Changeset 292595 in webkit


Ignore:
Timestamp:
Apr 8, 2022 1:30:55 AM (3 months ago)
Author:
commit-queue@webkit.org
Message:

Incorrect CORP/COEP check in 304 responses
​https://bugs.webkit.org/show_bug.cgi?id=238238
<rdar://problem/90706510>

Patch by Carlos Garcia Campos <​cgarcia@igalia.com> on 2022-04-08
Reviewed by Youenn Fablet.

LayoutTests/imported/w3c:

Sync cross-origin-embedder-policy tests to include the new test require-corp-revalidated-images.https.html.

  • web-platform-tests/html/cross-origin-embedder-policy/block-local-documents-inheriting-none.https.html:
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache-storage.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache-storage.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache-storage.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache.tentative.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/dedicated-worker.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/dedicated-worker.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/dedicated-worker.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/fetch.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/fetch.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/fetch.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-credentialless.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-credentialless.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-credentialless.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-none.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-none.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-none.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-require-corp.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-require-corp.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-require-corp.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe.tentative.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/image.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/image.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/image.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/link.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/link.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/link.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/redirect.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/redirect.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/redirect.tentative.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-navigation.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-navigation.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-navigation.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-subresource-corp.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-subresource-corp.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-subresource-corp.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/script.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/script.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/script.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-credentialless-proxy.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-credentialless-proxy.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-credentialless-proxy.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-none-proxy.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-none-proxy.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-none-proxy.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/shared-worker.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/shared-worker.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/shared-worker.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.https.window.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.tentative.https.window.js.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.https.window.js.headers: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.tentative.https.window.js.headers.
  • web-platform-tests/html/cross-origin-embedder-policy/credentialless/w3c-import.log:
  • web-platform-tests/html/cross-origin-embedder-policy/dedicated-worker.https-expected.txt:
  • web-platform-tests/html/cross-origin-embedder-policy/dedicated-worker.https.html:
  • web-platform-tests/html/cross-origin-embedder-policy/reporting-to-endpoint.https.html:
  • web-platform-tests/html/cross-origin-embedder-policy/reporting-to-endpoint.https.html.headers:
  • web-platform-tests/html/cross-origin-embedder-policy/require-corp-cached-images.https-expected.txt:
  • web-platform-tests/html/cross-origin-embedder-policy/require-corp-cached-images.https.html:
  • web-platform-tests/html/cross-origin-embedder-policy/require-corp-revalidated-images.https-expected.txt: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/require-corp-revalidated-images.https.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/resources/corp-image.py:

(main):

  • web-platform-tests/html/cross-origin-embedder-policy/resources/fetch-and-create-url.html: Added.
  • web-platform-tests/html/cross-origin-embedder-policy/resources/load-corp-images.html:
  • web-platform-tests/html/cross-origin-embedder-policy/resources/w3c-import.log:
  • web-platform-tests/html/cross-origin-embedder-policy/resources/worker-support.js: Added.

(setCoep):
(resolveUrl):
(async withIframe):
(waitForMessage):
(async createLocalUrl):

  • web-platform-tests/html/cross-origin-embedder-policy/shared-workers.https-expected.txt:
  • web-platform-tests/html/cross-origin-embedder-policy/shared-workers.https.html:
  • web-platform-tests/html/cross-origin-embedder-policy/w3c-import.log:

Source/WebKit:

Add CORP header to the 304 response if previously set to avoid being blocked by load checker due to COEP.

Test: imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-revalidated-images.https.html

  • NetworkProcess/NetworkResourceLoader.cpp:

(WebKit::NetworkResourceLoader::didReceiveResponse):

LayoutTests:

Mark some tests with DumpJSConsoleLogInStdErr modifier.

Location:
trunk
Files:
23 added
19 edited
20 moved

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r292571 r292595  
     12022-04-08  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        Incorrect CORP/COEP check in 304 responses
     4        https://bugs.webkit.org/show_bug.cgi?id=238238
     5        <rdar://problem/90706510>
     6
     7        Reviewed by Youenn Fablet.
     8
     9        Mark some tests with DumpJSConsoleLogInStdErr modifier.
     10
     11        * TestExpectations:
     12
    1132022-04-07  Matteo Flores  <matteo_flores@apple.com>
    214

  • trunk/LayoutTests/TestExpectations

    r292532 r292595  
    438438imported/w3c/web-platform-tests/html/browsers/sandboxing/sandbox-disallow-popups.html [ DumpJSConsoleLogInStdErr ]
    439439imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/blob.https.html [ DumpJSConsoleLogInStdErr ]
     440imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-cached-images.https.html [ DumpJSConsoleLogInStdErr ]
     441imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-revalidated-images.https.html [ DumpJSConsoleLogInStdErr ]
    440442imported/w3c/web-platform-tests/html/cross-origin-opener-policy/coop-csp-sandbox.https.html [ DumpJSConsoleLogInStdErr ]
    441443imported/w3c/web-platform-tests/html/cross-origin-opener-policy/coop-navigated-history-popup.https.html [ DumpJSConsoleLogInStdErr ]

