Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add initial support for 'Cross-Origin-Opener-Policy' HTTP header
https://bugs.webkit.org/show_bug.cgi?id=192193 <rdar://problem/42013525> Reviewed by Geoff Garen. LayoutTests/imported/w3c: Rebaseline WPT tests now that most tests are passing. * web-platform-tests/IndexedDB/serialize-sharedarraybuffer-throws.https-expected.txt: * web-platform-tests/html/cross-origin-embedder-policy/cross-origin-isolated-permission.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/blob-popup.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/coep-blob-popup.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/coep-navigate-popup.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/coep-redirect.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/coep.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/coop-coep-sandbox.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/coop-csp-sandbox-navigate.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/coop-csp-sandbox.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/coop-navigated-history-popup.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/coop-navigated-popup.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/coop-sandbox.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/header-parsing.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/historical/coep-navigate-popup-unsafe-inherit.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-cross-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-same-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/historical/popup-same-origin-unsafe-allow-outgoing-with-same-site.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-cross-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-same-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/historical/popup-same-site-unsafe-allow-outgoing-with-same-site.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/historical/popup-same-site-with-cross-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/historical/popup-same-site-with-same-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/historical/popup-same-site-with-same-site.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin-allow-popups.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/iframe-popup-same-origin-allow-popups-to-same-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/iframe-popup-same-origin-to-same-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/iframe-popup-same-origin-to-unsafe-none.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/iframe-popup-unsafe-none-to-same-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/javascript-url.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/navigate-to-aboutblank.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/no-https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-coop-by-sw-from-coop.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-coop-by-sw.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-redirect-cache.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-redirect-same-origin-allow-popups.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-cross-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-same-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-same-origin-allow-popups-with-same-site.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-same-origin-with-cross-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-same-origin-with-same-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-same-origin-with-same-site.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-unsafe-none-with-cross-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-unsafe-none-with-same-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-unsafe-none-with-same-site.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-unspecified-with-cross-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-unspecified-with-same-origin.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-unspecified-with-same-site.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/popup-with-structured-header.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/resource-popup.https-expected.txt: * web-platform-tests/html/cross-origin-opener-policy/resources/resource-popup.html: * web-platform-tests/html/dom/idlharness.worker-expected.txt: Source/WebCore: Add initial support for 'Cross-Origin-Opener-Policy' HTTP header: - https://html.spec.whatwg.org/multipage/origin.html#cross-origin-opener-policy-value Support is complete enough to pass most WPT tests with the exception of: - The ones involving blob. Support for Blob does not seem trivial so I will address separately (whatwg/html#5198). - The ones that requires reporting COOP enforcement as this is not supported yet. This is a fairly large task so I'll handle separately. - The ones that involve Cross-Origin-Embedder-Policy (COEP) and this is not yet supported. I tried to stay as close as possible to the HTML specification as possible in terms of structuring and naming. I also have code comments to link to the relevant HTML spec sections. Note that as it stands, we do not currently swap process based on COOP header. We merely do isolation of the new browsing context at JS level for now. At some point, we'll want to actually process-swap, once we support COEP and we want to re-enable some Web APIs such as SharedArrayBuffer. No new tests, covered by web-plaform-tests/html/cross-origin-opener-policy. * Headers.cmake: * Sources.txt: * WebCore.xcodeproj/project.pbxproj: * bindings/js/WebCoreBuiltinNames.h: * dom/Document.cpp: (WebCore::Document::initSecurityContext): (WebCore::Document::shouldForceNoOpenerBasedOnCOOP const): (WebCore::Document::crossOriginOpenerPolicy const): (WebCore::Document::setCrossOriginOpenerPolicy): * dom/Document.h: (WebCore::Document::isSameOriginAsTopDocument const): * dom/SecurityContext.cpp: (WebCore::SecurityContext::enforceSandboxFlags): * dom/SecurityContext.h: (WebCore::SecurityContext::creationSandboxFlags const): * inspector/InspectorFrontendClientLocal.cpp: (WebCore::InspectorFrontendClientLocal::openURLExternally): * loader/CrossOriginEmbedderPolicy.cpp: Copied from Source/WebCore/page/AbstractFrame.cpp. (WebCore::obtainCrossOriginEmbedderPolicy): * loader/CrossOriginEmbedderPolicy.h: Copied from Source/WebCore/page/AbstractFrame.cpp. * loader/CrossOriginOpenerPolicy.cpp: Added. (WebCore::obtainCrossOriginOpenerPolicy): * loader/CrossOriginOpenerPolicy.h: Copied from Source/WebCore/page/AbstractFrame.h. * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::willSendRequest): (WebCore::checkIfCOOPValuesRequireBrowsingContextGroupSwitch): (WebCore::computeResponseOriginAndCOOP): (WebCore::DocumentLoader::doCrossOriginOpenerHandlingOfResponse): (WebCore::DocumentLoader::enforceResponseCrossOriginOpenerPolicy): (WebCore::DocumentLoader::responseReceived): (WebCore::DocumentLoader::maybeLoadEmpty): * loader/DocumentLoader.h: (WebCore::DocumentLoader::crossOriginOpenerPolicy const): * loader/DocumentWriter.cpp: (WebCore::DocumentWriter::begin): * loader/FrameLoader.cpp: (WebCore::FrameLoader::didBeginDocument): (WebCore::FrameLoader::setOpener): (WebCore::FrameLoader::loadURL): (WebCore::FrameLoader::loadPostRequest): (WebCore::createWindow): (WebCore::FrameLoader::switchBrowsingContextsGroup): * loader/FrameLoader.h: * loader/NavigationAction.cpp: * loader/NavigationAction.h: (WebCore::NavigationAction::Requester::securityOrigin const): (WebCore::NavigationAction::Requester::topOrigin const): (WebCore::NavigationAction::Requester::crossOriginOpenerPolicy const): * page/AbstractFrame.cpp: (WebCore::AbstractFrame::resetWindowProxy): * page/AbstractFrame.h: * page/DOMWindow.cpp: (WebCore::DOMWindow::crossOriginIsolated const): (WebCore::DOMWindow::createWindow): * page/DOMWindow.h: * page/Frame.cpp: (WebCore::Frame::resetScript): * page/Frame.h: * page/Page.h: (WebCore::Page::setOpenedByDOMWithOpener): * page/WindowOrWorkerGlobalScope.idl: * page/csp/ContentSecurityPolicy.cpp: (WebCore::ContentSecurityPolicy::applyPolicyToScriptExecutionContext): * platform/network/HTTPHeaderNames.in: * platform/network/HTTPParsers.cpp: (WebCore::parseStructuredFieldValue): * platform/network/HTTPParsers.h: * platform/network/ResourceResponseBase.cpp: (WebCore::isSafeRedirectionResponseHeader): * workers/WorkerGlobalScope.cpp: (WebCore::WorkerGlobalScope::crossOriginIsolated const): * workers/WorkerGlobalScope.h: Source/WTF: Add experimental feature flag for 'Cross-Origin-Opener-Policy' HTTP header support. * Scripts/Preferences/WebPreferencesExperimental.yaml: LayoutTests: Update test expectations. * TestExpectations: * platform/ios-wk2/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt: * platform/mac-wk1/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt: * platform/mac-wk2/TestExpectations: * platform/mac-wk2/imported/w3c/web-platform-tests/html/dom/idlharness.https-expected.txt: * platform/mac/TestExpectations: git-svn-id: http://svn.webkit.org/repository/webkit/trunk@280504 268f45cc-cd09-0410-ab3c-d52691b4dbfc
- Loading branch information