Changeset 293311 in webkit


Ignore:
Timestamp:
Apr 24, 2022, 11:02:41 PM (3 years ago)
Author:
youenn@apple.com
Message:

TextTrackLoader should use SameOrigin mode by default
​https://bugs.webkit.org/show_bug.cgi?id=239381

Reviewed by Eric Carlson.

LayoutTests/imported/w3c:

  • web-platform-tests/html/semantics/embedded-content/media-elements/track/track-element/cloneNode-expected.txt:
  • web-platform-tests/html/semantics/embedded-content/media-elements/track/track-element/track-data-url-expected.txt:
  • web-platform-tests/service-workers/service-worker/webvtt-cross-origin.https-expected.txt:

Source/WebCore:

Covered by updated test.

  • loader/TextTrackLoader.cpp:

LayoutTests:

  • http/tests/security/contentSecurityPolicy/resources/track.vtt.py: Added.
  • http/tests/security/contentSecurityPolicy/track-redirect-allowed.html:
  • http/tests/security/contentSecurityPolicy/track-redirect-allowed2.html:
  • http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
  • http/tests/security/contentSecurityPolicy/track-redirect-blocked.html:
  • http/tests/security/text-track-crossorigin-expected.txt:
  • http/tests/security/text-track-crossorigin.html:
Location:
trunk
Files:
1 added
13 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r293291 r293311  
     12022-04-24  Youenn Fablet  <youenn@apple.com>
     2
     3        TextTrackLoader should use SameOrigin mode by default
     4        https://bugs.webkit.org/show_bug.cgi?id=239381
     5
     6        Reviewed by Eric Carlson.
     7
     8        * http/tests/security/contentSecurityPolicy/resources/track.vtt.py: Added.
     9        * http/tests/security/contentSecurityPolicy/track-redirect-allowed.html:
     10        * http/tests/security/contentSecurityPolicy/track-redirect-allowed2.html:
     11        * http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt:
     12        * http/tests/security/contentSecurityPolicy/track-redirect-blocked.html:
     13        * http/tests/security/text-track-crossorigin-expected.txt:
     14        * http/tests/security/text-track-crossorigin.html:
     15
    1162022-04-23  Andres Gonzalez  <andresg_22@apple.com>
    217

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/track-redirect-allowed.html

    r272981 r293311  
    77</head>
    88<body>
    9 <video>
    10     <track src="http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/track.vtt" kind="captions" onload="alertAndDone('PASS')" onerror="alertAndDone('FAIL')">
     9<video crossOrigin="anonymous">
     10    <track src="http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/track.vtt.py" kind="captions" onload="alertAndDone('PASS')" onerror="alertAndDone('FAIL')">
    1111</video>
    1212<script>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/track-redirect-allowed2.html

    r272981 r293311  
    77</head>
    88<body>
    9 <video>
    10     <track src="http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/track.vtt" kind="captions" onload="alertAndDone('PASS')" onerror="alertAndDone('FAIL')">
     9<video crossOrigin="anonymous">
     10    <track src="http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A%2F%2Flocalhost%3A8000/security/contentSecurityPolicy/resources/track.vtt.py" kind="captions" onload="alertAndDone('PASS')" onerror="alertAndDone('FAIL')">
    1111</video>
    1212<script>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/track-redirect-blocked-expected.txt

    r290443 r293311  
    1 CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/track.vtt because it does not appear in the media-src directive of the Content Security Policy.
    2  blockedURI = http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A//127.0.0.1%3A8000/resources/redirect.py%3Furl=http%3A//localhost%3A8000/security/contentSecurityPolicy/resources/track.vtt
     1CONSOLE MESSAGE: Refused to load http://localhost:8000/security/contentSecurityPolicy/resources/track.vtt.py because it does not appear in the media-src directive of the Content Security Policy.
     2 blockedURI = http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A//127.0.0.1%3A8000/resources/redirect.py%3Furl=http%3A//localhost%3A8000/security/contentSecurityPolicy/resources/track.vtt.py
    33
    44

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/track-redirect-blocked.html

    r290443 r293311  
    1414    });
    1515</script>
    16 <video>
    17 <track src="http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A//127.0.0.1%3A8000/resources/redirect.py%3Furl=http%3A//localhost%3A8000/security/contentSecurityPolicy/resources/track.vtt" kind="captions">
     16<video crossOrigin="anonymous">
     17<track src="http://127.0.0.1:8000/resources/redirect.py?code=307&url=http%3A//127.0.0.1%3A8000/resources/redirect.py%3Furl=http%3A//localhost%3A8000/security/contentSecurityPolicy/resources/track.vtt.py" kind="captions">
    1818</video>
    1919<script>

