From 485cd3eb9bb0b7407496600455260591273bb795 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Wed, 8 Jul 2020 11:05:28 +0200 Subject: [PATCH] Add the cross-origin isolated primitive A top-level navigation response with Cross-Origin-Opener-Policy set to same-origin and Cross-Origin-Embedder-Policy set to require-corp will create a cross-origin isolated browsing context group. And all agent clusters therein will be cross-origin isolated as well (shared and service workers can still not be, as they sit on the side). This change also: * Gates SharedArrayBuffer exposure behind that primitive for web compatibility reasons. * Gates SharedArrayBuffer sharing behind that primitive. * Exposes it through self.crossOriginIsolated. * Makes document.domain return before it mutates the origin. * Makes agent clusters keyed on origin. Tests: * https://github.com/web-platform-tests/wpt/pull/17719 * https://github.com/web-platform-tests/wpt/pull/17760 * https://github.com/web-platform-tests/wpt/pull/17761 * https://github.com/web-platform-tests/wpt/pull/17802 * https://github.com/web-platform-tests/wpt/pull/17909 * https://github.com/web-platform-tests/wpt/pull/18543 * https://github.com/web-platform-tests/wpt/pull/20116 * https://github.com/web-platform-tests/wpt/issues/22358 Closes #4732. Closes #5122. Closes #5444. Follow-up: #5435 (and #5362). --- source | 117 ++++++++++++++++++++++++++++++++++++++++----------------- 1 file changed, 83 insertions(+), 34 deletions(-) diff --git a/source b/source index 150f5fd86cc..eb3dcecc753 100644 --- a/source +++ b/source @@ -8007,13 +8007,24 @@ interface DOMStringList {

If ! IsSharedArrayBuffer(value) is true, then:

    +

  1. Let agentCluster be the surrounding agent's + agent cluster.

    2. + +
  2. +

    If agentCluster's cross-origin isolated is false, then throw a + "DataCloneError" DOMException.

    + +

    This check is only needed when serializing (and not when deserializing) as + cross-origin isolated cannot change over time and a + SharedArrayBuffer cannot leave an agent cluster.

    +
    3. +

  3. If forStorage is true, then throw a "DataCloneError" DOMException.

  4. Set serialized to { [[Type]]: "SharedArrayBuffer", [[ArrayBufferData]]: value.[[ArrayBufferData]], [[ArrayBufferByteLength]]: size, - [[AgentCluster]]: the current Realm Record's corresponding agent - cluster }.

    5. + [[AgentCluster]]: agentCluster }.

@@ -77258,10 +77269,6 @@ console.assert(iframeWindow.frameElement === null);

A browsing context group has a cross-origin isolated boolean. It is initially false.

-

The impact of cross-origin - isolated is under discussion in issue - #4734.

-

To create a new browsing context group, run these steps:

@@ -79679,6 +79686,9 @@ interface BarProp { a registrable domain suffix of and is not equal to effectiveDomain, then throw a "SecurityError" DOMException.

+

  • If the surrounding agent's agent cluster's cross-origin + isolated is true, then return.

    • +

  • Set this Document object's origin's domain to the result of parsing the given value.

    • @@ -86848,6 +86858,10 @@ interface ApplicationCache : EventTarget {

    Contains various Window objects which can potentially reach each other, either directly or by using document.domain.

    +

    If the encompassing agent cluster's cross-origin isolated is true, + then all the Window objects will be same origin, can reach each other + directly, and document.domain will no-op.

    +

    Two Window objects that are same origin can be in different similar-origin window agents, for instance if they are each in their own browsing context group.

    @@ -86926,6 +86940,9 @@ interface ApplicationCache : EventTarget { ensure that web developers see interoperable behavior with regard to shared memory, even in the face of varying and changing user agent process models.

    +

    An agent cluster has an associated cross-origin isolated (a boolean), + which is initially false.

    +
    @@ -86933,44 +86950,33 @@ interface ApplicationCache : EventTarget {

    The following defines the allocation of the agent clusters of similar-origin window agents.

    -

    An agent cluster key is a site.

