https://bugs.webkit.org/show_bug.cgi?id=201353
<rdar://problem/
54895650>
Source/WebKit:
Majority of this patch was written by John Wilander <wilander@apple.com>.
Patch by Kate Cheney <katherine_cheney@apple.com> on 2019-09-26
Reviewed by Brent Fulgham.
When tracking protections are enabled, we should downgrade all third-party
referrers to their origins. Note that this downgrade will be specific to
Cocoa so other ports will have to adopt as they see fit.
Cocoa already does this downgrade in ephemeral sessions (shipping).
The majority of these changes are test infrastructure. The functional
change is in WebKit::NetworkDataTaskCocoa and WebKit::NetworkSession.
* NetworkProcess/NetworkProcess.cpp:
(WebKit::NetworkProcess::setShouldDowngradeReferrerForTesting):
* NetworkProcess/NetworkProcess.h:
* NetworkProcess/NetworkProcess.messages.in:
* NetworkProcess/NetworkSession.cpp:
(WebKit::NetworkSession::isResourceLoadStatisticsEnabled const):
(WebKit::NetworkSession::setShouldDowngradeReferrerForTesting):
(WebKit::NetworkSession::shouldDowngradeReferrer const):
* NetworkProcess/NetworkSession.h:
* NetworkProcess/cocoa/NetworkDataTaskCocoa.h:
* NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
(WebKit::NetworkDataTaskCocoa::isThirdPartyRequest const):
(WebKit::NetworkDataTaskCocoa::NetworkDataTaskCocoa):
(WebKit::NetworkDataTaskCocoa::restrictRequestReferrerToOriginIfNeeded):
(WebKit::NetworkDataTaskCocoa::willPerformHTTPRedirection):
(WebKit::NetworkDataTaskCocoa::isThirdPartyRequest): Deleted.
* UIProcess/API/C/WKWebsiteDataStoreRef.cpp:
(WKWebsiteDataStoreSetResourceLoadStatisticsShouldDowngradeReferrerForTesting):
(WKWebsiteDataStoreStatisticsResetToConsistentState):
* UIProcess/API/C/WKWebsiteDataStoreRef.h:
* UIProcess/Network/NetworkProcessProxy.cpp:
(WebKit::NetworkProcessProxy::setShouldDowngradeReferrerForTesting):
* UIProcess/Network/NetworkProcessProxy.h:
* UIProcess/WebsiteData/WebsiteDataStore.cpp:
(WebKit::WebsiteDataStore::setResourceLoadStatisticsShouldDowngradeReferrerForTesting):
* UIProcess/WebsiteData/WebsiteDataStore.h:
Tools:
Majority of this patch was written by John Wilander <wilander@apple.com>.
Patch by Kate Cheney <katherine_cheney@apple.com> on 2019-09-26
Reviewed by Brent Fulgham.
The changes to the TestRunner facilitates an opt-out for test cases
that either test the referrer mechanism explicitly or tests that
rely on the full referrer to be sent.
The new boolean variable and early return in
TestRunner::setStatisticsShouldDowngradeReferrer() prevent the same
event from trying to set multiple TestRunner callbacks.
* WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
* WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
(WTR::InjectedBundle::didReceiveMessageToPage):
* WebKitTestRunner/InjectedBundle/TestRunner.cpp:
(WTR::TestRunner::setStatisticsShouldDowngradeReferrer):
(WTR::TestRunner::statisticsCallDidSetShouldDowngradeReferrerCallback):
* WebKitTestRunner/InjectedBundle/TestRunner.h:
* WebKitTestRunner/TestController.cpp:
(WTR::TestController::setStatisticsShouldDowngradeReferrer):
* WebKitTestRunner/TestController.h:
* WebKitTestRunner/TestInvocation.cpp:
(WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):
(WTR::TestInvocation::didSetShouldDowngradeReferrer):
* WebKitTestRunner/TestInvocation.h:
LayoutTests:
Majority of this patch was written by John Wilander <wilander@apple.com>
Patch by Kate Cheney <katherine_cheney@apple.com> on 2019-09-26
Reviewed by Brent Fulgham.
