Changeset 279602 in webkit


Ignore:
Timestamp:
Jul 6, 2021 12:02:03 PM (13 months ago)
Author:
youenn@apple.com
Message:

Unable to use 'data:application/javascript' url for Worker
​https://bugs.webkit.org/show_bug.cgi?id=225716
<rdar://problem/78222538>

Reviewed by Alex Christensen.

LayoutTests/imported/w3c:

  • web-platform-tests/fetch/api/cors/data-url-worker-expected.txt:
  • web-platform-tests/html/cross-origin-embedder-policy/cross-origin-isolated-permission.https-expected.txt:
  • web-platform-tests/html/webappapis/the-windoworworkerglobalscope-mixin/Worker_Self_Origin-expected.txt:
  • web-platform-tests/service-workers/service-worker/local-url-inherit-controller.https-expected.txt:
  • web-platform-tests/workers/Worker_script_mimetype-expected.txt:
  • web-platform-tests/workers/constructors/Worker/same-origin-expected.txt:
  • web-platform-tests/workers/data-url-expected.txt:
  • web-platform-tests/workers/dedicated-worker-in-data-url-context.window-expected.txt:
  • web-platform-tests/workers/modules/dedicated-worker-import-data-url-cross-origin-expected.txt:
  • web-platform-tests/workers/modules/dedicated-worker-import-data-url.any-expected.txt:

Source/WebCore:

As per ​https://fetch.spec.whatwg.org/#main-fetch step 11, same origin fetch for data URL should succeed.
Update AbstractWorker to let such URLs trigger loads and update WorkerScriptLoader to enable those loads.

Covered by rebased tests.

  • workers/AbstractWorker.cpp:

(WebCore::AbstractWorker::resolveURL):

  • workers/WorkerScriptLoader.cpp:

(WebCore::WorkerScriptLoader::loadAsynchronously):

LayoutTests:

Some tests are showing progress but are timing out. Skipping them for now.

Location:
trunk
Files:
16 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r279586 r279602  
     12021-07-06  Youenn Fablet  <youenn@apple.com>
     2
     3        Unable to use 'data:application/javascript' url for Worker
     4        https://bugs.webkit.org/show_bug.cgi?id=225716
     5        <rdar://problem/78222538>
     6
     7        Reviewed by Alex Christensen.
     8
     9        * TestExpectations:
     10        Some tests are showing progress but are timing out. Skipping them for now.
     11
    1122021-07-06  Eric Hutchison  <ehutchison@apple.com>
    213

  • trunk/LayoutTests/TestExpectations

    r279585 r279602  
    551551[ Debug ] imported/w3c/web-platform-tests/css/css-properties-values-api/registered-property-revert.html [ Skip ]
    552552[ Debug ] imported/w3c/web-platform-tests/css/css-scoping/slotted-matches.html [ Skip ]
     553
     554# Timing out tests
     555imported/w3c/web-platform-tests/workers/modules/dedicated-worker-import-data-url.any.html [ Skip ]
     556imported/w3c/web-platform-tests/workers/modules/dedicated-worker-import-data-url-cross-origin.html [ Skip ]
    553557
    554558# Newly imported WPT ref tests failures.

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r279585 r279602  
     12021-07-06  Youenn Fablet  <youenn@apple.com>
     2
     3        Unable to use 'data:application/javascript' url for Worker
     4        https://bugs.webkit.org/show_bug.cgi?id=225716
     5        <rdar://problem/78222538>
     6
     7        Reviewed by Alex Christensen.
     8
     9        * web-platform-tests/fetch/api/cors/data-url-worker-expected.txt:
     10        * web-platform-tests/html/cross-origin-embedder-policy/cross-origin-isolated-permission.https-expected.txt:
     11        * web-platform-tests/html/webappapis/the-windoworworkerglobalscope-mixin/Worker_Self_Origin-expected.txt:
     12        * web-platform-tests/service-workers/service-worker/local-url-inherit-controller.https-expected.txt:
     13        * web-platform-tests/workers/Worker_script_mimetype-expected.txt:
     14        * web-platform-tests/workers/constructors/Worker/same-origin-expected.txt:
     15        * web-platform-tests/workers/data-url-expected.txt:
     16        * web-platform-tests/workers/dedicated-worker-in-data-url-context.window-expected.txt:
     17        * web-platform-tests/workers/modules/dedicated-worker-import-data-url-cross-origin-expected.txt:
     18        * web-platform-tests/workers/modules/dedicated-worker-import-data-url.any-expected.txt:
     19
    1202021-07-06  Chris Dumez  <cdumez@apple.com>
    221

  • trunk/LayoutTests/imported/w3c/web-platform-tests/fetch/api/cors/data-url-worker-expected.txt

    r264144 r279602  
    11
    2 FAIL fetching "top.txt" without ACAO should be rejected. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    3 FAIL fetching "top.txt" with CORS allowing null origin should be allowed. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    4 FAIL fetching data url script should be allowed. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
     2PASS fetching "top.txt" without ACAO should be rejected.
     3PASS fetching "top.txt" with CORS allowing null origin should be allowed.
     4PASS fetching data url script should be allowed.
    55