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r292592 r292595  
     12022-04-08  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        Incorrect CORP/COEP check in 304 responses
     4        https://bugs.webkit.org/show_bug.cgi?id=238238
     5        <rdar://problem/90706510>
     6
     7        Reviewed by Youenn Fablet.
     8
     9        Sync cross-origin-embedder-policy tests to include the new test require-corp-revalidated-images.https.html.
     10
     11        * web-platform-tests/html/cross-origin-embedder-policy/block-local-documents-inheriting-none.https.html:
     12        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache-storage.https.window.html: Added.
     13        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache-storage.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache-storage.tentative.https.window.js.
     14        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache.window.html: Added.
     15        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache.tentative.window.js.
     16        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/dedicated-worker.https.window.html: Added.
     17        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/dedicated-worker.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/dedicated-worker.tentative.https.window.js.
     18        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/fetch.https.window.html: Added.
     19        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/fetch.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/fetch.tentative.https.window.js.
     20        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-credentialless.https.window.html: Added.
     21        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-credentialless.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-credentialless.tentative.https.window.js.
     22        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-none.https.window.html: Added.
     23        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-none.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-none.tentative.https.window.js.
     24        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-require-corp.https.window.html: Added.
     25        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-require-corp.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-require-corp.tentative.https.window.js.
     26        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe.window.html: Added.
     27        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe.tentative.window.js.
     28        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/image.https.window.html: Added.
     29        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/image.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/image.tentative.https.window.js.
     30        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/link.https.window.html: Added.
     31        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/link.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/link.tentative.https.window.js.
     32        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/redirect.window.html: Added.
     33        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/redirect.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/redirect.tentative.window.js.
     34        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-navigation.https.window.html: Added.
     35        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-navigation.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-navigation.tentative.https.window.js.
     36        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-subresource-corp.https.window.html: Added.
     37        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-subresource-corp.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-subresource-corp.tentative.https.window.js.
     38        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/script.https.window.html: Added.
     39        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/script.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/script.tentative.https.window.js.
     40        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-credentialless-proxy.https.window.html: Added.
     41        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-credentialless-proxy.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-credentialless-proxy.tentative.https.window.js.
     42        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-none-proxy.https.window.html: Added.
     43        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-none-proxy.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-none-proxy.tentative.https.window.js.
     44        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker.https.window.html: Added.
     45        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker.tentative.https.window.js.
     46        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/shared-worker.https.window.html: Added.
     47        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/shared-worker.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/shared-worker.tentative.https.window.js.
     48        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.https.window.html: Added.
     49        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.https.window.js: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.tentative.https.window.js.
     50        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.https.window.js.headers: Renamed from LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.tentative.https.window.js.headers.
     51        * web-platform-tests/html/cross-origin-embedder-policy/credentialless/w3c-import.log:
     52        * web-platform-tests/html/cross-origin-embedder-policy/dedicated-worker.https-expected.txt:
     53        * web-platform-tests/html/cross-origin-embedder-policy/dedicated-worker.https.html:
     54        * web-platform-tests/html/cross-origin-embedder-policy/reporting-to-endpoint.https.html:
     55        * web-platform-tests/html/cross-origin-embedder-policy/reporting-to-endpoint.https.html.headers:
     56        * web-platform-tests/html/cross-origin-embedder-policy/require-corp-cached-images.https-expected.txt:
     57        * web-platform-tests/html/cross-origin-embedder-policy/require-corp-cached-images.https.html:
     58        * web-platform-tests/html/cross-origin-embedder-policy/require-corp-revalidated-images.https-expected.txt: Added.
     59        * web-platform-tests/html/cross-origin-embedder-policy/require-corp-revalidated-images.https.html: Added.
     60        * web-platform-tests/html/cross-origin-embedder-policy/resources/corp-image.py:
     61        (main):
     62        * web-platform-tests/html/cross-origin-embedder-policy/resources/fetch-and-create-url.html: Added.
     63        * web-platform-tests/html/cross-origin-embedder-policy/resources/load-corp-images.html:
     64        * web-platform-tests/html/cross-origin-embedder-policy/resources/w3c-import.log:
     65        * web-platform-tests/html/cross-origin-embedder-policy/resources/worker-support.js: Added.
     66        (setCoep):
     67        (resolveUrl):
     68        (async withIframe):
     69        (waitForMessage):
     70        (async createLocalUrl):
     71        * web-platform-tests/html/cross-origin-embedder-policy/shared-workers.https-expected.txt:
     72        * web-platform-tests/html/cross-origin-embedder-policy/shared-workers.https.html:
     73        * web-platform-tests/html/cross-origin-embedder-policy/w3c-import.log:
     74
    1752022-04-07  Antti Koivisto  <antti@apple.com>
    276

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/block-local-documents-inheriting-none.https.html

    r287846 r292595  
    33<script src="/resources/testharness.js"></script>
    44<script src="/resources/testharnessreport.js"></script>
    5 <script src="/common/dispatcher/dispatcher.js"></script>
    65<script src="/common/get-host-info.sub.js"></script>
    76<script src="/common/utils.js"></script>
    … …  
    5958  // This initial navigation is required because it uses the parent frame as the
    6059  // initiator. That is first_iframe is the initiator, while we want top to be
    61   // the initiator for this test, which will be done in step 3 with a second
     60  // the initiator for this test, which will be done in step 4 with a second
    6261  // navigation from that blank.html document to the local scheme one.
    6362  const nested_frames = {};
    … …  
    7574  await Promise.all(nested_frames_promises);
    7675
    77   // 3. Navigate nested frames to a local scheme document.
     76  // 3. Navigate a dummy frame. This is required because some browsers (Chrome)
     77  // might consider the first navigation in 4. as a redirect otherwise.
     78  const dummy_Frame = document.createElement("iframe");
     79  t.add_cleanup( () => dummy_Frame.remove() );
     80  dummy_Frame.src = "/common/blank.html";
     81  iframe_load_promise = new Promise( resolve => dummy_Frame.addEventListener("load", resolve) );
     82  document.body.append(dummy_Frame);
     83  await iframe_load_promise;
     84
     85  // 4. Navigate nested frames to a local scheme document.
    7886  // COEP should be inherited from the initiator or blobURL's creator (top in both
    7987  // cases), this results in COEP being none and the documents not being allowed
    … …  
    8896  });
    8997
    90   // 4. Wait and validate reports.
     98  // 5. Wait and validate reports.
    9199  const reports = await reportPromise;
    92100  assert_equals(reports.length, test_cases.length);
    … …  
    100108  // Also verify that no message was sent by the nested frames and stored in
    101109  // received_events.
    102   assert_equals([], received_events.sort());
     110  assert_equals(received_events.length, 0);
    103111}, "Prevent local scheme documents from loading within a COEP: require-corp iframe if they inherit COEP: none");
    104112</script>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/w3c-import.log

    r285346 r292595  
    1717/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/META.yml
    1818/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/README.md
    19 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache-storage.tentative.https.window.js
    20 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache.tentative.window.js
     19/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache-storage.https.window.js
     20/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/cache.window.js
    2121/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/cross-origin-isolated.window.js
    22 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/dedicated-worker.tentative.https.window.js
    23 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/fetch.tentative.https.window.js
    24 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-credentialless.tentative.https.window.js
    25 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-none.tentative.https.window.js
    26 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-require-corp.tentative.https.window.js
    27 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe.tentative.window.js
    28 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/image.tentative.https.window.js
    29 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/link.tentative.https.window.js
    30 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/redirect.tentative.window.js
    31 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-navigation.tentative.https.window.js
    32 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-subresource-corp.tentative.https.window.js
    33 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/script.tentative.https.window.js
    34 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-credentialless-proxy.tentative.https.window.js
    35 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-none-proxy.tentative.https.window.js
    36 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker.tentative.https.window.js
    37 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/shared-worker.tentative.https.window.js
    38 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.tentative.https.window.js
    39 /LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.tentative.https.window.js.headers
     22/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/dedicated-worker.https.window.js
     23/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/fetch.https.window.js
     24/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-credentialless.https.window.js
     25/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-none.https.window.js
     26/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe-coep-require-corp.https.window.js
     27/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/iframe.window.js
     28/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/image.https.window.js
     29/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/link.https.window.js
     30/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/redirect.window.js
     31/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-navigation.https.window.js
     32/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/reporting-subresource-corp.https.window.js
     33/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/script.https.window.js
     34/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-credentialless-proxy.https.window.js
     35/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker-coep-none-proxy.https.window.js
     36/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/service-worker.https.window.js
     37/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/shared-worker.https.window.js
     38/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.https.window.js
     39/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/credentialless/video.https.window.js.headers