The changes in the two http/tests/resourceLoadStatistics/strip-referrer-to-origin*
tests and the http/tests/navigation/ping-attribute/* tests are for the functional
change. The other changes are to make use of the new
testRunner.setStatisticsShouldDowngradeReferrer() to maintain earlier functionality.
TestRunner::setStatisticsShouldDowngradeReferrer() function is not
supported for mac-wk1, win or wincairo.
* http/tests/blink/sendbeacon/beacon-cross-origin-expected.txt:
* http/tests/navigation/ping-attribute/anchor-cross-origin.html:
* http/tests/navigation/ping-attribute/area-cross-origin.html:
* http/tests/referrer-policy-script/no-referrer-when-downgrade/cross-origin-http-http.html:
* http/tests/referrer-policy-script/no-referrer-when-downgrade/cross-origin-http.https.html:
* http/tests/referrer-policy-script/no-referrer-when-downgrade/same-origin.html:
* http/tests/referrer-policy-script/no-referrer/cross-origin-http-http.html:
* http/tests/referrer-policy-script/no-referrer/cross-origin-http.https.html:
* http/tests/referrer-policy-script/no-referrer/same-origin.html:
* http/tests/referrer-policy-script/origin-when-cross-origin/cross-origin-http-http.html:
* http/tests/referrer-policy-script/origin-when-cross-origin/cross-origin-http.https.html:
* http/tests/referrer-policy-script/origin-when-cross-origin/same-origin.html:
* http/tests/referrer-policy-script/origin/cross-origin-http-http.html:
* http/tests/referrer-policy-script/origin/cross-origin-http.https.html:
* http/tests/referrer-policy-script/origin/same-origin.html:
* http/tests/referrer-policy-script/same-origin/cross-origin-http-http.html:
* http/tests/referrer-policy-script/same-origin/cross-origin-http.https.html:
* http/tests/referrer-policy-script/same-origin/same-origin.html:
* http/tests/referrer-policy-script/strict-origin-when-cross-origin/cross-origin-http-http.html:
* http/tests/referrer-policy-script/strict-origin-when-cross-origin/cross-origin-http.https.html:
* http/tests/referrer-policy-script/strict-origin-when-cross-origin/same-origin.html:
* http/tests/referrer-policy-script/strict-origin/cross-origin-http-http.html:
* http/tests/referrer-policy-script/strict-origin/cross-origin-http.https.html:
* http/tests/referrer-policy-script/strict-origin/same-origin.html:
* http/tests/referrer-policy-script/unsafe-url/cross-origin-http-http.html:
* http/tests/referrer-policy-script/unsafe-url/cross-origin-http.https.html:
* http/tests/referrer-policy-script/unsafe-url/same-origin.html:
* http/tests/referrer-policy/no-referrer-when-downgrade/cross-origin-http-http.html:
* http/tests/referrer-policy/no-referrer-when-downgrade/cross-origin-http.https.html:
* http/tests/referrer-policy/no-referrer-when-downgrade/same-origin.html:
* http/tests/referrer-policy/unsafe-url/cross-origin-http-http.html:
* http/tests/referrer-policy/unsafe-url/cross-origin-http.https.html:
* http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-requests.html: Removed.
* http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-redirects-expected.txt: Renamed from LayoutTests/http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-redirects-expected.txt.
* http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-redirects.html: Copied from LayoutTests/http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-redirects.html.
* http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-requests-expected.txt: Renamed from LayoutTests/http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-requests-expected.txt.
* http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-requests.html: Renamed from LayoutTests/http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-redirects.html.
