Andrew Paseltiner
772b1b5c15
Automatic update from web-platform-tests Strip fragments and credentials from COEP and DIP violation reports The CrossOriginEmbedderPolicyReporter and DocumentIsolationPolicyReporter were incorrectly preserving URL fragments in the blockedURL field of violation reports. This violates the specifications and can leak sensitive information. This CL introduces network::SerializeResponseUrlForReporting, which correctly strips fragments, usernames, and passwords from URLs for reporting purposes, following the Fetch specification. Spec links: - Fetch: https://fetch.spec.whatwg.org/#serialize-a-response-url-for-reporting - COEP: https://html.spec.whatwg.org/multipage/browsers.html#queue-a-cross-origin-embedder-policy-inheritance-violation - DIP: https://wicg.github.io/document-isolation-policy/#queue-a-document-isolation-policy-corp-violation-report The new function uses GURL::Replacements instead of GURL::GetAsReferrer() to ensure that local schemes like data: and blob: are supported. Using GetAsReferrer() would sanitize such URLs to empty strings, which caused regressions in COEP WPTs. Note: CrossOriginOpenerPolicyReporter currently uses GetAsReferrer() via a local SanitizedURL helper. While the COOP specification (specifically the "sanitize a URL for a report" algorithm [1]) does not have scheme restrictions and thus should support non-referrer schemes, this CL intentionally leaves COOP unchanged for now to maintain existing behavior and avoid unintentional side effects, as COOP's scheme constraints are currently different in implementation and consistency with the net/ reporting service [2] is currently preserved there. Both COOP and the general Reporting service currently deviate from their respective specifications by using GetAsReferrer(), which rejects non-referrer schemes like data: and blob:. This CL documents these discrepancies while ensuring COEP and DIP are spec-compliant. [1] https://html.spec.whatwg.org/multipage/browsers.html#sanitize-url-report [2] https://w3c.github.io/reporting/#strip-url-for-use-in-reports Fixed: 503719488 Force-WPT-Export: True Change-Id: Id14221951618e4f37512beb82ac5f10642f13760 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7790791 Reviewed-by: Camille Lamy <clamy@chromium.org> Commit-Queue: Andrew Paseltiner <apaseltiner@chromium.org> Reviewed-by: Eric Orth <ericorth@chromium.org> Cr-Commit-Position: refs/heads/main@{#1623313} -- wpt-commits: 4a13360c8d99119c47b1c9ad99f0d752b1680ca1 wpt-pr: 59582
This directory contains tests for Document-Isolation-Policy.