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/dedicated-worker.https-expected.txt

    r280953 r292595  
    77CONSOLE MESSAGE: Worker load was blocked by Cross-Origin-Embedder-Policy
    88CONSOLE MESSAGE: Cannot load https://localhost:9443/html/cross-origin-embedder-policy/resources/dedicated-worker.js due to access control checks.
     9CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/common/blank.html because it violates the resource's Cross-Origin-Resource-Policy response header.
     10CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/common/blank.html because it violates the resource's Cross-Origin-Resource-Policy response header.
    911CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/common/blank.html because it violates the resource's Cross-Origin-Resource-Policy response header.
    1012CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/common/blank.html because it violates the resource's Cross-Origin-Resource-Policy response header.
    … …  
    1820PASS COEP: require-corp module worker in COEP: none frame
    1921PASS COEP: require-corp module worker in COEP: require-corp frame
     22PASS COEP: worker inherits COEP for blob URL.
     23PASS COEP: worker inherits COEP from blob URL creator, not owner.
     24FAIL COEP: worker inherits COEP for data URL. assert_equals: expected "FAILED" but got "LOADED"
     25PASS COEP: worker inherits COEP from owner, not data URL creator.
     26FAIL COEP: worker inherits COEP for filesystem URL. assert_equals: url creation error expected (undefined) undefined but got (string) "unimplemented"
     27FAIL COEP: worker inherits COEP from filesystem URL creator, not owner. assert_equals: url creation error expected (undefined) undefined but got (string) "unimplemented"
    2028

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/dedicated-worker.https.html