* http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.php:
* http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.php:
* http/tests/security/referrer-policy-header.html:
* platform/ios-wk2/TestExpectations:
* platform/ios/TestExpectations:
* platform/mac-wk1/TestExpectations:
* platform/mac-wk2/TestExpectations:
* platform/win/TestExpectations:
* platform/wincairo/TestExpectations:
* platform/wk2/TestExpectations:
* resources/testharnessreport.js:
* resources/js-test.js:
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@250413
268f45cc-cd09-0410-ab3c-
d52691b4dbfc
+2019-09-26 Kate Cheney <katherine_cheney@apple.com>
+
+ Resource Load Statistics: Downgrade all third-party referrer headers
+ https://bugs.webkit.org/show_bug.cgi?id=201353
+ <rdar://problem/54895650>
+
+ Majority of this patch was written by John Wilander <wilander@apple.com>
+
+ Reviewed by Brent Fulgham.
+
+ The changes in the two http/tests/resourceLoadStatistics/strip-referrer-to-origin*
+ tests and the http/tests/navigation/ping-attribute/* tests are for the functional
+ change. The other changes are to make use of the new
+ testRunner.setStatisticsShouldDowngradeReferrer() to maintain earlier functionality.
+
+ TestRunner::setStatisticsShouldDowngradeReferrer() function is not
+ supported for mac-wk1, win or wincairo.
+
+ * http/tests/blink/sendbeacon/beacon-cross-origin-expected.txt:
+ * http/tests/navigation/ping-attribute/anchor-cross-origin.html:
+ * http/tests/navigation/ping-attribute/area-cross-origin.html:
+ * http/tests/referrer-policy-script/no-referrer-when-downgrade/cross-origin-http-http.html:
+ * http/tests/referrer-policy-script/no-referrer-when-downgrade/cross-origin-http.https.html:
+ * http/tests/referrer-policy-script/no-referrer-when-downgrade/same-origin.html:
+ * http/tests/referrer-policy-script/no-referrer/cross-origin-http-http.html:
+ * http/tests/referrer-policy-script/no-referrer/cross-origin-http.https.html:
+ * http/tests/referrer-policy-script/no-referrer/same-origin.html:
+ * http/tests/referrer-policy-script/origin-when-cross-origin/cross-origin-http-http.html:
+ * http/tests/referrer-policy-script/origin-when-cross-origin/cross-origin-http.https.html:
+ * http/tests/referrer-policy-script/origin-when-cross-origin/same-origin.html:
+ * http/tests/referrer-policy-script/origin/cross-origin-http-http.html:
+ * http/tests/referrer-policy-script/origin/cross-origin-http.https.html:
+ * http/tests/referrer-policy-script/origin/same-origin.html:
+ * http/tests/referrer-policy-script/same-origin/cross-origin-http-http.html:
+ * http/tests/referrer-policy-script/same-origin/cross-origin-http.https.html:
+ * http/tests/referrer-policy-script/same-origin/same-origin.html:
+ * http/tests/referrer-policy-script/strict-origin-when-cross-origin/cross-origin-http-http.html:
+ * http/tests/referrer-policy-script/strict-origin-when-cross-origin/cross-origin-http.https.html:
+ * http/tests/referrer-policy-script/strict-origin-when-cross-origin/same-origin.html:
+ * http/tests/referrer-policy-script/strict-origin/cross-origin-http-http.html:
+ * http/tests/referrer-policy-script/strict-origin/cross-origin-http.https.html:
+ * http/tests/referrer-policy-script/strict-origin/same-origin.html:
+ * http/tests/referrer-policy-script/unsafe-url/cross-origin-http-http.html:
+ * http/tests/referrer-policy-script/unsafe-url/cross-origin-http.https.html:
+ * http/tests/referrer-policy-script/unsafe-url/same-origin.html:
+ * http/tests/referrer-policy/no-referrer-when-downgrade/cross-origin-http-http.html:
+ * http/tests/referrer-policy/no-referrer-when-downgrade/cross-origin-http.https.html:
+ * http/tests/referrer-policy/no-referrer-when-downgrade/same-origin.html:
+ * http/tests/referrer-policy/unsafe-url/cross-origin-http-http.html:
+ * http/tests/referrer-policy/unsafe-url/cross-origin-http.https.html:
+ * http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-requests.html: Removed.
