third_party/WebKit/LayoutTests/http/tests/navigation/resources/form-target.pl - Issue 2225383003: Origin header should be preserved in http requests made via OpenURL code path.

Side by Side Diff: third_party/WebKit/LayoutTests/http/tests/navigation/resources/form-target.pl

Issue 2225383003: Origin header should be preserved in http requests made via OpenURL code path. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master

Patch Set: Test doesn't depent on initial URI of the frame (as long as it is cross-site). Created 4 years, 4 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

« third_party/WebKit/LayoutTests/http/tests/navigation/form-targets-cross-site-frame-get.html ('K') | « third_party/WebKit/LayoutTests/http/tests/navigation/post-goback1-expected.txt ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
1 #!/usr/bin/perl	1 #!/usr/bin/perl

2 # Simple script to that dumps the HTTP request method and all input parameters.	2 # Simple script to that dumps the HTTP request method and all input parameters.

3	3

4 use CGI;	4 use CGI;

5 $query = new CGI;	5 $query = new CGI;

6	6

7 print "Content-type: text/html\r\n";	7 print "Content-type: text/html\r\n";

8 print "\r\n";	8 print "\r\n";

9	9

10 $method = $query->request_method();	10 $method = $query->request_method();

11	11

12 print <<HEADER;	12 print <<HEADER;

13 <body>	13 <body>

14 <p>This page was requested with the HTTP method $method.</p>	14 <p>This page was requested with the HTTP method $method.</p>

15	15

16 <p>Parameters:</p>	16 <p>Parameters:</p>

17 <ul>	17 <ul>

18 HEADER	18 HEADER

19	19

20 @paramNames = $query->param;	20 @paramNames = $query->param;

21	21

22 foreach $paramName (@paramNames)	22 foreach $paramName (@paramNames)

23 {	23 {

24 print "<li>" . $paramName . " = " . $query->param($paramName) . "</li>"	24 print "<li>" . $paramName . " = " . $query->param($paramName) . "</li>"

25 }	25 }

26	26

	27 print <<HEADER2;
	jww 2016/08/09 22:38:23 There are a lot of tests that use form-target.pl, There are a lot of tests that use form-target.pl, and you'll need to change the test expectations for all of them if you do this, I think. For exmaple, "form-action-src-allowed.html" uses this target. Instead, maybe add a parameter to form-target.pl that gets the header printing. Maybe only print if the request is to "form-target.pl?print-headers=true"? Łukasz Anforowicz 2016/08/10 00:03:19 Ooops. I thought that I fixed expectations of all Show quoted text On 2016/08/09 22:38:23, jww wrote: > There are a lot of tests that use form-target.pl, and you'll need to change the > test expectations for all of them if you do this, I think. For exmaple, > "form-action-src-allowed.html" uses this target. Instead, maybe add a parameter > to form-target.pl that gets the header printing. Maybe only print if the request > is to "form-target.pl?print-headers=true"? Ooops. I thought that I fixed expectations of all the affected tests, but obviously I've missed tests outside of http/tests/navigation. I thought about making the headers dump optional, but decided against it because of worries about the interaction with forms using get method. I also like the extra coverage provided by the dumping of the headers from other testcases (e.g. previously we could start sending Origin with GET requests and the existing tests wouldn't have caught this). Would it be okay if I just updated test expectations for the 3 affected tests under http/tests/security/contentSecurityPolicy/1.1? This is what I am doing in patchset 4. (if this is not okay not, then I think I also could 1) modify changes to form-target.pl so we only dump headers if a query parameter is present and 2) modify changes to form-targets-cross-site-frame-post.html so it is the only layout test that asks for dump of http request headers). WDYT? jww 2016/08/10 00:44:53 SGTM. If it's just the CSP tests using this, that' Show quoted text On 2016/08/10 00:03:19, Łukasz Anforowicz wrote: > On 2016/08/09 22:38:23, jww wrote: > > There are a lot of tests that use form-target.pl, and you'll need to change > the > > test expectations for all of them if you do this, I think. For exmaple, > > "form-action-src-allowed.html" uses this target. Instead, maybe add a > parameter > > to form-target.pl that gets the header printing. Maybe only print if the > request > > is to "form-target.pl?print-headers=true"? > > Ooops. I thought that I fixed expectations of all the affected tests, but > obviously I've missed tests outside of http/tests/navigation. > > I thought about making the headers dump optional, but decided against it because > of worries about the interaction with forms using get method. I also like the > extra coverage provided by the dumping of the headers from other testcases (e.g. > previously we could start sending Origin with GET requests and the existing > tests wouldn't have caught this). > > Would it be okay if I just updated test expectations for the 3 affected tests > under http/tests/security/contentSecurityPolicy/1.1? This is what I am doing in > patchset 4. (if this is not okay not, then I think I also could 1) modify > changes to form-target.pl so we only dump headers if a query parameter is > present and 2) modify changes to form-targets-cross-site-frame-post.html so it > is the only layout test that asks for dump of http request headers). > > WDYT? SGTM. If it's just the CSP tests using this, that's esp. fine, since it probably behooves them to verify the headers as well. I'm a big fan of providing options to test resources like this, but I appreciate your concerns about forms using the GET method.
	28 </ul>

	29 <p>Http headers:</p>

	30 <ul>

	31 HEADER2

	32

	33 my %headers = map { $_ => $query->http($_) } $query->http();

	34 for my $header ( sort (keys %headers) ) {

	35 if (("$header" ne "HTTP_ACCEPT_ENCODING") &&

	36 ("$header" ne "HTTP_ACCEPT_LANGUAGE") &&

	37 ("$header" ne "HTTP_ACCEPT") &&

	38 ("$header" ne "HTTP_USER_AGENT")) {

	39 print "<li>$header = $headers{$header}</li>\n";

	40 }

	41 }

	42

27 print <<FOOTER	43 print <<FOOTER

28 </ul>	44 </ul>

29 <script>	45 <script>

30 var isDone = true;	46 var isDone = true;

31 if (sessionStorage.formTargetShouldNavAndGoBack) {	47 if (sessionStorage.formTargetShouldNavAndGoBack) {

32 if (sessionStorage.didNav) {	48 if (sessionStorage.didNav) {

33 delete sessionStorage.didNav;	49 delete sessionStorage.didNav;

34 delete sessionStorage.formTargetShouldNavAndGoBack;	50 delete sessionStorage.formTargetShouldNavAndGoBack;

35 } else {	51 } else {

36 isDone = false;	52 isDone = false;

(...skipping 13 matching lines...) Expand all Loading...
50 };	66 };

51 }	67 }

52 }	68 }

53	69

54 if (isDone && window.testRunner)	70 if (isDone && window.testRunner)

55 testRunner.notifyDone();	71 testRunner.notifyDone();

56	72

57 </script>	73 </script>

58 </body>	74 </body>

59 FOOTER	75 FOOTER

OLD	NEW