    r264117 r292595  
    44<script src=/resources/testharnessreport.js></script>
    55<script src="/common/get-host-info.sub.js"></script>
     6<script src="resources/worker-support.js"></script>
    67<body>
    78<script>
    8 const HOST = get_host_info();
    9 const FETCH_URL = `${HOST.REMOTE_ORIGIN}/common/blank.html`;
    10 const WORKER_URL = new URL('resources/dedicated-worker.js', location).href;
    11 const WITH_COEP = '?pipe=header(cross-origin-embedder-policy,require-corp)';
    12 
    13 async function createWorker(t, frameHasCoep, workerHasCoep, workerOptions) {
    14   const frame = document.createElement("iframe");
    15   t.add_cleanup(() => frame.remove());
    16   frame.src = '/common/blank.html';
    17   if (frameHasCoep) {
    18     frame.src += WITH_COEP;
    19   }
    20   document.body.append(frame);
    21 
    22   await new Promise(resolve => {
    23     frame.addEventListener('load', resolve, {once: true})
    24   });
    25   const worker = new frame.contentWindow.Worker(
    26     workerHasCoep ? WORKER_URL + WITH_COEP : WORKER_URL, workerOptions);
    27 
    28   return worker;
     9
     10const targetUrl = resolveUrl("/common/blank.html", {
     11    host: get_host_info().REMOTE_HOST,
     12}).href;
     13
     14function workerUrl(options) {
     15  return resolveUrl("resources/dedicated-worker.js", options);
    2916}
    3017
    31 function waitForMessage(target) {
    32   return new Promise(resolve => {
    33     target.addEventListener('message', resolve, {once: true});
    34   });
     18async function createWorker(t, url, options) {
     19  const { ownerCoep, workerOptions } = options || {};
     20
     21  const frameUrl = resolveUrl("/common/blank.html", {
     22    coep: ownerCoep,
     23  });
     24  const frame = await withIframe(t, frameUrl);
     25
     26  return new frame.contentWindow.Worker(url, workerOptions);
    3527}
    3628
    3729promise_test(async (t) => {
    38   const worker = await createWorker(t, false, false, {});
    39   worker.onerror = t.unreached_func('Worker.onerror should not be called');
    40 
    41   worker.postMessage(FETCH_URL);
     30  const worker = await createWorker(t, workerUrl());
     31  worker.onerror = t.unreached_func('Worker.onerror should not be called');
     32
     33  worker.postMessage(targetUrl);
    4234
    4335  const result = await waitForMessage(worker);
    … …  
    4638
    4739promise_test(async (t) => {
    48   const worker = await createWorker(t, true, false, {});
     40  const worker = await createWorker(t, workerUrl(), {
     41    ownerCoep: "require-corp",
     42  });
    4943  await new Promise(resolve => {
    5044    worker.onerror = resolve;
    … …  
    5347
    5448promise_test(async (t) => {
    55   const worker = await createWorker(t, false, true, {});
    56   worker.onerror = t.unreached_func('Worker.onerror should not be called');
    57 
    58   worker.postMessage(FETCH_URL);
     49  const worker = await createWorker(t, workerUrl({ coep: "require-corp" }));
     50  worker.onerror = t.unreached_func('Worker.onerror should not be called');
     51
     52  worker.postMessage(targetUrl);
    5953
    6054  const result = await waitForMessage(worker);
    … …  
    6357
    6458promise_test(async (t) => {
    65   const worker = await createWorker(t, true, true, {});
    66   worker.onerror = t.unreached_func('Worker.onerror should not be called');
    67 
    68   worker.postMessage(FETCH_URL);
     59  const worker = await createWorker(t, workerUrl({ coep: "require-corp" }), {
     60    ownerCoep: "require-corp",
     61  });
     62  worker.onerror = t.unreached_func('Worker.onerror should not be called');
     63
     64  worker.postMessage(targetUrl);
    6965
    7066  const result = await waitForMessage(worker);
    … …  
    7369
    7470promise_test(async (t) => {
    75   const worker = await createWorker(t, false, false, {type: 'module'});
    76   worker.onerror = t.unreached_func('Worker.onerror should not be called');
    77 
    78   worker.postMessage(FETCH_URL);
     71  const worker = await createWorker(t, workerUrl(), {
     72    workerOptions: { type: 'module' },
     73  });
     74  worker.onerror = t.unreached_func('Worker.onerror should not be called');
     75
     76  worker.postMessage(targetUrl);
    7977
    8078  const result = await waitForMessage(worker);
    … …  
    8381
    8482promise_test(async (t) => {
    85   const worker = await createWorker(t, true, false, {type: 'module'});
     83  const worker = await createWorker(t, workerUrl(), {
     84    ownerCoep: "require-corp",
     85    workerOptions: { type: 'module' },
     86  });
    8687  await new Promise(resolve => {
    8788    worker.onerror = resolve;
    … …  
    9091
    9192promise_test(async (t) => {
    92   const worker = await createWorker(t, false, true, {type: 'module'});
    93   worker.onerror = t.unreached_func('Worker.onerror should not be called');
    94 
    95   worker.postMessage(FETCH_URL);
     93  const worker = await createWorker(t, workerUrl({ coep: "require-corp" }), {
     94    workerOptions: { type: 'module' },
     95  });
     96  worker.onerror = t.unreached_func('Worker.onerror should not be called');
     97
     98  worker.postMessage(targetUrl);
    9699
    97100  const result = await waitForMessage(worker);
    … …  
    100103
    101104promise_test(async (t) => {
    102   const worker = await createWorker(t, true, true, {type: 'module'});
    103   worker.onerror = t.unreached_func('Worker.onerror should not be called');
    104 
    105   worker.postMessage(FETCH_URL);
     105  const worker = await createWorker(t, workerUrl({ coep: "require-corp" }), {
     106    ownerCoep: "require-corp",
     107    workerOptions: { type: 'module' },
     108  });
     109  worker.onerror = t.unreached_func('Worker.onerror should not be called');
     110
     111  worker.postMessage(targetUrl);
    106112
    107113  const result = await waitForMessage(worker);
    108114  assert_equals(result.data, 'FAILED');
    109115}, 'COEP: require-corp module worker in COEP: require-corp frame');
     116
     117promise_test(async (t) => {
     118  const url = await createLocalUrl(t, {
     119    url: workerUrl(),
     120    creatorCoep: "require-corp",
     121    scheme: "blob",
     122  });
     123
     124  const worker = await createWorker(t, url, { ownerCoep: "require-corp" });
     125  worker.onerror = t.unreached_func('Worker.onerror should not be called');
     126
     127  worker.postMessage(targetUrl);
     128
     129  const result = await waitForMessage(worker);
     130  assert_equals(result.data, 'FAILED');
     131}, "COEP: worker inherits COEP for blob URL.");
     132
     133promise_test(async (t) => {
     134  const url = await createLocalUrl(t, {
     135    url: workerUrl(),
     136    creatorCoep: "require-corp",
     137    scheme: "blob",
     138  });
     139
     140  const worker = await createWorker(t, url);
     141  worker.onerror = t.unreached_func('Worker.onerror should not be called');
     142
     143  worker.postMessage(targetUrl);
     144
     145  const result = await waitForMessage(worker);
     146  assert_equals(result.data, 'FAILED');
     147}, "COEP: worker inherits COEP from blob URL creator, not owner.");
     148
     149promise_test(async (t) => {
     150  const url = await createLocalUrl(t, {
     151    url: workerUrl(),
     152    creatorCoep: "require-corp",
     153    scheme: "data",
     154  });
     155
     156  const worker = await createWorker(t, url, { ownerCoep: "require-corp" });
     157  worker.onerror = t.unreached_func('Worker.onerror should not be called');
     158
     159  worker.postMessage(targetUrl);
     160
     161  const result = await waitForMessage(worker);
     162  assert_equals(result.data, 'FAILED');
     163}, "COEP: worker inherits COEP for data URL.");
     164
     165promise_test(async (t) => {
     166  const url = await createLocalUrl(t, {
     167    url: workerUrl(),
     168    creatorCoep: "require-corp",
     169    scheme: "data",
     170  });
     171
     172  const worker = await createWorker(t, url);
     173  worker.onerror = t.unreached_func('Worker.onerror should not be called');
     174
     175  worker.postMessage(targetUrl);
     176
     177  const result = await waitForMessage(worker);
     178  assert_equals(result.data, 'LOADED');
     179}, "COEP: worker inherits COEP from owner, not data URL creator.");
     180
     181promise_test(async (t) => {
     182  const url = await createLocalUrl(t, {
     183    url: workerUrl(),
     184    creatorCoep: "require-corp",
     185    scheme: "filesystem",
     186  });
     187
     188  const worker = await createWorker(t, url, { ownerCoep: "require-corp" });
     189  worker.onerror = t.unreached_func('Worker.onerror should not be called');
     190
     191  worker.postMessage(targetUrl);
     192
     193  const result = await waitForMessage(worker);
     194  assert_equals(result.data, 'FAILED');
     195}, "COEP: worker inherits COEP for filesystem URL.");
     196
     197promise_test(async (t) => {
     198  const url = await createLocalUrl(t, {
     199    url: workerUrl(),
     200    creatorCoep: "require-corp",
     201    scheme: "filesystem",
     202  });
     203
     204  const worker = await createWorker(t, url);
     205  worker.onerror = t.unreached_func('Worker.onerror should not be called');
     206
     207  worker.postMessage(targetUrl);
     208
     209  const result = await waitForMessage(worker);
     210  assert_equals(result.data, 'FAILED');
     211}, "COEP: worker inherits COEP from filesystem URL creator, not owner.");
    110212
    111213</script>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/reporting-to-endpoint.https.html