+ * http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-redirects-expected.txt: Renamed from LayoutTests/http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-redirects-expected.txt.
+ * http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-redirects.html: Copied from LayoutTests/http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-redirects.html.
+ * http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-requests-expected.txt: Renamed from LayoutTests/http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-requests-expected.txt.
+ * http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-requests.html: Renamed from LayoutTests/http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-redirects.html.
+ * http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.php:
+ * http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.php:
+ * http/tests/security/referrer-policy-header.html:
+ * platform/ios-wk2/TestExpectations:
+ * platform/ios/TestExpectations:
+ * platform/mac-wk1/TestExpectations:
+ * platform/mac-wk2/TestExpectations:
+ * platform/win/TestExpectations:
+ * platform/wincairo/TestExpectations:
+ * platform/wk2/TestExpectations:
+ * resources/testharnessreport.js:
+ * resources/js-test.js:
+
2019-09-26 Eric Carlson <eric.carlson@apple.com>
REGRESSION (iOS 13): Trying to record just audio using HTML Media Capture crashes Safari
PASS Beacon sent successfully
PASS Content-Type: text/plain;charset=UTF-8
PASS Origin: http://127.0.0.1:8000
-PASS Referer: http://127.0.0.1:8000/blink/sendbeacon/beacon-cross-origin.html
+PASS Referer: http://127.0.0.1:8000/
PASS Request-Method: POST
PASS Length: 11
PASS Body: CrossOrigin
function test() {
if (!testCalled) {
if (window.testRunner && window.internals) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { });
testRunner.dumpAsText();
internals.settings.setHyperlinkAuditingEnabled(true);
testRunner.waitUntilDone();
<script>
if (window.testRunner && window.internals) {
testRunner.dumpAsText();
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { });
internals.settings.setHyperlinkAuditingEnabled(true);
testRunner.waitUntilDone();
}
<head>
<script src="/js-test-resources/js-test.js"></script>
</head>
-<body>
+<body onload="runTest()">
<script>
description("Tests the behavior of no-referrer-when-downgrade referrer policy when cross origin.");
jsTestIsAsync = true;
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/referrer-policy-script/no-referrer-when-downgrade/cross-origin-http-http.html");
finishJSTest();
}
+
+function runTest() {
+ if (window.testRunner) {
+ setTimeout(function() {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('no-referrer-when-downgrade', 'localhost')});
+ }, 1000);
+ }
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="no-referrer-when-downgrade"></script>
</body>
</html>
shouldBeEqualToString("referrer", "");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () {
+ downgradeReferrerCallback('no-referrer-when-downgrade', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="no-referrer-when-downgrade"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/referrer-policy-script/no-referrer-when-downgrade/same-origin.html");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('no-referrer-when-downgrade', '127.0.0.1')});
+}
</script>
-<script src="http://127.0.0.1:8000/referrer-policy/resources/script.php" referrerpolicy=no-referrer-when-downgrade"></script>
</body>
</html>
shouldBeEqualToString("referrer", "");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('no-referrer', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="no-referrer"></script>
</body>
</html>
shouldBeEqualToString("referrer", "");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function() { downgradeReferrerCallback('no-referrer', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="no-referrer"></script>
</body>
</html>
shouldBeEqualToString("referrer", "");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('no-referrer', '127.0.0.1')});
+}
</script>
-<script src="http://127.0.0.1:8000/referrer-policy/resources/script.php" referrerpolicy="no-referrer"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('origin-when-cross-origin', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="origin-when-cross-origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "https://127.0.0.1:8443/");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('origin-when-cross-origin', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="origin-when-cross-origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/referrer-policy-script/origin-when-cross-origin/same-origin.html");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('origin-when-cross-origin', '127.0.0.1')});