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/cross-origin-isolated-permission.https-expected.txt

    r279427 r279602  
    1212FAIL dedicated worker: scheme = https, value = self assert_equals: expected (boolean) true but got (undefined) undefined
    1313FAIL dedicated worker: scheme = https, value = (\) assert_equals: expected (boolean) false but got (undefined) undefined
    14 FAIL dedicated worker: scheme = data, value = undefined The operation is insecure.
    15 FAIL dedicated worker: scheme = data, value = * The operation is insecure.
    16 FAIL dedicated worker: scheme = data, value = self The operation is insecure.
    17 FAIL dedicated worker: scheme = data, value = (\) The operation is insecure.
     14FAIL dedicated worker: scheme = data, value = undefined assert_equals: expected (boolean) false but got (undefined) undefined
     15FAIL dedicated worker: scheme = data, value = * assert_equals: expected (boolean) false but got (undefined) undefined
     16FAIL dedicated worker: scheme = data, value = self assert_equals: expected (boolean) false but got (undefined) undefined
     17FAIL dedicated worker: scheme = data, value = (\) assert_equals: expected (boolean) false but got (undefined) undefined
    1818FAIL dedicated worker: scheme = blob, value = undefined assert_equals: expected (boolean) true but got (undefined) undefined
    1919FAIL dedicated worker: scheme = blob, value = * assert_equals: expected (boolean) true but got (undefined) undefined

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/webappapis/the-windoworworkerglobalscope-mixin/Worker_Self_Origin-expected.txt

    r267646 r279602  
    22PASS Same Origin Worker
    33FAIL Same Origin SharedWorker Can't find variable: SharedWorker
    4 FAIL Data Url Worker The operation is insecure.
     4PASS Data Url Worker
    55FAIL Data Url SharedWorker Can't find variable: SharedWorker
    66PASS Blob Url Worker

  • trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/local-url-inherit-controller.https-expected.txt

    r267647 r279602  
    55PASS Same-origin blob URL worker should intercept fetch().
    66PASS Data URL iframe should not intercept fetch().
    7 FAIL Data URL worker should not inherit service worker controller. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    8 FAIL Data URL worker should not intercept fetch(). promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
     7FAIL Data URL worker should not inherit service worker controller. promise_test: Unhandled rejection with value: "Error: Script error."
     8FAIL Data URL worker should not intercept fetch(). assert_equals: data URL worker should not intercept fetch expected "" but got "intercepted"
    99

  • trunk/LayoutTests/imported/w3c/web-platform-tests/workers/Worker_script_mimetype-expected.txt

    r279425 r279602  
    33PASS blob: URLs should load, despite no MIME type for the backing Blob
    44PASS blob: URLs should load, despite the wrong MIME type for the backing Blob
    5 FAIL data: URLs should load, despite the wrong MIME type The operation is insecure.
     5PASS data: URLs should load, despite the wrong MIME type
    66

  • trunk/LayoutTests/imported/w3c/web-platform-tests/workers/constructors/Worker/same-origin-expected.txt

    r273203 r279602  
    11
    22PASS unsupported_scheme
    3 FAIL data_url The operation is insecure.
     3PASS data_url
    44PASS about_blank
    55PASS example_invalid

  • trunk/LayoutTests/imported/w3c/web-platform-tests/workers/data-url-expected.txt

    r230445 r279602  
    11
    2 FAIL application/javascript MIME allowed The operation is insecure.
    3 FAIL text/plain MIME allowed The operation is insecure.
    4 FAIL empty MIME allowed The operation is insecure.
    5 FAIL communication goes both ways The operation is insecure.
    6 FAIL indexedDB is present The operation is insecure.
    7 FAIL indexedDB is inaccessible The operation is insecure.
    8 FAIL cross-origin worker The operation is insecure.
    9 FAIL worker has opaque origin The operation is insecure.
    10 FAIL invalid javascript produces error The operation is insecure.
     2PASS application/javascript MIME allowed
     3PASS text/plain MIME allowed
     4PASS empty MIME allowed
     5PASS communication goes both ways
     6PASS indexedDB is present
     7PASS indexedDB is inaccessible
     8PASS cross-origin worker
     9PASS worker has opaque origin
     10PASS invalid javascript produces error
    1111

