LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-allow.html - Issue 27073003: CSP Suborigins

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-allow.html

Issue 27073003: CSP Suborigins Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: Rebase Created 6 years, 6 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

« no previous file with comments | « LayoutTests/http/tests/security/contentSecurityPolicy/resources/suborigin-frame.html ('k') | LayoutTests/http/tests/security/contentSecurityPolicy/suborigin-allow-expected.txt » ('j') | Source/core/dom/ExecutionContext.h » ('J')
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
(Empty)
	1 <meta http-equiv="Content-Security-Policy" content="suborigin foobar">
	abarth-chromium 2014/07/31 05:02:05 I don't understand how this works. Does this mean I don't understand how this works. Does this mean a document can change suborigins in the middle of execution? For example, if we put a <script> block above the meta tag, would that script execute outside the suborigin? If we permit that, we'll be getting into a bunch of the insanity of document.domain where you can have a JavaScript reference to an object that you can no longer access. I thought for \|sandbox\| we prevented it from being engaged via the meta tag. Instead, you have to use the HTTP header, which means the document is in the sandbox from the start. IMHO, we should do the same thing here. jww 2014/10/21 23:51:06 I 100% agree. I should have mentioned this in my o Show quoted text On 2014/07/31 05:02:05, abarth wrote: > I don't understand how this works. Does this mean a document can change > suborigins in the middle of execution? For example, if we put a <script> block > above the meta tag, would that script execute outside the suborigin? > > If we permit that, we'll be getting into a bunch of the insanity of > document.domain where you can have a JavaScript reference to an object that you > can no longer access. > > I thought for \|sandbox\| we prevented it from being engaged via the meta tag. > Instead, you have to use the HTTP header, which means the document is in the > sandbox from the start. IMHO, we should do the same thing here. I 100% agree. I should have mentioned this in my original comments, but for experimental purposes, I am allowing <meta> suborigin creation for ease of use. Definitely for the Real Thing, this is not acceptable, and it needs to be header only. For now, bear with me on this, and I'll separately try to take a stab at getting this to work header-only.
	2 <script>

	3 if (window.testRunner) {

	4 testRunner.waitUntilDone();

	5 testRunner.dumpAsText();

	6 }

	7

	8 function iframeLoaded() {

	9 var iframe = document.getElementById('iframe');

	10 try {

	11 var secret = iframe.contentWindow.secret;

	12 alert("PASS: Secret is '" + secret + "'.");

	13 } catch(e) {

	14 alert('FAIL: Prevented from accessing the content of the iframe in the s ame suborigin.');

	15 }

	16 testRunner.notifyDone();

	17 }

	18 </script>

	19 <p>

	20 This tests whether a frame in a can access secrets in a frame in the same subori gin.

	21 </p>

	22 <iframe onload="iframeLoaded();" id="iframe" src="resources/suborigin-frame.html "></iframe>

OLD	NEW