HTML: cross-site SharedArrayBuffer ought to not work #17909
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
annevk
force-pushed
the
annevk/cross-site-sab-via-popup
branch
2 times, most recently
from
ea66246
to
ffc0177
Compare
annevk
changed the title
wpt-pr-bot
requested review from
domenic,
foolip,
jdm,
jgraham,
zcorpan and
zqzhang
3 tasks
annevk
force-pushed
the
annevk/cross-site-sab-via-popup
branch
from
ffc0177
to
3aebe61
Compare
annevk
force-pushed
the
annevk/cross-site-sab-via-popup
branch
from
3aebe61
to
848c0fc
Compare
|
To be clear, this is ready for review/suggestions. |
domenic
approved these changes
Aug 22, 2019
|
Sorry for the delay... Can you point me a link to the spec/document describing reasoning? |
|
Why shared memory is not cross-site? Because of browsers wanting one-process-per-site and cross-process shared memory not being a thing we want to expose to sites (or necessarily being a thing all architectures support). This follows from how agent clusters are defined, with whatwg/html#4361 and associated PR improving on that. |
| const frame = document.createElement("iframe"); | ||
| t.add_cleanup(() => frame.remove()); | ||
| frame.src = get_host_info().HTTPS_NOTSAMESITE_ORIGIN + new URL("resources/iframe-failure.html", location).pathname; | ||
| window.onmessage = t.unreached_func("Got a message event, expected a messageerror event"); |
There was a problem hiding this comment.
+frame.onerror = t.unreached_func(...);
There was a problem hiding this comment.
As that event is not defined for that element I'd rather not add that in case we want to add it in the future.
yutakahirano
approved these changes
Aug 26, 2019
|
Thank you! |
annevk
added a commit
to whatwg/html
that referenced
this pull request
Jun 29, 2020
A top-level navigation response with Cross-Origin-Opener-Policy set to same-origin and Cross-Origin-Embedder-Policy set to require-corp will create a cross-origin isolated browsing context group. And all agent clusters therein will be cross-origin isolated as well (shared and service workers can still not be, as they sit on the side). This change also: * Gates SharedArrayBuffer exposure behind that primitive for web compatibility reasons. * Gates SharedArrayBuffer sharing behind that primitive. * Exposes it through self.crossOriginIsolated. * Makes document.domain return before it mutates the origin. * Makes agent clusters keyed on origin. Tests: * web-platform-tests/wpt#17719 * web-platform-tests/wpt#17760 * web-platform-tests/wpt#17761 * web-platform-tests/wpt#17802 * web-platform-tests/wpt#17909 * web-platform-tests/wpt#18543 * web-platform-tests/wpt#20116 * web-platform-tests/wpt#22358 Closes #4732. Closes #5122. Closes #5444. Follow-up: #5435.
annevk
added a commit
to whatwg/html
that referenced
this pull request
Jul 8, 2020
A top-level navigation response with Cross-Origin-Opener-Policy set to same-origin and Cross-Origin-Embedder-Policy set to require-corp will create a cross-origin isolated browsing context group. And all agent clusters therein will be cross-origin isolated as well (shared and service workers can still not be, as they sit on the side). This change also: * Gates SharedArrayBuffer exposure behind that primitive for web compatibility reasons. * Gates SharedArrayBuffer sharing behind that primitive. * Exposes it through self.crossOriginIsolated. * Makes document.domain return before it mutates the origin. * Makes agent clusters keyed on origin. Tests: * web-platform-tests/wpt#17719 * web-platform-tests/wpt#17760 * web-platform-tests/wpt#17761 * web-platform-tests/wpt#17802 * web-platform-tests/wpt#17909 * web-platform-tests/wpt#18543 * web-platform-tests/wpt#20116 * web-platform-tests/wpt#22358 Closes #4732. Closes #5122. Closes #5444. Follow-up: #5435 (and #5362).
mfreed7
pushed a commit
to mfreed7/html
that referenced
this pull request
Sep 11, 2020
A top-level navigation response with Cross-Origin-Opener-Policy set to same-origin and Cross-Origin-Embedder-Policy set to require-corp will create a cross-origin isolated browsing context group. And all agent clusters therein will be cross-origin isolated as well (shared and service workers can still not be, as they sit on the side). This change also: * Gates SharedArrayBuffer exposure behind that primitive for web compatibility reasons. * Gates SharedArrayBuffer sharing behind that primitive. * Exposes it through self.crossOriginIsolated. * Makes document.domain return before it mutates the origin. * Makes agent clusters keyed on origin. Tests: * web-platform-tests/wpt#17719 * web-platform-tests/wpt#17760 * web-platform-tests/wpt#17761 * web-platform-tests/wpt#17802 * web-platform-tests/wpt#17909 * web-platform-tests/wpt#18543 * web-platform-tests/wpt#20116 * web-platform-tests/wpt#22358 Closes whatwg#4732. Closes whatwg#5122. Closes whatwg#5444. Follow-up: whatwg#5435 (and whatwg#5362).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is not great, but then Firefox does not ship SAB yet. I guess we did not test this since we did not have cross-site domains back in the day.
Please review #17761 first, this builds on that.