CSP: New test with form-action and a redirect into a new window.

CSP: New test with form-action and a redirect into a new window.

This test shows that the CSP of the navigating frame are used instead of
the CSP of the frame that has initiated the navigation.

BUG=700964
Review-Url: https://codereview.chromium.org/2747823002
Cr-Commit-Position: refs/heads/master@{#456656}
Committed: https://chromium.googlesource.com/chromium/src/+/def680801ab5c196b089e67a6e2a1d3768b4a7d3

[arthursonzogni, 2017-03-13 17:19:25]

Patchset #1 (id:1) has been deleted

[arthursonzogni, 2017-03-13 17:21:04]

The CQ bit was checked by arthursonzogni@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-13 17:21:52]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[arthursonzogni, 2017-03-13 17:27:22]

arthursonzogni@chromium.org changed reviewers:
+ mkwst@chromium.org

[arthursonzogni, 2017-03-13 17:27:23]

Hi Mike,

Can you take a look?
This test shows that during a navigation, the CSP used for the form-action
directive are the one of the navigating frame, not the one that has triggered
the navigation.

I previously thought there was no problems. Indeed, this may seem to work
sometimes, but it is accidental, it is when the new window is still on
about:blank when the form-submission occurs, because of
https://codereview.chromium.org/2530343006.

[commit-bot: I haz the power, 2017-03-13 18:23:36]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-13 18:23:37]

Dry run: This issue passed the CQ dry run.

[Mike West, 2017-03-13 20:04:12]

LGTM, thanks for filing the bug.

[arthursonzogni, 2017-03-14 08:41:07]

The CQ bit was checked by arthursonzogni@chromium.org

[commit-bot: I haz the power, 2017-03-14 08:41:28]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-14 08:44:55]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1489480867823940,
"parent_rev": "42b88efd1fc0721c8c97e1d5dfb89e4b9ce58fa9", "commit_rev":
"def680801ab5c196b089e67a6e2a1d3768b4a7d3"}

[commit-bot: I haz the power, 2017-03-14 08:45:39]

Description was changed from

==========
CSP: New test with form-action and a redirect into a new window.

This test shows that the CSP of the navigating frame are used instead of
the CSP of the frame that has initiated the navigation.

BUG=700964
==========

to

==========
CSP: New test with form-action and a redirect into a new window.

This test shows that the CSP of the navigating frame are used instead of
the CSP of the frame that has initiated the navigation.

BUG=700964

Review-Url: https://codereview.chromium.org/2747823002
Cr-Commit-Position: refs/heads/master@{#456656}
Committed:
https://chromium.googlesource.com/chromium/src/+/def680801ab5c196b089e67a6e2a...
==========

[commit-bot: I haz the power, 2017-03-14 08:45:40]

Committed patchset #1 (id:20001) as
https://chromium.googlesource.com/chromium/src/+/def680801ab5c196b089e67a6e2a...

[arthursonzogni, 2017-03-14 16:45:08]

A revert of this CL (patchset #1 id:20001) has been created in
https://codereview.chromium.org/2746333004/ by arthursonzogni@chromium.org.

The reason for reverting is: It looks like the test is passing with
site-isolation, so they have the wrong file expectation. There is also a minor
problem when accessing namedWindow.location.href.

I will fix the test and try to understand why it seems to work with
site-isolation..