[ServiceWorker] Introduce the new security restriction of redirected response.

[ServiceWorker] Introduce the new security restriction of redirected response.

This CL blocks responding to requests which redirect mode is not 'follow' with redirected responses.

BUG=669363, 658249
Review-Url: https://codereview.chromium.org/2755643004
Cr-Commit-Position: refs/heads/master@{#457736}
Committed: https://chromium.googlesource.com/chromium/src/+/343f57b30319e935a538ef99853a8eaafe7926e5

[horo, 2017-03-16 08:00:55]

The CQ bit was checked by horo@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-16 08:01:18]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[horo, 2017-03-16 08:44:59]

The CQ bit was checked by horo@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-03-16 08:45:24]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-16 10:05:49]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-03-16 10:05:49]

Dry run: This issue passed the CQ dry run.

[horo, 2017-03-17 02:27:29]

horo@chromium.org changed reviewers:
+ falken@chromium.org

[horo, 2017-03-17 02:27:30]

falken@c

[horo, 2017-03-17 02:27:37]

falken@
Please review this.

[horo, 2017-03-17 02:27:37]

falken@
Please review this.

[falken, 2017-03-17 09:28:44]

lgtm

https://codereview.chromium.org/2755643004/diff/20001/third_party/WebKit/Layo...
File
third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-request-redirect.https.html
(right):

https://codereview.chromium.org/2755643004/diff/20001/third_party/WebKit/Layo...
third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-request-redirect.https.html:43:
// Chrome blocks reading the contentDocument of the error iframe.
At first I was surprised that Chrome is mentioned in the comment for the WPT,
but I guess it makes sense since the point of the test isn't to test browser
behavior for an iframe that failed to load due to network error. Do you know if
Firefox, etc behave differently, and what the spec says about it?

Maybe we can expand the comment to something like:
"Chrome treats iframes that failed to load due to a network error as having a
different origin, so accessing contentDocument throws an error. Other browsers
might have different behavior."

WDYT?

[horo, 2017-03-17 09:54:24]

https://codereview.chromium.org/2755643004/diff/20001/third_party/WebKit/Layo...
File
third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-request-redirect.https.html
(right):

https://codereview.chromium.org/2755643004/diff/20001/third_party/WebKit/Layo...
third_party/WebKit/LayoutTests/external/wpt/service-workers/service-worker/fetch-request-redirect.https.html:43:
// Chrome blocks reading the contentDocument of the error iframe.
On 2017/03/17 09:28:43, falken wrote:
> At first I was surprised that Chrome is mentioned in the comment for the WPT,
> but I guess it makes sense since the point of the test isn't to test browser
> behavior for an iframe that failed to load due to network error. Do you know
if
> Firefox, etc behave differently, and what the spec says about it?
> 
> Maybe we can expand the comment to something like:
> "Chrome treats iframes that failed to load due to a network error as having a
> different origin, so accessing contentDocument throws an error. Other browsers
> might have different behavior."
> 
> WDYT? 

Done.

Firefox hits the timeout at line 30.
Chrome also hit the timeout before https://codereview.chromium.org/1920873002.

[horo, 2017-03-17 09:54:29]

The CQ bit was checked by horo@chromium.org

[horo, 2017-03-17 09:54:29]

The patchset sent to the CQ was uploaded after l-g-t-m from falken@chromium.org
Link to the patchset: https://codereview.chromium.org/2755643004/#ps40001
(title: "change comment")

[commit-bot: I haz the power, 2017-03-17 09:54:40]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-03-17 11:24:35]

CQ is committing da patch.

Bot data: {"patchset_id": 40001, "attempt_start_ts": 1489744469131180,
"parent_rev": "532ac1199af575790db7370f5e197909482ffe50", "commit_rev":
"343f57b30319e935a538ef99853a8eaafe7926e5"}

[commit-bot: I haz the power, 2017-03-17 11:25:14]

Description was changed from

==========
[ServiceWorker] Introduce the new security restriction of redirected response.

This CL blocks responding to requests which redirect mode is not 'follow' with
redirected responses.

BUG=669363,658249
==========

to

==========
[ServiceWorker] Introduce the new security restriction of redirected response.

This CL blocks responding to requests which redirect mode is not 'follow' with
redirected responses.

BUG=669363,658249

Review-Url: https://codereview.chromium.org/2755643004
Cr-Commit-Position: refs/heads/master@{#457736}
Committed:
https://chromium.googlesource.com/chromium/src/+/343f57b30319e935a538ef99853a...
==========

[commit-bot: I haz the power, 2017-03-17 11:25:15]

Committed patchset #3 (id:40001) as
https://chromium.googlesource.com/chromium/src/+/343f57b30319e935a538ef99853a...