    r281775 r292595  
    2020//  - cache-storage-reporting*.https.html
    2121// .
     22
    2223const { REMOTE_ORIGIN } = get_host_info();
    2324const BASE = new URL("resources", location).pathname
    … …  
    2829  '?pipe=header(cross-origin-embedder-policy,require-corp;report-to="endpoint")' +
    2930  `|header(cross-origin-embedder-policy-report-only,require-corp;report-to="report-only-endpoint")`;
     31const REPORT_UUID = "4d8b6d86-c9a8-47c1-871b-111169a8f79c";
     32const REPORT_ONLY_UUID = "5d7c1e33-ef88-43c2-9ca3-c67ff300b8c2";
    3033
    3134function wait(ms) {
    … …  
    103106  iframe.contentWindow.fetch(url, init).catch(() => {});
    104107
    105   await checkCorpReportExistence('endpoint', url, iframe.src, '', 'enforce');
    106   await checkCorpReportExistence(
    107       'report-only-endpoint', url, iframe.src, '', 'reporting');
     108  await checkCorpReportExistence(REPORT_UUID, url, iframe.src, '', 'enforce');
     109  await checkCorpReportExistence(
     110      REPORT_ONLY_UUID, url, iframe.src, '', 'reporting');
    108111}, 'subresource CORP');
    109112
    … …  
    132135
    133136  await checkCorpReportExistence(
    134       'endpoint', url, iframe.src, 'iframe', 'enforce');
    135   await checkCorpReportExistence(
    136       'report-only-endpoint', url, iframe.src, 'iframe', 'reporting');
     137      REPORT_UUID, url, iframe.src, 'iframe', 'enforce');
     138  await checkCorpReportExistence(
     139      REPORT_ONLY_UUID, url, iframe.src, 'iframe', 'reporting');
    137140}, 'navigation CORP');
    138141
    … …  
    153156
    154157  await checkNavigationReportExistence(
    155       'endpoint', targetUrl, iframe.src, 'enforce');
    156   await checkNavigationReportExistence(
    157     'report-only-endpoint', targetUrl, iframe.src, 'reporting');
     158      REPORT_UUID, targetUrl, iframe.src, 'enforce');
     159  await checkNavigationReportExistence(
     160      REPORT_ONLY_UUID, targetUrl, iframe.src, 'reporting');
    158161}, 'COEP violation on nested frame navigation');
    159162
    … …  
    175178
    176179  await checkNavigationReportExistence(
    177       'endpoint', targetUrl, iframe.src, 'enforce');
    178   await checkNavigationReportExistence(
    179     'report-only-endpoint', targetUrl, iframe.src, 'reporting');
     180      REPORT_UUID, targetUrl, iframe.src, 'enforce');
     181  await checkNavigationReportExistence(
     182      REPORT_ONLY_UUID, targetUrl, iframe.src, 'reporting');
    180183
    181184}, 'Two COEP headers, split inside report-to value');
    … …  
    199202
    200203  await checkCorpReportExistence(
    201       'endpoint', targetUrl, WORKER_URL, 'iframe', 'enforce');
    202   await checkCorpReportExistence(
    203       'report-only-endpoint', targetUrl, WORKER_URL, 'iframe', 'reporting');
     204      REPORT_UUID, targetUrl, WORKER_URL, 'iframe', 'enforce');
     205  await checkCorpReportExistence(
     206      REPORT_ONLY_UUID, targetUrl, WORKER_URL, 'iframe', 'reporting');
    204207}, 'Shared worker fetch');
    205208

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/reporting-to-endpoint.https.html.headers

    r282604 r292595  
    1 report-to: { "group": "endpoint", "max_age": 10886400, "endpoints": [{ "url": "/html/cross-origin-embedder-policy/resources/report.py?endpoint=endpoint" }] }, { "group": "report-only-endpoint", "max_age": 10886400, "endpoints": [{ "url": "/html/cross-origin-embedder-policy/resources/report.py?endpoint=report-only-endpoint" }] }
     1Reporting-Endpoints: endpoint="https://{{host}}:{{ports[https][0]}}//html/cross-origin-embedder-policy/resources/report.py?endpoint=4d8b6d86-c9a8-47c1-871b-111169a8f79c", report-only-endpoint="/html/cross-origin-embedder-policy/resources/report.py?endpoint=5d7c1e33-ef88-43c2-9ca3-c67ff300b8c2"

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-cached-images.https-expected.txt

    r284510 r292595  
    1 CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/corp-image.py because it violates the resource's Cross-Origin-Resource-Policy response header.
    2 CONSOLE MESSAGE: Cannot load image https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/corp-image.py due to access control checks.
    3 CONSOLE MESSAGE: Cancelled load to https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/corp-image.py because it violates the resource's Cross-Origin-Resource-Policy response header.
    4 CONSOLE MESSAGE: Cannot load image https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/corp-image.py due to access control checks.
    51
    62
    7 PASS NETWORK-https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/corp-image.py
    8 PASS NETWORK-https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/corp-image.py?corp-cross-origin=1
    9 PASS CACHED-https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/corp-image.py
    10 PASS CACHED-https://127.0.0.1:9443/html/cross-origin-embedder-policy/resources/corp-image.py?corp-cross-origin=1
     3PASS NETWORK - No CORP image
     4PASS NETWORK - CORP image
     5PASS CACHED - No CORP image
     6PASS CACHED - CORP image
    117PASS main_test
    128

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-cached-images.https.html

    r284510 r292595  
    55<script src="/resources/testharnessreport.js"></script>
    66<script src="/common/get-host-info.sub.js"></script>
     7<script src="/common/utils.js"></script>
    78<script>
    89
    … …  
    1314
    1415//
    15 // This test loads a same-orign iframe resources/load_corp_images.html with
     16// This test loads a same-origin iframe resources/load-corp-images.html with
    1617// Cross-Origin-Embedder-Policy: require-corp
    1718// The iframe loads two cross origin images, one with a
    … …  
    2324//
    2425
    25 const image_path = "/html/cross-origin-embedder-policy/resources/corp-image.py";
     26const RUNS = ["NETWORK", "CACHED"];
     27const RESOURCE_DESC = ["No CORP image", "CORP image"];
    2628
    2729let EXPECTED_LOADS = {
    28   [`NETWORK-${remote(image_path)}`]: false,
    29   [`NETWORK-${remote(image_path)}?corp-cross-origin=1`]: true,
    30   [`CACHED-${remote(image_path)}`]: false,
    31   [`CACHED-${remote(image_path)}?corp-cross-origin=1`]: true,
     30  [`${RUNS[0]} - ${RESOURCE_DESC[0]}`]: false,
     31  [`${RUNS[0]} - ${RESOURCE_DESC[1]}`]: true,
     32  [`${RUNS[1]} - ${RESOURCE_DESC[0]}`]: false,
     33  [`${RUNS[1]} - ${RESOURCE_DESC[1]}`]: true,
    3234}
    3335
    … …  
    3840
    3941window.addEventListener("load", async () => {
    40   let iframe = document.createElement("iframe");
    41   let firstRun = true;
    42   let t = async_test("main_test");
    43   await new Promise((resolve, reject) => {
    44     iframe.src = "resources/load-corp-images.html";
    45     iframe.onload = () => { resolve() };
    46     iframe.onerror = (e) => { reject(); };
    47     window.addEventListener("message", (event) => {
    48       // After the first done event we reload the iframe.
    49       if (event.data.done) {
    50         if (firstRun) {
    51           firstRun = false;
    52           iframe.contentWindow.location.reload();
    53         } else {
    54           // After the second done event the test is finished.
    55           t.done();
    56         }
     42  const t = async_test("main_test");
     43  const iframe = document.createElement("iframe");
     44  // The token attribute is used to ensure the resource has never been seen by
     45  // the HTTP cache. This can be useful if the cache isn't properly flushed in
     46  // between two tests.
     47  iframe.src = `resources/load-corp-images.html?revalidate=false&token=${token()}`;
     48  let runCount = 0;
     49  window.addEventListener("message", (event) => {
     50    // After the first done event we reload the iframe.
     51    if (event.data.done) {
     52      ++runCount;
     53      if (runCount < RUNS.length) {
     54        iframe.contentWindow.location.reload();
    5755      } else {
    58         // Check that each image either loads or doesn't based on the expectations
    59         let testName = `${firstRun ? "NETWORK-" : "CACHED-"}${event.data.src}`;
    60         let test = TESTS[testName];
    61         test.step(() => {
    62           assert_equals(event.data.loaded, EXPECTED_LOADS[testName], `${firstRun ? "NETWORK" : "CACHED"} load of ${event.data.src} should ${EXPECTED_LOADS[testName] ? "" : "not"} succeed`);
    63         });
    64         test.done();
     56        // After the second done event the test is finished.
     57        t.done();
    6558      }
    66     }, false);
    67     document.body.appendChild(iframe);
    68   })
     59      return;
     60    }
     61
     62    // Check that each image either loads or doesn't based on the expectations
     63    let testName = `${RUNS[runCount]} - ${event.data.corp ? RESOURCE_DESC[1] : RESOURCE_DESC[0]}`;
     64    let test = TESTS[testName];
     65    test.step(() => {
     66      assert_equals(event.data.loaded, EXPECTED_LOADS[testName], `${testName} should ${EXPECTED_LOADS[testName] ? "" : "not"} succeed`);
     67    });
     68    test.done();
     69  }, false);
     70  document.body.appendChild(iframe);
    6971});
    70 
    7172
    7273</script>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/resources/corp-image.py

