| commit | 19f0e5b428566278daf7902c469a540cf1353ea5 | [log] [tgz] |
|---|---|---|
| author | Ian Clelland <iclelland@chromium.org> | Wed Nov 11 20:28:46 2020 |
| committer | Blink WPT Bot <blink-w3c-test-autoroller@chromium.org> | Wed Nov 11 20:49:56 2020 |
| tree | 34212dfd0211740913f141a113b495b45ddf6dc1 | |
| parent | 745dadda961bea859f6f48a9377bb125ac2dd270 [diff] |
Change Feature-Policy header semantics This change implements the algorithmic changes for a recent change to the Feature/Permissions policy spec: https://github.com/w3c/webappsec-permissions-policy/pull/378 With this change, the Feature-Policy or Permissions-Policy headers by themselves cannot be used to delegate powerful features to cross-origin iframes; the allow attribute must be used as well. To allow this to still be ergonomic, the default value for the header for powerful features is effectively '*', so that delegation is allowed by the header implicitly. The header can now be used effectively to completely block access to a feature, as any origins not present in the header allowlist cannot be granted the feature through the allow attribute. This also removes some code which previously only existed to track the cases where this change would affect the output of an IsFeatureEnabled call. Several tests will have been modified or rewritten prior to landing this change; this CL depends on the following (though they are all independent, so they are not chained together): - https://crrev.com/c/2424633 - https://crrev.com/c/2424634 - https://crrev.com/c/2424635 - https://crrev.com/c/2424654 - https://crrev.com/c/2424655 - https://crrev.com/c/2424657 - https://crrev.com/c/2425003 - https://crrev.com/c/2425004 (See Patchset 8 for a version with the changes from all of those CLs included.) This CL, while large, can best be understood as the union of the following changes: - Algorithm changes, including the removal of previous "what-if" code and metrics: feature_policy.cc feature_policy.h execution_context.cc - Unit tests to cover those changes: feature_policy_unittest.cc render_frame_host_feature_policy_unittest.cc - Update WPT test expectations to account for the change in behaviour when only the header is used: 3p/b/web_tests/external/wpt/feature-policy/feature-policy-* 3p/b/web_tests/external/wpt/permissions-policy/permissions-policy-* - Update Blink web tests for fullscreen and payment request to validate that both are now working correctly with the new header semantics: 3p/b/web_tests/http/tests/feature-policy/fullscreen* 3p/b/web_tests/http/tests/feature-policy/payment* - Update Blink web tests for the iframe policy JS interface because of new test expectations when features are allowed/disallowed by header: 3p/b/renderer/core/feature_policy/policy_test.cc 3p/b/web_tests/http/tests/feature-policy/policy_iframes.php Bug: 1095641, 937131 Change-Id: Iecbb0950c27a4565998ee5192590d6691a03b4a3 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2363169 Reviewed-by: Yoav Weiss <yoavweiss@chromium.org> Reviewed-by: Charlie Hu <chenleihu@google.com> Reviewed-by: Ken Buchanan <kenrb@chromium.org> Commit-Queue: Ian Clelland <iclelland@chromium.org> Cr-Commit-Position: refs/heads/master@{#826408}
The web-platform-tests Project is a cross-browser test suite for the Web-platform stack. Writing tests in a way that allows them to be run in all browsers gives browser projects confidence that they are shipping software that is compatible with other implementations, and that later implementations will be compatible with their implementations. This in turn gives Web authors/developers confidence that they can actually rely on the Web platform to deliver on the promise of working across browsers and devices without needing extra layers of abstraction to paper over the gaps left by specification editors and implementors.
The most important sources of information and activity are:
#testing on irc.w3.org; includes participants located around the world, but busiest during the European working day; all discussion is archived hereIf you'd like clarification about anything, don't hesitate to ask in the chat room or on the mailing list.
Clone or otherwise get https://github.com/web-platform-tests/wpt.
Note: because of the frequent creation and deletion of branches in this repo, it is recommended to “prune” stale branches when fetching updates, i.e. use git pull --prune (or git fetch -p && git merge).
See the documentation website and in particular the system setup for running tests locally.
The wpt command provides a frontend to a variety of tools for working with and running web-platform-tests. Some of the most useful commands are:
wpt serve - For starting the wpt http serverwpt run - For running tests in a browserwpt lint - For running the lint against all testswpt manifest - For updating or generating a MANIFEST.json test manifestwpt install - For installing the latest release of a browser or webdriver server on the local machine.wpt serve-wave - For starting the wpt http server and the WAVE test runner. For more details on how to use the WAVE test runner see the documentation.On Windows wpt commands must be prefixed with python or the path to the python binary (if python is not in your %PATH%).
python wpt [command]
Alternatively, you may also use Bash on Ubuntu on Windows in the Windows 10 Anniversary Update build, then access your windows partition from there to launch wpt commands.
Please make sure git and your text editor do not automatically convert line endings, as it will cause lint errors. For git, please set git config core.autocrlf false in your working tree.
The master branch is automatically synced to http://w3c-test.org/.
Pull requests are automatically mirrored except those that modify sensitive resources (such as .py). The latter require someone with merge access to comment with “LGTM” or “w3c-test:mirror” to indicate the pull request has been checked.
Save the Web, Write Some Tests!
Absolutely everyone is welcome to contribute to test development. No test is too small or too simple, especially if it corresponds to something for which you've noted an interoperability bug in a browser.
The way to contribute is just as usual:
git checkout -b topic../wpt lint as described above.If you spot an issue with a test and are not comfortable providing a pull request per above to fix it, please file a new issue. Thank you!