| OLD | NEW |
|---|
| 1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
| 2 <script src="../resources/testharness.js"></script> | 2 <script src="../resources/testharness.js"></script> |
| 3 <script src="../resources/testharnessreport.js"></script> | 3 <script src="../resources/testharnessreport.js"></script> |
| 4 <script src="../resources/get-host-info.js"></script> | 4 <script src="../resources/get-host-info.js"></script> |
| 5 <script src="resources/test-helpers.js"></script> | 5 <script src="resources/test-helpers.js"></script> |
| 6 <script src="resources/foreign-fetch-helpers.js"></script> | 6 <script src="resources/foreign-fetch-helpers.js"></script> |
| 7 <body> | 7 <body> |
| 8 <script> | 8 <script> |
| 9 var host_info = get_host_info(); | 9 var host_info = get_host_info(); |
| 10 | 10 |
| (...skipping 139 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 150 frame.contentDocument.head.appendChild(meta); | 150 frame.contentDocument.head.appendChild(meta); |
| 151 return frame.contentWindow.fetch(remote_url, {mode: 'no-cors'}); | 151 return frame.contentWindow.fetch(remote_url, {mode: 'no-cors'}); |
| 152 }) | 152 }) |
| 153 .then(response => response.json()) | 153 .then(response => response.json()) |
| 154 .then(response_data => { | 154 .then(response_data => { |
| 155 assert_equals('', response_data.referrer); | 155 assert_equals('', response_data.referrer); |
| 156 assert_equals('null', response_data.origin); | 156 assert_equals('null', response_data.origin); |
| 157 }); | 157 }); |
| 158 }, 'Referrer and origin are set correctly in ForeignFetchEvent.'); | 158 }, 'Referrer and origin are set correctly in ForeignFetchEvent.'); |
| 159 | 159 |
| 160 function fetch_from_iframe(origin, url) { |
| 161 return with_iframe(origin + |
| 162 '/serviceworker/resources/foreign-fetch-helper-iframe.html') |
| 163 .then(frame => new Promise((resolve) => { |
| 164 var channel = new MessageChannel(); |
| 165 frame.contentWindow.postMessage({url: url, |
| 166 port: channel.port1}, |
| 167 '*', [channel.port1]); |
| 168 channel.port2.onmessage = reply => resolve(reply.data); |
| 169 })); |
| 170 } |
| 171 |
| 172 promise_test(t => { |
| 173 var scope = 'simple.txt?basic_insecure'; |
| 174 var remote_url = |
| 175 host_info.AUTHENTICATED_ORIGIN + '/serviceworker/resources/' + scope; |
| 176 return install_cross_origin_worker(t, worker_for_scopes(['']), scope, |
| 177 host_info.AUTHENTICATED_ORIGIN) |
| 178 .then(() => fetch_from_iframe(host_info.HTTPS_REMOTE_ORIGIN, remote_url)) |
| 179 .then(response => assert_equals(response, 'Success: Foreign Fetch')) |
| 180 .then(() => fetch_from_iframe(host_info.UNAUTHENTICATED_ORIGIN, |
| 181 remote_url)) |
| 182 .then(response => assert_equals(response, |
| 183 'Error: TypeError: Failed to fetch')); |
| 184 }, 'Service Worker does not intercept fetches from an insecure context.'); |
| 185 |
| 160 </script> | 186 </script> |
| 161 </body> | 187 </body> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2032653003:
Limit foreign fetch to only intercept requests made from secure contexts. (Closed)
Base URL: https://chromium.googlesource.com/chromium/src.git@master