  • trunk/LayoutTests/http/tests/security/text-track-crossorigin-expected.txt

    r285145 r293311  
     1CONSOLE MESSAGE: Unsafe attempt to load URL http://localhost:8000/security/resources/captions-with-access-control-headers.py from origin http://127.0.0.1:8000. Domains, protocols and ports must match.
     2
    13CONSOLE MESSAGE: Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin. Status code: 200
    24CONSOLE MESSAGE: Cross-origin text track load denied by Cross-Origin Resource Sharing policy.
    … …  
    57
    68Loading without Access-Control-Allow-Origin header, no "crossorigin" attribute on <video>
    7 EVENT(load)
    8 PASS: shouldLoad should be 'true' and is.
     9EVENT(error)
     10PASS: shouldLoad should be 'false' and is.
    911PASS: event.target should be '[object HTMLTrackElement]' and is.
    10 PASS: trackElement.readyState should be '2' and is.
     12PASS: trackElement.readyState should be '3' and is.
    1113
    1214

  • trunk/LayoutTests/http/tests/security/text-track-crossorigin.html

    r274244 r293311  
    3030                log('<br>');
    3131                switch(counter) {
    32                 case 0:
    33                     log('Loading <b>without</b> Access-Control-Allow-Origin header, setting video.crossorigin to "anonymous"');
    34                     url = "http://localhost:8000/security/resources/captions-with-access-control-headers.py?count=" + counter;
    35                     videoElement.setAttribute('crossorigin', 'anonymous');
     32                case 2:
     33                    log('Loading <b>with</b> Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers, setting video.crossorigin to "use-credentials"');
     34                    url = "http://localhost:8000/security/resources/captions-with-access-control-headers.py?origin=1&credentials=1";
     35                    videoElement.setAttribute('crossorigin', 'use-credentials');
    3636                    trackElement.removeAttribute('src');
    3737                    trackElement.setAttribute('src', url);
    38                     shouldLoad = false;
    39                     ++counter;
    40                     break;
    41 
    42                 case 2:
    43                     log('Loading <b>with</b> Access-Control-Allow-Origin and Access-Control-Allow-Credentials headers, setting video.crossorigin to "use-credentials"');
    44                     url = "http://localhost:8000/security/resources/captions-with-access-control-headers.py?origin=1;credentials=1";
    45                     trackElement.setAttribute('crossorigin', 'use-credentials');
    46                     trackElement.setAttribute('src', url);
     38                    shouldLoad = true;
    4739                    ++counter;
    4840                    break;
    … …  
    5244                    if (window.testRunner)
    5345                        testRunner.notifyDone();
     46
    5447                defaut:
    5548                    if (window.testRunner)
    … …  
    7063                log('<br>');
    7164                switch(counter) {
     65                case 0:
     66                    log('Loading <b>without</b> Access-Control-Allow-Origin header, setting video.crossorigin to "anonymous"');
     67                    url = "http://localhost:8000/security/resources/captions-with-access-control-headers.py?count=" + counter;
     68                    videoElement.setAttribute('crossorigin', 'anonymous');
     69                    trackElement.removeAttribute('src');
     70                    trackElement.setAttribute('src', url);
     71                    shouldLoad = false;
     72                    ++counter;
     73                    break;
     74
    7275                case 1:
    7376                    log('Loading <b>with</b> Access-Control-Allow-Origin header, leaving video.crossorigin as "anonymous"');
    7477                    url = "http://localhost:8000/security/resources/captions-with-access-control-headers.py?origin=1";
     78                    trackElement.removeAttribute('src');
    7579                    trackElement.setAttribute('src', url);
    7680                    shouldLoad = true;
    7781                    ++counter;
    7882                    break;
     83
    7984                defaut:
    8085                    if (window.testRunner)
    … …  
    9095                var url = "http://localhost:8000/security/resources/captions-with-access-control-headers.py"
    9196                trackElement.setAttribute('src', url);
     97                shouldLoad = false;
    9298            }
    9399

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r293288 r293311  
     12022-04-24  Youenn Fablet  <youenn@apple.com>
     2
     3        TextTrackLoader should use SameOrigin mode by default
     4        https://bugs.webkit.org/show_bug.cgi?id=239381
     5
     6        Reviewed by Eric Carlson.
     7
     8        * web-platform-tests/html/semantics/embedded-content/media-elements/track/track-element/cloneNode-expected.txt:
     9        * web-platform-tests/html/semantics/embedded-content/media-elements/track/track-element/track-data-url-expected.txt:
     10        * web-platform-tests/service-workers/service-worker/webvtt-cross-origin.https-expected.txt:
     11
    1122022-04-22  Cathie Chen  <cathiechen@igalia.com>
    213

