From 306955e5cfb8dfac801f568ee5aa5356a1b81f7d Mon Sep 17 00:00:00 2001 From: Lukasz Anforowicz Date: Thu, 26 Sep 2019 16:39:53 -0700 Subject: [PATCH] CORB: Remove no-longer-needed, hacky detection of same-origin requests. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After r694827 (Set |request_initiator| to the website, not to the content script's origin), CORB can detect all same-origin requests directly, without resorting to a hacky comparison with the request_initiator_site_lock. This CL reverts parts of r620866 where this hack was introduced. Bug: 940068 Change-Id: I69f3e6b868436f2aaa78b594da25a3c5431ab7cb Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1823597 Commit-Queue: Charlie Reis Auto-Submit: Łukasz Anforowicz Reviewed-by: Charlie Reis Cr-Commit-Position: refs/heads/master@{#700486} --- fetch/corb/img-mime-types-coverage.tentative.sub.html | 7 +------ ...g-png-mislabeled-as-html-nosniff.tentative.sub.html | 10 ++-------- ...e-png-mislabeled-as-html-nosniff.tentative.sub.html | 10 ++-------- .../script-html-correctly-labeled.tentative.sub.html | 7 +------ ...esource-with-json-parser-breaker.tentative.sub.html | 7 +------ .../the-link-element/resources/link-style-error.js | 8 +------- 6 files changed, 8 insertions(+), 41 deletions(-) diff --git a/fetch/corb/img-mime-types-coverage.tentative.sub.html b/fetch/corb/img-mime-types-coverage.tentative.sub.html index c2aa93236360de..e2386de2f2a949 100644 --- a/fetch/corb/img-mime-types-coverage.tentative.sub.html +++ b/fetch/corb/img-mime-types-coverage.tentative.sub.html @@ -53,12 +53,7 @@ const get_url = (mime) => { // www1 is cross-origin, so the HTTP response is CORB-eligible --> - // - // TODO(lukasza@chromium.org): Once https://crbug.com/888079 and - // https://crbug.com/891872 are fixed, we should use a cross-*origin* - // rather than cross-*site* URL below (e.g. s/hosts[alt]/domains/g). - // See also https://crbug.com/918660 for more context. - url = "http://{{hosts[alt][www1]}}:{{ports[http][0]}}" + url = "http://{{domains[www1]}}:{{ports[http][0]}}" url = url + "/fetch/nosniff/resources/image.py" if (mime != null) { url += "?type=" + encodeURIComponent(mime) diff --git a/fetch/corb/img-png-mislabeled-as-html-nosniff.tentative.sub.html b/fetch/corb/img-png-mislabeled-as-html-nosniff.tentative.sub.html index 46403b0b18107c..82adc47b0cf31c 100644 --- a/fetch/corb/img-png-mislabeled-as-html-nosniff.tentative.sub.html +++ b/fetch/corb/img-png-mislabeled-as-html-nosniff.tentative.sub.html @@ -7,11 +7,5 @@ - - + + diff --git a/fetch/corb/preload-image-png-mislabeled-as-html-nosniff.tentative.sub.html b/fetch/corb/preload-image-png-mislabeled-as-html-nosniff.tentative.sub.html index 2fc93f8317e6bc..cea80f2f89fac4 100644 --- a/fetch/corb/preload-image-png-mislabeled-as-html-nosniff.tentative.sub.html +++ b/fetch/corb/preload-image-png-mislabeled-as-html-nosniff.tentative.sub.html @@ -17,14 +17,8 @@ }); - + + href="http://{{domains[www1]}}:{{ports[http][0]}}/fetch/corb/resources/png-mislabeled-as-html-nosniff.png"> diff --git a/fetch/corb/script-html-correctly-labeled.tentative.sub.html b/fetch/corb/script-html-correctly-labeled.tentative.sub.html index 407cef9158444d..8f4d7679e3d749 100644 --- a/fetch/corb/script-html-correctly-labeled.tentative.sub.html +++ b/fetch/corb/script-html-correctly-labeled.tentative.sub.html @@ -24,12 +24,7 @@ }); // www1 is cross-origin, so the HTTP response is CORB-eligible. - // - // TODO(lukasza@chromium.org): Once https://crbug.com/888079 and - // https://crbug.com/891872 are fixed, we should use a cross-*origin* - // rather than cross-*site* URL below (e.g. s/hosts[alt]/domains/g). - // See also https://crbug.com/918660 for more context. - script.src = 'http://{{hosts[alt][www1]}}:{{ports[http][0]}}/fetch/corb/resources/html-correctly-labeled.html'; + script.src = 'http://{{domains[www1]}}:{{ports[http][0]}}/fetch/corb/resources/html-correctly-labeled.html'; document.body.appendChild(script) }, "CORB-blocked script has no syntax errors"); diff --git a/fetch/corb/script-resource-with-json-parser-breaker.tentative.sub.html b/fetch/corb/script-resource-with-json-parser-breaker.tentative.sub.html index 03924cdad0dbad..cabc7b09c458ca 100644 --- a/fetch/corb/script-resource-with-json-parser-breaker.tentative.sub.html +++ b/fetch/corb/script-resource-with-json-parser-breaker.tentative.sub.html @@ -68,12 +68,7 @@ }); // www1 is cross-origin, so the HTTP response is CORB-eligible. - // - // TODO(lukasza@chromium.org): Once https://crbug.com/888079 and - // https://crbug.com/891872 are fixed, we should use a cross-*origin* - // rather than cross-*site* URL below (e.g. s/hosts[alt]/domains/g). - // See also https://crbug.com/918660 for more context. - var src_prefix = "http://{{hosts[alt][www1]}}:{{ports[http][0]}}/fetch/corb/resources/sniffable-resource.py"; + var src_prefix = "http://{{domains[www1]}}:{{ports[http][0]}}/fetch/corb/resources/sniffable-resource.py"; script.src = src_prefix + "?type=" + mime_type + "&body=" + encodeURIComponent(body); document.body.appendChild(script) }, "CORB-blocks '" + mime_type + "' that starts with the following JSON parser breaker: " + body); diff --git a/html/semantics/document-metadata/the-link-element/resources/link-style-error.js b/html/semantics/document-metadata/the-link-element/resources/link-style-error.js index 7ebc39ba6cc5b2..d1fa5ac2d6fcb4 100644 --- a/html/semantics/document-metadata/the-link-element/resources/link-style-error.js +++ b/html/semantics/document-metadata/the-link-element/resources/link-style-error.js @@ -1,13 +1,7 @@ ["", "@import"].forEach(linkType => { [ ["same-origin", "resources/css.py"], - - // TODO(lukasza@chromium.org): Once https://crbug.com/888079 and - // https://crbug.com/891872 are fixed, we should use a cross-*origin* rather - // than cross-*site* URL below (e.g. s/ HTTP_NOTSAMESITE_ORIGIN / - // HTTP_REMOTE_ORIGIN /g). See also https://crbug.com/918660 for more - // context. - ["cross-origin", get_host_info().HTTP_NOTSAMESITE_ORIGIN + "/html/semantics/document-metadata/the-link-element/resources/css.py"] + ["cross-origin", get_host_info().HTTP_REMOTE_ORIGIN + "/html/semantics/document-metadata/the-link-element/resources/css.py"] ].forEach(originType => { ["no Content-Type", "wrong Content-Type", "broken Content-Type"].forEach(contentType => { ["no nosniff", "nosniff"].forEach(nosniff => {