Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(290)

Issue 1738753002: Revert of Set the request mode and the credentials mode of FetchEvent in the service worker correctly. (Closed)

Created:
4 years, 10 months ago by horo
Modified:
4 years, 10 months ago
CC:
blink-reviews, chromium-reviews, falken, gavinp+loader_chromium.org, horo+watch_chromium.org, Nate Chapin, jsbell+serviceworker_chromium.org, kenjibaheux+watch_chromium.org, kinuko+serviceworker, kinuko+watch, loading-reviews_chromium.org, michaeln, nhiroki, serviceworker-reviews, tyoshino+watch_chromium.org, tzik
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

Revert of Set the request mode and the credentials mode of FetchEvent in the service worker correctly. (patchset #1 id:1 of https://codereview.chromium.org/1665533003/ ) Reason for revert: This change introduced a security bug. crbug.com/589740 Original issue's description: > Set the request mode and the credentials mode of FetchEvent in the service worker correctly. > > Currently the request mode and the credentials mode of FetchEvent.request are > not correctly set. > > 1. The credentials mode of no-cors resource request must be 'include', but > currently 'same-origin'. (https://crbug.com/576534) > ex: <img src="img.png"> <script src="test.js"> > > 2. When fetch() is called in the page, the FetchEvent.request.mode is always > 'cors' and the FetchEvent.request.credentials is always 'same-origin' in the > service worker. (https://crbug.com/543895) > > 3. When an audio element fetches a request, the FetchEvent.request.mode is > always 'cors' and the FetchEvent.request.credentials is always 'same-origin' > in the service worker. > Expected: > - <audio> > mode: no-cors, credentials: include > - <audio crossOrigin='anonymous'> > mode: cors, credentials: same-origin > - <audio crossOrigin='use-credentials'> > mode: cors, credentials: include > > This CL includes many changes in LayoutTests/http/tests/fetch/. It is because > the credentials mode for script tag is changed from 'same-origin' to 'include'. > And fetch's SW-thorough tests are using script tags. > > I will add browser_tests to check the modes which are set in > - MimeHandlerViewContainer for <embed src="test.pdf"> > - ManifestFetcher for <link rel="manifest" href="manifest.json"> > - PepperURLLoaderHost for PPAPI's pp::URLLoader. > https://codereview.chromium.org/1665453003/ > > BUG=576534, 543895 > > Committed: https://crrev.com/aac099cc134c503accc16f5b2345023acff04b9e > Cr-Commit-Position: refs/heads/master@{#375403} TBR=tyoshino@chromium.org,mkwst@chromium.org # Not skipping CQ checks because original CL landed more than 1 days ago. BUG=576534, 543895 Committed: https://crrev.com/0a778a5336f80ad11cf019352e664d2e8d06d737 Cr-Commit-Position: refs/heads/master@{#377571}

Patch Set 1 #

Patch Set 2 : rebase #

Unified diffs Side-by-side diffs Delta from patch set Stats (+187 lines, -294 lines) Patch
M third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/thorough/cors.js View 1 2 chunks +20 lines, -32 lines 0 comments Download
M third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/thorough/cors-preflight.js View 1 1 chunk +35 lines, -51 lines 0 comments Download
M third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/thorough/cors-preflight2.js View 1 1 chunk +39 lines, -47 lines 0 comments Download
M third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/thorough/redirect.js View 1 6 chunks +43 lines, -46 lines 0 comments Download
M third_party/WebKit/LayoutTests/http/tests/fetch/script-tests/thorough/redirect-loop.js View 1 1 chunk +8 lines, -10 lines 0 comments Download
M third_party/WebKit/LayoutTests/http/tests/serviceworker/fetch-request-resources.html View 1 5 chunks +15 lines, -63 lines 0 comments Download
M third_party/WebKit/LayoutTests/http/tests/serviceworker/resources/fetch-request-resources-iframe.html View 1 1 chunk +0 lines, -8 lines 0 comments Download
M third_party/WebKit/LayoutTests/http/tests/serviceworker/resources/fetch-request-xhr-iframe.html View 1 1 chunk +1 line, -1 line 0 comments Download
M third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp View 1 2 chunks +21 lines, -33 lines 0 comments Download
M third_party/WebKit/Source/core/loader/ImageLoader.cpp View 1 1 chunk +1 line, -0 lines 0 comments Download
M third_party/WebKit/Source/modules/fetch/FetchManager.cpp View 1 1 chunk +0 lines, -2 lines 0 comments Download
M third_party/WebKit/Source/platform/network/ResourceRequest.cpp View 1 1 chunk +4 lines, -1 line 0 comments Download

Messages

Total messages: 9 (8 generated)
horo
4 years, 10 months ago (2016-02-25 08:13:18 UTC) #1
Created Revert of Set the request mode and the credentials mode of FetchEvent in
the service worker correctly.

Powered by Google App Engine
This is Rietveld 408576698