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/track/track-element/cloneNode-expected.txt

    r267646 r293311  
     1CONSOLE MESSAGE: Unsafe attempt to load URL javascript:"network error" from origin http://localhost:8800. Domains, protocols and ports must match.
     2
     3CONSOLE MESSAGE: Unsafe attempt to load URL javascript:"network error" from origin http://localhost:8800. Domains, protocols and ports must match.
     4
    15
    26PASS track element cloneNode, not loaded

  • trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/embedded-content/media-elements/track/track-element/track-data-url-expected.txt

    r285145 r293311  
    1 CONSOLE MESSAGE: Origin http://localhost:8800 is not allowed by Access-Control-Allow-Origin. Status code: 200
    2 CONSOLE MESSAGE: Cross-origin text track load denied by Cross-Origin Resource Sharing policy.
    3 CONSOLE MESSAGE: Origin http://localhost:8800 is not allowed by Access-Control-Allow-Origin. Status code: 200
    4 CONSOLE MESSAGE: Cross-origin text track load denied by Cross-Origin Resource Sharing policy.
    51
    62FAIL track element data: URL No CORS null is not an object (evaluating 't.track.cues.length')
    7 FAIL track element data: URL anonymous assert_unreached: got error event Reached unreachable code
    8 FAIL track element data: URL use-credentials assert_unreached: got error event Reached unreachable code
     3FAIL track element data: URL anonymous null is not an object (evaluating 't.track.cues.length')
     4FAIL track element data: URL use-credentials null is not an object (evaluating 't.track.cues.length')
    95

  • trunk/LayoutTests/imported/w3c/web-platform-tests/service-workers/service-worker/webvtt-cross-origin.https-expected.txt

    r267647 r293311  
    22PASS initialize global state
    33PASS same-origin text track should load
    4 FAIL cross-origin text track with no-cors request should not load assert_equals: expected "error event" but got "load event"
     4PASS cross-origin text track with no-cors request should not load
    55PASS cross-origin text track with rejected cors request should not load
    6 FAIL cross-origin text track with approved cors request should not load assert_equals: expected "error event" but got "load event"
     6PASS cross-origin text track with approved cors request should not load
    77PASS same-origin text track that redirects same-origin should load
    8 FAIL same-origin text track that redirects cross-origin should not load assert_equals: expected "error event" but got "load event"
     8PASS same-origin text track that redirects cross-origin should not load
    99PASS same-origin text track that redirects to a cross-origin text track with rejected cors should not load
    10 FAIL same-origin text track that redirects to a cross-origin text track with approved cors should not load assert_equals: expected "error event" but got "load event"
     10PASS same-origin text track that redirects to a cross-origin text track with approved cors should not load
    1111PASS restore global state
    1212

  • trunk/Source/WebCore/ChangeLog

    r293308 r293311  
     12022-04-24  Youenn Fablet  <youenn@apple.com>
     2
     3        TextTrackLoader should use SameOrigin mode by default
     4        https://bugs.webkit.org/show_bug.cgi?id=239381
     5
     6        Reviewed by Eric Carlson.
     7
     8        Covered by updated test.
     9
     10        * loader/TextTrackLoader.cpp:
     11
    1122022-04-24  Diego Pino Garcia  <dpino@igalia.com>
    213

  • trunk/Source/WebCore/loader/TextTrackLoader.cpp

    r290026 r293311  
    148148    ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
    149149    options.contentSecurityPolicyImposition = element.isInUserAgentShadowTree() ? ContentSecurityPolicyImposition::SkipPolicyCheck : ContentSecurityPolicyImposition::DoPolicyCheck;
     150    options.sameOriginDataURLFlag = SameOriginDataURLFlag::Set;
    150151
    151152    // FIXME: Do we really need to call completeURL here?
    … …  
    155156        resourceRequest.setInspectorInitiatorNodeIdentifier(InspectorInstrumentation::identifierForNode(*mediaElement));
    156157
    157     auto cueRequest = createPotentialAccessControlRequest(WTFMove(resourceRequest), WTFMove(options), m_document, element.mediaElementCrossOriginAttribute());
     158    auto cueRequest = createPotentialAccessControlRequest(WTFMove(resourceRequest), WTFMove(options), m_document, element.mediaElementCrossOriginAttribute(), SameOriginFlag::Yes);
    158159    m_resource = m_document.cachedResourceLoader().requestTextTrack(WTFMove(cueRequest)).value_or(nullptr);
    159160    if (!m_resource)
Note: See TracChangeset for help on using the changeset viewer.