    r284510 r292595  
    1111    response.headers.set(b'Access-Control-Allow-Headers', b'Content-Type')
    1212
    13     response.headers.set(b"Cache-Control", b"max-age=3600");
    1413    # CORS preflight
    1514    if request.method == u'OPTIONS':
    1615        return u''
    1716
    18     if b'some-etag' == request.headers.get(b"If-None-Match", None):
     17    if b'true' == request.GET.get(b'revalidate', None):
     18        response.headers.set(b'Cache-Control', b'max-age=0, must-revalidate')
     19    else:
     20        response.headers.set(b'Cache-Control', b'max-age=3600');
     21
     22    if b'some-etag' == request.headers.get(b'If-None-Match', None):
    1923        response.status = 304
    2024        return u''
    2125
    22     if request.GET.first(b"corp-cross-origin", default=b""):
     26    if request.GET.get(b'corp-cross-origin', None):
    2327        response.headers.set(b'Cross-Origin-Resource-Policy', b'cross-origin')
    2428

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/resources/load-corp-images.html

    r284510 r292595  
    99}
    1010
    11 const image_path = "/html/cross-origin-embedder-policy/resources/corp-image.py";
     11let params = new URLSearchParams(location.search);
     12let token = params.get('token');
     13let revalidate = params.get('revalidate');
     14
     15let image_path = `/html/cross-origin-embedder-policy/resources/corp-image.py?token=${token}&revalidate=${revalidate}`;
    1216
    1317window.addEventListener("load", async () => {
    … …  
    1519    let img = document.createElement("img");
    1620    img.src = remote(image_path);
    17     img.onload = () => { window.parent.postMessage({loaded: true, src: img.src}, "*"); resolve(); };
    18     img.onerror = (e) => { window.parent.postMessage({loaded: false, src: img.src}, "*"); resolve(); };
     21    img.onload = () => { window.parent.postMessage({corp: false, loaded: true}, "*"); resolve(); };
     22    img.onerror = (e) => { window.parent.postMessage({corp: false, loaded: false}, "*"); resolve(); };
    1923    document.body.appendChild(img);
    2024  });
    … …  
    2226  await new Promise(resolve => {
    2327    let img = document.createElement("img");
    24     img.src = remote(image_path + "?corp-cross-origin=1");
    25     img.onload = () => { window.parent.postMessage({loaded: true, src: img.src}, "*"); resolve(); };
    26     img.onerror = (e) => { window.parent.postMessage({loaded: false, src: img.src}, "*"); resolve(); };
     28    img.src = remote(image_path + "&corp-cross-origin=1");
     29    img.onload = () => { window.parent.postMessage({corp: true, loaded: true}, "*"); resolve(); };
     30    img.onerror = (e) => { window.parent.postMessage({corp: true, loaded: false}, "*"); resolve(); };
    2731    document.body.appendChild(img);
    2832  });

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/resources/w3c-import.log

    r284510 r292595  
    2525/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/resources/dedicated-worker.js
    2626/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/resources/empty-coep.py
     27/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/resources/fetch-and-create-url.html
    2728/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/resources/fetch-in-dedicated-worker.js
    2829/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/resources/iframe.html
    … …  
    5556/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/resources/worker-owner-frame.html
    5657/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/resources/worker-owner.js
     58/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/resources/worker-support.js

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/shared-workers.https-expected.txt

    r289247 r292595  
    55PASS "require-corp" (derived from response)
    66PASS default policy (derived from owner set due to use of local scheme - blob URL)
     7PASS require-corp (derived from blob URL creator)
    78FAIL "require-corp" (derived from owner set due to use of local scheme - blob URL) assert_equals: expected "failure" but got "success"
    89PASS default policy (derived from owner set due to use of local scheme - data URL)
     10PASS default policy (not derived from data URL creator)
    911FAIL "require-corp" (derived from owner set due to use of local scheme - data URL) assert_equals: expected "failure" but got "success"
     12FAIL default policy (derived from owner set due to use of local scheme - filesystem URL) assert_equals: url creation error expected (undefined) undefined but got (string) "unimplemented"
     13FAIL require-corp (derived from filesystem URL creator) assert_equals: url creation error expected (undefined) undefined but got (string) "unimplemented"
     14FAIL "require-corp" (derived from owner set due to use of local scheme - filesystem URL) assert_equals: url creation error expected (undefined) undefined but got (string) "unimplemented"
    1015