+}
</script>
-<script src="http://127.0.0.1:8000/referrer-policy/resources/script.php" referrerpolicy="origin-when-cross-origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('origin', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "https://127.0.0.1:8443/");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('origin', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('origin', '127.0.0.1')});
+}
</script>
-<script src="http://127.0.0.1:8000/referrer-policy/resources/script.php" referrerpolicy="origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('same-origin', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="same-origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('same-origin', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="same-origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/referrer-policy-script/same-origin/same-origin.html");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('same-origin', '127.0.0.1')});
+}
</script>
-<script src="http://127.0.0.1:8000/referrer-policy/resources/script.php" referrerpolicy="same-origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('strict-origin-when-cross-origin', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="strict-origin-when-cross-origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('strict-origin-when-top-origin', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="strict-origin-when-cross-origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/referrer-policy-script/strict-origin-when-cross-origin/same-origin.html");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('strict-origin-when-cross-origin', '127.0.0.1')});
+}
</script>
-<script src="http://127.0.0.1:8000/referrer-policy/resources/script.php" referrerpolicy="strict-origin-when-cross-origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('strict-origin', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="strict-origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('strict-origin', 'localhost')});
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="strict-origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('strict-origin', '127.0.0.1')});
+}
</script>
-<script src="http://127.0.0.1:8000/referrer-policy/resources/script.php" referrerpolicy="strict-origin"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/referrer-policy-script/unsafe-url/cross-origin-http-http.html");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('unsafe-url', 'localhost') });
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="unsaf-url"></script>
</body>
</html>
shouldBeEqualToString("referrer", "https://127.0.0.1:8443/referrer-policy-script/unsafe-url/cross-origin-http.https.html");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () {
+ downgradeReferrerCallback('unsafe-url', 'localhost');
+ });
+}
</script>
-<script src="http://localhost:8000/referrer-policy/resources/script.php" referrerpolicy="unsafe-url"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/referrer-policy-script/unsafe-url/same-origin.html");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () { downgradeReferrerCallback('unsafe-url', '127.0.0.1')});
+}
</script>
-<script src="http://127.0.0.1:8000/referrer-policy/resources/script.php" referrerpolicy="unsafe-url"></script>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/referrer-policy/no-referrer-when-downgrade/cross-origin-http-http.html");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () {
+ let iframeElement = document.createElement("iframe");
+ iframeElement.src = "http://localhost:8000/referrer-policy/resources/document.html";
+ document.body.appendChild(iframeElement);
+ });
+}
</script>
-<iframe src="http://localhost:8000/referrer-policy/resources/document.html"></iframe>
</body>
</html>
shouldBeEqualToString("referrer", "");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () {
+ let iframeElement = document.createElement("iframe");
+ iframeElement.src = "http://localhost:8000/referrer-policy/resources/document.html";
+ document.body.appendChild(iframeElement);
+ });
+}
</script>
-<iframe src="http://localhost:8000/referrer-policy/resources/document.html"></iframe>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/referrer-policy/no-referrer-when-downgrade/same-origin.html");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () {
+ let iframeElement = document.createElement("iframe");
+ iframeElement.src = "http://127.0.0.1:8000/referrer-policy/resources/document.html";