    - -

    whatwg/html #4734 is - expected to widen agent cluster key (but not site) to encompass all - tuple origins.

    - -

    To obtain an agent cluster key, given an origin - origin, return the result of obtaining a site with - origin.

    +

    An agent cluster key is a site or tuple origin whose host's registrable domain is non-null. I.e., an + agent cluster key can be a scheme-and-registrable-domain or any + origin.

    To obtain a similar-origin window agent, given an origin origin and browsing context group group, run these steps:

      -

    1. Let clusterKey be the result of obtaining an agent cluster key given - origin.

      2. - -

    2. Let agentCluster be the result of obtaining a browsing context agent cluster with - group and clusterKey.

      3. - -

    3. Return the single similar-origin window agent contained in - agentCluster.

      4. -
    +

  • Let clusterKey be the result of obtaining a + site with origin.

    • -

    To obtain a browsing context agent cluster, - given a browsing context group group and agent cluster key - key, run these steps:

    +

  • If group's cross-origin + isolated is true, then set clusterKey to origin.

    • -

    1. If group's agent cluster map[key] does not exist, then:

      + exists">does not exist, then:

      +

      1. Let agentCluster be a new agent cluster.

        2. +

      2. Set agentCluster's cross-origin isolated to group's + cross-origin isolated.

        3. +

      3. Add the result of creating an agent, given false, to agentCluster.

        4. @@ -86979,7 +86985,8 @@ interface ApplicationCache : EventTarget {
      2. -

    2. Return group's agent cluster map[key].

      3. +

    3. Return the single similar-origin window agent contained in group's + agent cluster map[key].

    This means that there is only one similar-origin window agent per @@ -87333,6 +87340,26 @@ interface ApplicationCache : EventTarget { is not yet defined in the JavaScript specification; see tc39/ecma262#1357.

    +
  • +

    If agent's agent cluster's cross-origin isolated is + false, then:

    + +
      +

    1. Let global be realm's global + object.

      2. + +

    2. Let status be ! global.[[Delete]]("SharedArrayBuffer").

      3. + +

    3. Assert: status is true.

      4. +
    + +

    This is done for compatibility with web content and there is some hope that this + can be removed in the future. Web developers can still get at the constructor through + new WebAssembly.Memory({ shared:true, initial:0, maximum:0 + }).buffer.constructor.

    +
    • +

  • Return realm execution context.

    • @@ -92138,6 +92165,7 @@ interface mixin DocumentAndElementEventHandlers { interface mixin WindowOrWorkerGlobalScope { [Replaceable] readonly attribute USVString origin; readonly attribute boolean isSecureContext; + readonly attribute boolean crossOriginIsolated; // base64 utility methods DOMString btoa(DOMString data); @@ -92161,13 +92189,19 @@ interface mixin WindowOrWorkerGlobalScope {
    self . isSecureContext
    -

    Returns whether or not this global object represents a secure context.

    self . origin
    -

    Returns the global object's origin, serialized as string.

    + +
    self . crossOriginIsolated
    +

    Returns whether the surrounding agent's agent cluster is + cross-origin isolated. This depends on the `Cross-Origin-Opener-Policy` and `Cross-Origin-Embedder-Policy` HTTP response headers and determines whether + SharedArrayBuffer can be used with postMessage() + APIs.

    @@ -92198,6 +92232,10 @@ document.body.appendChild(frame) data-x="concept-settings-object-origin">origin, serialized.

    +

    The crossOriginIsolated getter steps + are to return the surrounding agent's agent cluster's cross-origin + isolated.

    +
    @@ -99090,6 +99128,17 @@ interface SharedWorkerGlobalScope : WorkerGlobalScope { obtaining an embedder policy from response.

    +
  • +

    If worker global scope's embedder policy is "require-corp" and is shared is true, then set + agent's agent cluster's cross-origin isolated to + true.

    + +

    This really ought to be set when the agent cluster is created, which requires a + redesign of this section.

    +
    • +

  • If the result of checking a global object's embedder policy with worker global scope, owner, and response is false, then set response to a network