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/shared-workers.https.html

    r279427 r292595  
    66<script src="/resources/testharnessreport.js"></script>
    77<script src="/common/get-host-info.sub.js"></script>
     8<script src="resources/worker-support.js"></script>
    89<body>
    910<p>Verify the Cross-Origin Embedder Policy for Shared Workers by performing a
    … …  
    1415'use strict';
    1516
    16 const {ORIGIN, REMOTE_ORIGIN} = get_host_info();
    17 const BASE = new URL("resources", location).pathname
    18 const testUrl = `${REMOTE_ORIGIN}${BASE}/empty-coep.py`;
    19 const workerHttpUrl = `${ORIGIN}${BASE}/shared-worker-fetch.js.py`;
    20 let workerBlobUrl;
    21 let workerDataUrl;
    22 
    23 promise_setup(() => {
    24   return fetch(workerHttpUrl)
    25     .then((response) => response.text())
    26     .then((text) => {
    27       workerDataUrl = 'data:text/javascript;base64,' + btoa(text);
    28       workerBlobUrl = URL.createObjectURL(
    29         new Blob([text], { 'Content-Type': 'text/javascript' })
    30       );
    31     });
    32 });
     17const testUrl = resolveUrl("resources/empty-coep.py", {
     18  host: get_host_info().REMOTE_HOST,
     19}).href;
     20
     21function makeWorkerUrl(options) {
     22  return resolveUrl("resources/shared-worker-fetch.js.py", options);
     23}
    3324
    3425/**
    … …  
    3728 * @param {object} t - a testharness.js subtest instance (used to reset global
    3829 *                     state)
    39  * @param {string} ownerCoep - the Cross-Origin Embedder Policy of the iframe
    40  * @param {string} workerUrl - the URL from which the Shared Worker should be
    41  *                             created
     30 * @param {string} url - the URL from which the Shared Worker should be
     31 *                       created
     32 * @param {string} options.ownerCoep - the Cross-Origin Embedder Policy of the
     33                                       iframe
    4234 */
    43 function create(t, ownerCoep, workerUrl) {
    44   const iframe = document.createElement('iframe');
    45   iframe.src = 'resources/empty-coep.py' +
    46     (ownerCoep ? '?value=' + ownerCoep : '');
    47 
    48   return new Promise((resolve, reject) => {
    49       document.body.appendChild(iframe);
    50       t.add_cleanup(() => iframe.remove());
    51       iframe.onload = () => resolve(iframe);
    52     })
    53     .then((iframe) => {
    54       const sw = new iframe.contentWindow.SharedWorker(workerUrl);
    55 
    56       return new Promise((resolve) => {
    57         sw.port.addEventListener('message', () => resolve(sw), { once: true });
    58         sw.port.start();
    59       });
    60     });
     35async function createWorker(t, url, options) {
     36  const { ownerCoep } = options || {};
     37  const frameUrl = resolveUrl("/common/blank.html", { coep: ownerCoep });
     38
     39  const iframe = await withIframe(t, frameUrl);
     40
     41  const sw = new iframe.contentWindow.SharedWorker(url);
     42  sw.onerror = t.unreached_func('SharedWorker.onerror should not be called');
     43
     44  await new Promise((resolve) => {
     45    sw.port.addEventListener('message', resolve, { once: true });
     46    sw.port.start();
     47  });
     48
     49  return sw;
    6150}
    6251
    … …  
    7766};
    7867
    79 promise_test((t) => {
    80   return create(t, null, workerHttpUrl)
    81     .then((worker) => fetchFromWorker(worker, testUrl))
    82     .then((result) => assert_equals(result, 'success'));
     68promise_test(async (t) => {
     69  const worker = await createWorker(t, makeWorkerUrl());
     70  const result = await fetchFromWorker(worker, testUrl);
     71  assert_equals(result, 'success');
    8372}, 'default policy (derived from response)');
    8473
    85 promise_test((t) => {
    86   return create(t, null, workerHttpUrl + '?value=require-corp')
    87     .then((worker) => fetchFromWorker(worker, testUrl))
    88     .then((result) => assert_equals(result, 'failure'));
     74promise_test(async (t) => {
     75  const worker = await createWorker(t, makeWorkerUrl({ coep: 'require-corp' }));
     76  const result = await fetchFromWorker(worker, testUrl);
     77  assert_equals(result, 'failure');
    8978}, '"require-corp" (derived from response)');
    9079
    91 promise_test((t) => {
    92   return Promise.all([
    93       create(t, null, workerBlobUrl),
    94       create(t, null, workerBlobUrl),
    95       create(t, null, workerBlobUrl)
    96     ])
    97     .then((workers) => fetchFromWorker(workers[0], testUrl))
    98     .then((result) => assert_equals(result, 'success'));
     80promise_test(async (t) => {
     81  const blobUrl = await createLocalUrl(t, {
     82    url: makeWorkerUrl(),
     83    scheme: "blob",
     84  });
     85
     86  const workers = await Promise.all([
     87    createWorker(t, blobUrl),
     88    createWorker(t, blobUrl),
     89    createWorker(t, blobUrl),
     90  ]);
     91
     92  const result = await fetchFromWorker(workers[0], testUrl);
     93  assert_equals(result, 'success');
    9994}, 'default policy (derived from owner set due to use of local scheme - blob URL)');
    10095
    101 promise_test((t) => {
    102   return Promise.all([
    103       create(t, null, workerBlobUrl),
    104       create(t, 'require-corp', workerBlobUrl),
    105       create(t, null, workerBlobUrl)
    106     ])
    107     .then((workers) => fetchFromWorker(workers[0], testUrl))
    108     .then((result) => assert_equals(result, 'failure'));
     96promise_test(async (t) => {
     97  const blobUrl = await createLocalUrl(t, {
     98    url: makeWorkerUrl(),
     99    creatorCoep: "require-corp",
     100    scheme: "blob",
     101  });
     102
     103  const workers = await Promise.all([
     104    createWorker(t, blobUrl),
     105    createWorker(t, blobUrl),
     106    createWorker(t, blobUrl),
     107  ]);
     108
     109  const result = await fetchFromWorker(workers[0], testUrl);
     110  assert_equals(result, 'failure');
     111}, 'require-corp (derived from blob URL creator)');
     112
     113promise_test(async (t) => {
     114  const blobUrl = await createLocalUrl(t, {
     115    url: makeWorkerUrl(),
     116    scheme: "blob",
     117  });
     118
     119  const workers = await Promise.all([
     120    createWorker(t, blobUrl),
     121    createWorker(t, blobUrl, { ownerCoep: 'require-corp' }),
     122    createWorker(t, blobUrl),
     123  ]);
     124
     125  const result = await fetchFromWorker(workers[0], testUrl);
     126  assert_equals(result, 'failure');
    109127}, '"require-corp" (derived from owner set due to use of local scheme - blob URL)');
    110128
    111 promise_test((t) => {
    112   return Promise.all([
    113       create(t, null, workerDataUrl),
    114       create(t, null, workerDataUrl),
    115       create(t, null, workerDataUrl)
    116     ])
    117     .then((workers) => fetchFromWorker(workers[0], testUrl))
    118     .then((result) => assert_equals(result, 'success'));
     129promise_test(async (t) => {
     130  const dataUrl = await createLocalUrl(t, {
     131    url: makeWorkerUrl(),
     132    scheme: "data",
     133  });
     134
     135  const workers = await Promise.all([
     136    createWorker(t, dataUrl),
     137    createWorker(t, dataUrl),
     138    createWorker(t, dataUrl),
     139  ]);
     140
     141  const result = await fetchFromWorker(workers[0], testUrl);
     142  assert_equals(result, 'success');
    119143}, 'default policy (derived from owner set due to use of local scheme - data URL)');
    120144
    121 promise_test((t) => {
    122   return Promise.all([
    123       create(t, null, workerDataUrl),
    124       create(t, 'require-corp', workerDataUrl),
    125       create(t, null, workerDataUrl)
    126     ])
    127     .then((workers) => fetchFromWorker(workers[0], testUrl))
    128     .then((result) => assert_equals(result, 'failure'));
     145promise_test(async (t) => {
     146  const dataUrl = await createLocalUrl(t, {
     147    url: makeWorkerUrl(),
     148    creatorCoep: "require-corp",
     149    scheme: "data",
     150  });
     151
     152  const workers = await Promise.all([
     153    createWorker(t, dataUrl),
     154    createWorker(t, dataUrl),
     155    createWorker(t, dataUrl),
     156  ]);
     157
     158  const result = await fetchFromWorker(workers[0], testUrl);
     159  assert_equals(result, 'success');
     160}, 'default policy (not derived from data URL creator)');
     161
     162promise_test(async (t) => {
     163  const dataUrl = await createLocalUrl(t, {
     164    url: makeWorkerUrl(),
     165    scheme: "data",
     166  });
     167
     168  const workers = await Promise.all([
     169    createWorker(t, dataUrl),
     170    createWorker(t, dataUrl, { ownercoep: 'require-corp' }),
     171    createWorker(t, dataUrl),
     172  ]);
     173
     174  const result = await fetchFromWorker(workers[0], testUrl);
     175  assert_equals(result, 'failure');
    129176}, '"require-corp" (derived from owner set due to use of local scheme - data URL)');
     177
     178promise_test(async (t) => {
     179  const filesystemUrl = await createLocalUrl(t, {
     180    url: makeWorkerUrl(),
     181    scheme: "filesystem",
     182  });
     183
     184  const workers = await Promise.all([
     185    createWorker(t, filesystemUrl),
     186    createWorker(t, filesystemUrl),
     187    createWorker(t, filesystemUrl),
     188  ]);
     189
     190  const result = await fetchFromWorker(workers[0], testUrl);
     191  assert_equals(result, 'success');
     192}, 'default policy (derived from owner set due to use of local scheme - filesystem URL)');
     193
     194promise_test(async (t) => {
     195  const filesystemUrl = await createLocalUrl(t, {
     196    url: makeWorkerUrl(),
     197    creatorCoep: "require-corp",
     198    scheme: "filesystem",
     199  });
     200
     201  const workers = await Promise.all([
     202    createWorker(t, filesystemUrl),
     203    createWorker(t, filesystemUrl),
     204    createWorker(t, filesystemUrl),
     205  ]);
     206
     207  const result = await fetchFromWorker(workers[0], testUrl);
     208  assert_equals(result, 'failure');
     209}, 'require-corp (derived from filesystem URL creator)');
     210
     211promise_test(async (t) => {
     212  const filesystemUrl = await createLocalUrl(t, {
     213    url: makeWorkerUrl(),
     214    scheme: "filesystem",
     215  });
     216
     217  const workers = await Promise.all([
     218    createWorker(t, filesystemUrl),
     219    createWorker(t, filesystemUrl, { ownerCoep: 'require-corp' }),
     220    createWorker(t, filesystemUrl),
     221  ]);
     222
     223  const result = await fetchFromWorker(workers[0], testUrl);
     224  assert_equals(result, 'failure');
     225}, '"require-corp" (derived from owner set due to use of local scheme - filesystem URL)');
    130226</script>
    131227</body>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/w3c-import.log

