From 450bef112cf7cd48db1e8307eb385a04a93d59b5 Mon Sep 17 00:00:00 2001 From: Noam Rosenthal Date: Sat, 4 Feb 2023 07:05:34 -0800 Subject: [PATCH] Consolidate iframe & object resource timing code paths So far several of the decision making in resource timing for subframe navigations (iframe/object/embed) was duplicated, e.g. both in blink and in content. This has led to race conditions, inconsistencies and sometimes XSS leaks. This patch attempts to improve the situation by consolidating the code paths: - CorsUrlLoader registers redirect end time, and whether subframe navigations should be considered as "cross-origin" for resource timing (both defined in the fetch spec). - NavigationRequest saves is_container_initiated, which ensures only container-initiated navigations are reported to the parent, as specified in the HTML spec (https://html.spec.whatwg.org/#create-navigation-params-by-fetching, #8) - Both object fallbacks and cancelled navigations (204/205) report to the parent via RenderFrameImpl, and blink converts that to a ResourceTimingInfo object. This allows us to remove the duplicated resource timing creation code in //content. - We report fallback resource timing also for plugin error events and not only for load events. Change-Id: Id37d23cd02eee9e38f812e6f3da99caedafdee3d --- ...entries-for-object-frame-options-deny.html | 35 +++++++++++++++++++ .../resources/object-frame-options-200.asis | 6 ++++ .../resources/object-frame-options-403.asis | 6 ++++ 3 files changed, 47 insertions(+) create mode 100644 resource-timing/entries-for-object-frame-options-deny.html create mode 100644 resource-timing/resources/object-frame-options-200.asis create mode 100644 resource-timing/resources/object-frame-options-403.asis diff --git a/resource-timing/entries-for-object-frame-options-deny.html b/resource-timing/entries-for-object-frame-options-deny.html new file mode 100644 index 000000000000000..b89b15d5153deb9 --- /dev/null +++ b/resource-timing/entries-for-object-frame-options-deny.html @@ -0,0 +1,35 @@ + + + + + + + + + + + + + + + diff --git a/resource-timing/resources/object-frame-options-200.asis b/resource-timing/resources/object-frame-options-200.asis new file mode 100644 index 000000000000000..122445326bdef6d --- /dev/null +++ b/resource-timing/resources/object-frame-options-200.asis @@ -0,0 +1,6 @@ +HTTP/1.0 200 OK +Content-Type: text/html +X-Frame-Options: DENY +Content-Security-Policy: frame-ancestors 'none' + +Hello diff --git a/resource-timing/resources/object-frame-options-403.asis b/resource-timing/resources/object-frame-options-403.asis new file mode 100644 index 000000000000000..fd64f0bcdbb7c17 --- /dev/null +++ b/resource-timing/resources/object-frame-options-403.asis @@ -0,0 +1,6 @@ +HTTP/1.0 403 OK +Content-Type: text/html +X-Frame-Options: DENY +Content-Security-Policy: frame-ancestors 'none' + +Hello