failingURL, const String& localizedDescription, Type type = Type::General)
    43         : ResourceErrorBase(domain, errorCode, failingURL, localizedDescription, type)
     42    ResourceError(const String& domain, int errorCode, const URL& failingURL, const String& localizedDescription, Type type = Type::General, IsSanitized isSanitized = IsSanitized::No)
     43        : ResourceErrorBase(domain, errorCode, failingURL, localizedDescription, type, isSanitized)
    4444    {
    4545    }

  • trunk/Source/WebCore/platform/network/soup/ResourceError.h

    r272010 r281012  
    4444    }
    4545
    46     ResourceError(const String& domain, int errorCode, const URL& failingURL, const String& localizedDescription, Type type = Type::General)
    47         : ResourceErrorBase(domain, errorCode, failingURL, localizedDescription, type)
     46    ResourceError(const String& domain, int errorCode, const URL& failingURL, const String& localizedDescription, Type type = Type::General, IsSanitized isSanitized = IsSanitized::No)
     47        : ResourceErrorBase(domain, errorCode, failingURL, localizedDescription, type, isSanitized)
    4848    {
    4949    }

  • trunk/Source/WebCore/workers/WorkerScriptLoader.cpp

    r280953 r281012  
    100100    // If the fetching attempt failed, throw a NetworkError exception and abort all these steps.
    101101    if (failed())
    102         return Exception { NetworkError, error().localizedDescription() };
     102        return Exception { NetworkError, m_error.sanitizedDescription() };
    103103
    104104#if ENABLE(SERVICE_WORKER)

  • trunk/Source/WebCore/workers/service/FetchEvent.cpp

    r278274 r281012  
    6262}
    6363
    64 ResourceError FetchEvent::createResponseError(const URL& url, const String& errorMessage)
     64ResourceError FetchEvent::createResponseError(const URL& url, const String& errorMessage, ResourceError::IsSanitized isSanitized)
    6565{
    66     return ResourceError { errorDomainWebKitServiceWorker, 0, url, makeString("FetchEvent.respondWith received an error: ", errorMessage), ResourceError::Type::General };
     66    return ResourceError { errorDomainWebKitServiceWorker, 0, url, makeString("FetchEvent.respondWith received an error: ", errorMessage), ResourceError::Type::General, isSanitized };
    6767
    6868}
    … …  
    9090
    9191    if (isRegistered == DOMPromise::IsCallbackRegistered::No)
    92         respondWithError(createResponseError(m_request->url(), "FetchEvent unable to handle respondWith promise."_s));
     92        respondWithError(createResponseError(m_request->url(), "FetchEvent unable to handle respondWith promise."_s, ResourceError::IsSanitized::Yes));
    9393
    9494    return { };
    … …  
    119119    if (m_respondPromise->status() == DOMPromise::Status::Rejected) {
    120120        auto reason = m_respondPromise->result().toWTFString(m_respondPromise->globalObject());
    121         respondWithError(createResponseError(m_request->url(), reason));
     121        respondWithError(createResponseError(m_request->url(), reason, ResourceError::IsSanitized::Yes));
    122122        return;
    123123    }
    … …  
    126126    auto response = JSFetchResponse::toWrapped(m_respondPromise->globalObject()->vm(), m_respondPromise->result());
    127127    if (!response) {
    128         respondWithError(createResponseError(m_request->url(), "Returned response is null."_s));
     128        respondWithError(createResponseError(m_request->url(), "Returned response is null."_s, ResourceError::IsSanitized::Yes));
    129129        return;
    130130    }
    131131
    132132    if (response->isDisturbedOrLocked()) {
    133         respondWithError(createResponseError(m_request->url(), "Response is disturbed or locked."_s));
     133        respondWithError(createResponseError(m_request->url(), "Response is disturbed or locked."_s, ResourceError::IsSanitized::Yes));
    134134        return;
    135135    }

  • trunk/Source/WebCore/workers/service/FetchEvent.h

    r278274 r281012  
    7070    bool respondWithEntered() const { return m_respondWithEntered; }
    7171
    72     static ResourceError createResponseError(const URL&, const String&);
     72    static ResourceError createResponseError(const URL&, const String&, ResourceError::IsSanitized = ResourceError::IsSanitized::No);
    7373
    7474private:

  • trunk/Source/WebCore/workers/service/context/ServiceWorkerFetch.cpp

    r278714 r281012  
    5050{
    5151    if (response.type() == ResourceResponse::Type::Error)
    52         return ResourceError { errorDomainWebKitInternal, 0, response.url(), "Response served by service worker is an error"_s, ResourceError::Type::General };
     52        return ResourceError { errorDomainWebKitInternal, 0, response.url(), "Response served by service worker is an error"_s, ResourceError::Type::General, ResourceError::IsSanitized::Yes };
    5353
    5454    if (mode != FetchOptions::Mode::NoCors && response.tainting() == ResourceResponse::Tainting::Opaque)
    55         return ResourceError { errorDomainWebKitInternal, 0, response.url(), "Response served by service worker is opaque"_s, ResourceError::Type::AccessControl };
     55        return ResourceError { errorDomainWebKitInternal, 0, response.url(), "Response served by service worker is opaque"_s, ResourceError::Type::AccessControl, ResourceError::IsSanitized::Yes };
    5656
    5757    // Navigate mode induces manual redirect.
    5858    if (redirect != FetchOptions::Redirect::Manual && mode != FetchOptions::Mode::Navigate && response.tainting() == ResourceResponse::Tainting::Opaqueredirect)
    59         return ResourceError { errorDomainWebKitInternal, 0, response.url(), "Response served by service worker is opaque redirect"_s, ResourceError::Type::AccessControl };
     59        return ResourceError { errorDomainWebKitInternal, 0, response.url(), "Response served by service worker is opaque redirect"_s, ResourceError::Type::AccessControl, ResourceError::IsSanitized::Yes };
    6060
    6161    if ((redirect != FetchOptions::Redirect::Follow || mode == FetchOptions::Mode::Navigate) && response.isRedirected())
    62         return ResourceError { errorDomainWebKitInternal, 0, response.url(), "Response served by service worker has redirections"_s, ResourceError::Type::AccessControl };
     62        return ResourceError { errorDomainWebKitInternal, 0, response.url(), "Response served by service worker has redirections"_s, ResourceError::Type::AccessControl, ResourceError::IsSanitized::Yes };
    6363
    6464    return { };
    … …  
    116116        response->consumeBodyReceivedByChunk([client = WTFMove(client)] (auto&& result) mutable {
    117117            if (result.hasException()) {
    118                 client->didFail(FetchEvent::createResponseError(URL { }, result.exception().message()));
     118                auto error = FetchEvent::createResponseError(URL { }, result.exception().message(), ResourceError::IsSanitized::Yes);
     119                client->didFail(error);
    119120                return;
    120121            }
    … …  
    189190    if (!event->respondWithEntered()) {
    190191        if (event->defaultPrevented()) {
    191             client->didFail(ResourceError { errorDomainWebKitInternal, 0, requestURL, "Fetch event was canceled"_s });
     192            ResourceError error { errorDomainWebKitInternal, 0, requestURL, "Fetch event was canceled"_s, ResourceError::Type::General, ResourceError::IsSanitized::Yes };
     193            client->didFail(error);
    192194            return;
    193195        }

  • trunk/Source/WebKit/ChangeLog

    r281007 r281012  
     12021-08-13  Youenn Fablet  <youenn@apple.com>
     2
     3        Overly verbose catchable fetch error messages lead to cross-origin leaks
     4        https://bugs.webkit.org/show_bug.cgi?id=228861
     5
     6        Reviewed by Brent Fulgham.
     7
     8        * Shared/WebCoreArgumentCoders.cpp:
     9        (IPC::ArgumentCoder<ResourceError>::encode):
     10        (IPC::ArgumentCoder<ResourceError>::decode):
     11
    1122021-08-12  Peng Liu  <peng.liu6@apple.com>
    213

  • trunk/Source/WebKit/Shared/WebCoreArgumentCoders.cpp

    r279872 r281012  
    12981298        return;
    12991299    encodePlatformData(encoder, resourceError);
     1300    encoder << resourceError.isSanitized();
    13001301}
    13011302
    … …  
    13141315        return false;
    13151316
     1317    bool isSanitized;
     1318    if (!decoder.decode(isSanitized))
     1319        return false;
     1320
    13161321    resourceError.setType(type);
     1322    if (isSanitized)
     1323        resourceError.setAsSanitized();
     1324
    13171325    return true;
    13181326}
Note: See TracChangeset for help on using the changeset viewer.