    r287846 r292595  
    6666/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-load-from-cache-storage.https.html
    6767/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-load-from-cache-storage.https.html.headers
     68/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-revalidated-images.https.html
    6869/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-sw-from-none.https.html
    6970/LayoutTests/imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-sw-from-require-corp.https.html

  • trunk/Source/WebKit/ChangeLog

    r292593 r292595  
     12022-04-08  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        Incorrect CORP/COEP check in 304 responses
     4        https://bugs.webkit.org/show_bug.cgi?id=238238
     5        <rdar://problem/90706510>
     6
     7        Reviewed by Youenn Fablet.
     8
     9        Add CORP header to the 304 response if previously set to avoid being blocked by load checker due to COEP.
     10
     11        Test: imported/w3c/web-platform-tests/html/cross-origin-embedder-policy/require-corp-revalidated-images.https.html
     12
     13        * NetworkProcess/NetworkResourceLoader.cpp:
     14        (WebKit::NetworkResourceLoader::didReceiveResponse):
     15
    1162022-04-07  J Pascoe  <j_pascoe@apple.com>
    217

  • trunk/Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp

    r292468 r292595  
    793793            m_cacheEntryForValidation = m_cache->update(originalRequest(), *m_cacheEntryForValidation, m_response, m_privateRelayed);
    794794            // If the request was conditional then this revalidation was not triggered by the network cache and we pass the 304 response to WebCore.
    795             if (originalRequest().isConditional())
     795            if (originalRequest().isConditional()) {
     796                // Add CORP header to the 304 response if previously set to avoid being blocked by load checker due to COEP.
     797                auto crossOriginResourcePolicy = m_cacheEntryForValidation->response().httpHeaderField(HTTPHeaderName::CrossOriginResourcePolicy);
     798                if (!crossOriginResourcePolicy.isEmpty())
     799                    m_response.setHTTPHeaderField(HTTPHeaderName::CrossOriginResourcePolicy, crossOriginResourcePolicy);
    796800                m_cacheEntryForValidation = nullptr;
     801            }
    797802        } else
    798803            m_cacheEntryForValidation = nullptr;
Note: See TracChangeset for help on using the changeset viewer.