From f19917fc73bd54823eded982d7b8adbb8d2b94bf Mon Sep 17 00:00:00 2001 From: Yutaka Hirano Date: Thu, 5 Mar 2020 21:35:13 +0000 Subject: [PATCH] Bug 1618527 [wpt PR 22005] - Introduce COEP reporting for CORP (3/3), a=testonly Automatic update from web-platform-tests Introduce COEP reporting for CORP (3/3) 1: https://crrev.com/c/2074177 2: https://crrev.com/c/2075002 3: [this] This series of CLs implements https://github.com/mikewest/corpp/pull/9. We introduce network::mojom::CrossOriginEmbedderPolicyReporter and its implementation content::CrossOriginEmbedderPolicyReporter, implement the reporting logic in content::CrossOriginEmbedderPolicyReporter and the CORP check, and plumb the mojo interface. This CL creates CrossOriginEmbedderPolicyReport during the frame navigation and dedicated worker initialization, and give it to the network service so that (possibly potential) CORP blocks are reported. Bug: 1052764 Change-Id: Ia39ff8277eb23d96025f5e6fba4e5a4fa6ffde70 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2076223 Commit-Queue: Yutaka Hirano Reviewed-by: Kinuko Yasuda Cr-Commit-Position: refs/heads/master@{#747176} -- wpt-commits: 0d183bf3945eda537d23f8d37afbde1dad982544 wpt-pr: 22005 --- .../report-only-require-corp.https.html | 86 +++++++++++++++++++ ...eport-only-require-corp.https.html.headers | 1 + .../reporting.https.html | 68 +++++++++++++++ .../resources/report.py | 19 ++++ .../resources/stash-take.py | 9 ++ .../resources/subresource-corp.html | 35 ++++++++ .../subresource-corp.html.sub.headers | 4 + 7 files changed, 222 insertions(+) create mode 100644 testing/web-platform/tests/html/cross-origin-embedder-policy/report-only-require-corp.https.html create mode 100644 testing/web-platform/tests/html/cross-origin-embedder-policy/report-only-require-corp.https.html.headers create mode 100644 testing/web-platform/tests/html/cross-origin-embedder-policy/reporting.https.html create mode 100644 testing/web-platform/tests/html/cross-origin-embedder-policy/resources/report.py create mode 100644 testing/web-platform/tests/html/cross-origin-embedder-policy/resources/stash-take.py create mode 100644 testing/web-platform/tests/html/cross-origin-embedder-policy/resources/subresource-corp.html create mode 100644 testing/web-platform/tests/html/cross-origin-embedder-policy/resources/subresource-corp.html.sub.headers diff --git a/testing/web-platform/tests/html/cross-origin-embedder-policy/report-only-require-corp.https.html b/testing/web-platform/tests/html/cross-origin-embedder-policy/report-only-require-corp.https.html new file mode 100644 index 0000000000000..ff9e5b64a084e --- /dev/null +++ b/testing/web-platform/tests/html/cross-origin-embedder-policy/report-only-require-corp.https.html @@ -0,0 +1,86 @@ + + +Cross-Origin-Embedder-Policy-Report-Only header does not affect the actual behavior + + + + +
+ diff --git a/testing/web-platform/tests/html/cross-origin-embedder-policy/report-only-require-corp.https.html.headers b/testing/web-platform/tests/html/cross-origin-embedder-policy/report-only-require-corp.https.html.headers new file mode 100644 index 0000000000000..289659a41fdf4 --- /dev/null +++ b/testing/web-platform/tests/html/cross-origin-embedder-policy/report-only-require-corp.https.html.headers @@ -0,0 +1 @@ +cross-origin-embedder-policy-report-only: require-corp diff --git a/testing/web-platform/tests/html/cross-origin-embedder-policy/reporting.https.html b/testing/web-platform/tests/html/cross-origin-embedder-policy/reporting.https.html new file mode 100644 index 0000000000000..3a0aebe49a7ba --- /dev/null +++ b/testing/web-platform/tests/html/cross-origin-embedder-policy/reporting.https.html @@ -0,0 +1,68 @@ + + + + + + + + + diff --git a/testing/web-platform/tests/html/cross-origin-embedder-policy/resources/report.py b/testing/web-platform/tests/html/cross-origin-embedder-policy/resources/report.py new file mode 100644 index 0000000000000..8adf3009d08e2 --- /dev/null +++ b/testing/web-platform/tests/html/cross-origin-embedder-policy/resources/report.py @@ -0,0 +1,19 @@ +import json + + +def main(request, response): + if request.method == 'OPTIONS': + # CORS preflight + response.headers.set('Access-Control-Allow-Origin', '*') + response.headers.set('Access-Control-Allow-Methods', 'POST') + response.headers.set('Access-Control-Allow-Headers', 'content-type') + return '' + + url_dir = '/'.join(request.url_parts.path.split('/')[:-1]) + '/' + key = request.GET.first('key') + reports = request.server.stash.take(key, url_dir) or [] + for report in json.loads(request.body): + reports.append(report) + request.server.stash.put(key, reports, url_dir) + response.headers.set('Access-Control-Allow-Origin', '*') + return 'done' diff --git a/testing/web-platform/tests/html/cross-origin-embedder-policy/resources/stash-take.py b/testing/web-platform/tests/html/cross-origin-embedder-policy/resources/stash-take.py new file mode 100644 index 0000000000000..73e0def86caed --- /dev/null +++ b/testing/web-platform/tests/html/cross-origin-embedder-policy/resources/stash-take.py @@ -0,0 +1,9 @@ +from wptserve.handlers import json_handler + + +@json_handler +def main(request, response): + path = '/'.join(request.url_parts.path.split('/')[:-1]) + '/' + key = request.GET.first('key') + response.headers.set('Access-Control-Allow-Origin', '*') + return request.server.stash.take(key, path) diff --git a/testing/web-platform/tests/html/cross-origin-embedder-policy/resources/subresource-corp.html b/testing/web-platform/tests/html/cross-origin-embedder-policy/resources/subresource-corp.html new file mode 100644 index 0000000000000..4b029700e0e9a --- /dev/null +++ b/testing/web-platform/tests/html/cross-origin-embedder-policy/resources/subresource-corp.html @@ -0,0 +1,35 @@ + + + + + diff --git a/testing/web-platform/tests/html/cross-origin-embedder-policy/resources/subresource-corp.html.sub.headers b/testing/web-platform/tests/html/cross-origin-embedder-policy/resources/subresource-corp.html.sub.headers new file mode 100644 index 0000000000000..00609991031ea --- /dev/null +++ b/testing/web-platform/tests/html/cross-origin-embedder-policy/resources/subresource-corp.html.sub.headers @@ -0,0 +1,4 @@ +cache-control: no-store, no-cache +report-to: { "group": "endpoint", "max_age": 3600, "endpoints": [{ "url": "https://{{hosts[][www]}}:{{ports[https][0]}}/html/cross-origin-embedder-policy/resources/report.py?key={{GET[token1]}}" }] }, { "group": "report-only-endpoint", "max_age": 3600, "endpoints": [{ "url": "https://{{hosts[][www]}}:{{ports[https][0]}}/html/cross-origin-embedder-policy/resources/report.py?key={{GET[token2]}}" }] } +cross-origin-embedder-policy: require-corp; report-to="endpoint" +cross-origin-embedder-policy-report-only: require-corp; report-to="report-only-endpoint"