  • trunk/LayoutTests/imported/w3c/web-platform-tests/workers/dedicated-worker-in-data-url-context.window-expected.txt

    r267649 r279602  
    1 CONSOLE MESSAGE: SecurityError: The operation is insecure.
    2 
    3 Harness Error (TIMEOUT), message = null
     1CONSOLE MESSAGE: Error: Script error.
    42
    53FAIL Create a dedicated worker in a data url frame assert_equals: expected "PASS" but got "Worker construction unexpectedly synchronously failed"
    6 FAIL Create a dedicated worker in a data url dedicated worker promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    7 TIMEOUT Create a data url dedicated worker in a data url frame Test timed out
    8 NOTRUN Create a data url dedicated worker in a data url dedicated worker
     4FAIL Create a dedicated worker in a data url dedicated worker assert_equals: expected "PASS" but got "Worker construction unexpectedly synchronously failed"
     5PASS Create a data url dedicated worker in a data url frame
     6FAIL Create a data url dedicated worker in a data url dedicated worker promise_test: Unhandled rejection with value: "Error: Script error."
    97

  • trunk/LayoutTests/imported/w3c/web-platform-tests/workers/modules/dedicated-worker-import-data-url-cross-origin-expected.txt

    r279425 r279602  
     1CONSOLE MESSAGE: Origin null is not allowed by Access-Control-Allow-Origin.
     2CONSOLE MESSAGE: Importing a module script failed.
    13
    2 FAIL static import data url from data: URL should be allowed. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    3 FAIL static import script from data: URL should be allowed. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    4 FAIL dynamic import data url from data: URL should be allowed. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    5 FAIL dynamic import script from data: URL should be blocked. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
     4Harness Error (FAIL), message = Script error.
    65
     6PASS static import data url from data: URL should be allowed.
     7TIMEOUT static import script from data: URL should be allowed. Test timed out
     8NOTRUN dynamic import data url from data: URL should be allowed.
     9NOTRUN dynamic import script from data: URL should be blocked.
     10

  • trunk/LayoutTests/imported/w3c/web-platform-tests/workers/modules/dedicated-worker-import-data-url.any-expected.txt

    r279425 r279602  
     1Blocked access to external URL https://www1.localhost:9443/workers/modules/resources/export-on-load-script.py
     2CONSOLE MESSAGE: Importing a module script failed.
    13
    2 FAIL Static import. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    3 FAIL Static import (cross-origin). promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    4 FAIL Static import (redirect). promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    5 FAIL Nested static import. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    6 FAIL Static import and then dynamic import. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    7 FAIL Dynamic import. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    8 FAIL Nested dynamic import. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    9 FAIL Dynamic import and then static import. promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
    10 FAIL eval(import()). promise_test: Unhandled rejection with value: object "SecurityError: The operation is insecure."
     4Harness Error (FAIL), message = Script error.
    115
     6PASS Static import.
     7TIMEOUT Static import (cross-origin). Test timed out
     8NOTRUN Static import (redirect).
     9NOTRUN Nested static import.
     10NOTRUN Static import and then dynamic import.
     11NOTRUN Dynamic import.
     12NOTRUN Nested dynamic import.
     13NOTRUN Dynamic import and then static import.
     14NOTRUN eval(import()).
     15

  • trunk/Source/WebCore/ChangeLog

    r279595 r279602  
     12021-07-06  Youenn Fablet  <youenn@apple.com>
     2
     3        Unable to use 'data:application/javascript' url for Worker
     4        https://bugs.webkit.org/show_bug.cgi?id=225716
     5        <rdar://problem/78222538>
     6
     7        Reviewed by Alex Christensen.
     8
     9        As per https://fetch.spec.whatwg.org/#main-fetch step 11, same origin fetch for data URL should succeed.
     10        Update AbstractWorker to let such URLs trigger loads and update WorkerScriptLoader to enable those loads.
     11
     12        Covered by rebased tests.
     13
     14        * workers/AbstractWorker.cpp:
     15        (WebCore::AbstractWorker::resolveURL):
     16        * workers/WorkerScriptLoader.cpp:
     17        (WebCore::WorkerScriptLoader::loadAsynchronously):
     18
    1192021-07-06  Alex Christensen  <achristensen@webkit.org>
    220

  • trunk/Source/WebCore/workers/AbstractWorker.cpp

    r278520 r279602  
    5050        return Exception { SyntaxError };
    5151
    52     if (!context.securityOrigin()->canRequest(scriptURL))
     52    if (!context.securityOrigin()->canRequest(scriptURL) && !scriptURL.protocolIsData())
    5353        return Exception { SecurityError };
    5454

  • trunk/Source/WebCore/workers/WorkerScriptLoader.cpp

    r278516 r279602  
    131131
    132132    // FIXME: We should drop the sameOriginDataURLFlag flag and implement the latest Fetch specification.
    133     if (fetchOptions.destination != FetchOptions::Destination::Worker)
    134         options.sameOriginDataURLFlag = SameOriginDataURLFlag::Set;
     133    options.sameOriginDataURLFlag = SameOriginDataURLFlag::Set;
    135134
    136135    // A service worker job can be executed from a worker context or a document context.
Note: See TracChangeset for help on using the changeset viewer.