+ document.body.appendChild(iframeElement);
+ });
+}
</script>
-<iframe src="http://127.0.0.1:8000/referrer-policy/resources/document.html"></iframe>
</body>
</html>
shouldBeEqualToString("referrer", "http://127.0.0.1:8000/referrer-policy/unsafe-url/cross-origin-http-http.html");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () {
+ let iframeElement = document.createElement("iframe");
+ iframeElement.src = "http://localhost:8000/referrer-policy/resources/document.html";
+ document.body.appendChild(iframeElement);
+ });
+}
</script>
-<iframe src="http://localhost:8000/referrer-policy/resources/document.html"></iframe>
</body>
</html>
shouldBeEqualToString("referrer", "https://127.0.0.1:8443/referrer-policy/unsafe-url/cross-origin-http.https.html");
finishJSTest();
}
+
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () {
+ let iframeElement = document.createElement("iframe");
+ iframeElement.src = "http://localhost:8000/referrer-policy/resources/document.html";
+ document.body.appendChild(iframeElement);
+ });
+}
</script>
-<iframe src="http://localhost:8000/referrer-policy/resources/document.html"></iframe>
</body>
</html>
+++ /dev/null
-<!DOCTYPE html>
-<html>
-<head>
- <script src="/js-test-resources/js-test.js"></script>
- <script src="resources/util.js"></script>
-</head>
-<body>
-<script>
- description("Tests that only the origin is sent as referrer for prevalent resources without user interaction.");
- jsTestIsAsync = true;
- testRunner.dumpChildFramesAsText();
-
- function openIframe(url, onLoadHandler) {
- const element = document.createElement("iframe");
- element.src = url;
- if (onLoadHandler) {
- element.onload = onLoadHandler;
- }
- document.body.appendChild(element);
- }
-
- var referrer;
- setEnableFeature(true, function() {
- if (testRunner.isStatisticsPrevalentResource("http://localhost"))
- testFailed("Localhost was classified as prevalent resource before the test started.");
-
- fetch("resources/echo-referrer.php").then(function(response) {
- return response.text();
- }).then(function(data) {
- referrer = data;
- shouldBeEqualToString("referrer", "http://127.0.0.1:8000/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-requests.html");
-
- testRunner.setStatisticsPrevalentResource("http://localhost", true, function() {
- if (!testRunner.isStatisticsPrevalentResource("http://localhost"))
- testFailed("Host did not get set as prevalent resource.");
-
- testRunner.statisticsUpdateCookieBlocking(function() {
- fetch("http://localhost:8000/resourceLoadStatistics/resources/echo-referrer.php").then(function(response) {
- return response.text();
- }).then(function(data) {
- referrer = data;
- shouldBeEqualToString("referrer", "http://127.0.0.1:8000/");
-
- openIframe("resources/redirect.php?redirectTo=http://localhost:8000/resourceLoadStatistics/resources/echo-referrer.php", function() {
- setEnableFeature(false, finishJSTest);
- });
-
- }).catch(function(error) {
- console.log(error.message);
- setEnableFeature(false, finishJSTest);
- });
- });
- });
- }).catch(function(error) {
- console.log(error.message);
- setEnableFeature(false, finishJSTest);
- });
- });
-</script>
-</body>
-</html>
-Tests that only the origin is sent as referrer in redirects to prevalent resources without user interaction.
+Tests that only the origin is sent as referrer in redirects to third-parties.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-PASS referrer is "http://127.0.0.1:8000/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-redirects.html"
+PASS referrer is "http://127.0.0.1:8000/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-redirects.html"
PASS successfullyParsed is true
TEST COMPLETE
--- /dev/null
+<!DOCTYPE html>
+<html>
+<head>
+ <script src="/js-test-resources/js-test.js"></script>
+ <script src="resources/util.js"></script>
+</head>
+<body>
+<script>
+ description("Tests that only the origin is sent as referrer in redirects to third-parties.");
+ jsTestIsAsync = true;
+ testRunner.dumpChildFramesAsText();
+
+ function openIframe(url, onLoadHandler) {
+ const element = document.createElement("iframe");
+ element.src = url;
+ if (onLoadHandler) {
+ element.onload = onLoadHandler;
+ }
+ document.body.appendChild(element);
+ }
+
+ let referrer;
+ setEnableFeature(true, function() {
+ fetch("resources/echo-referrer.php").then(function(response) {
+ return response.text();
+ }).then(function(data) {
+ referrer = data;
+ shouldBeEqualToString("referrer", "http://127.0.0.1:8000/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-redirects.html");
+
+ openIframe("resources/redirect.php?redirectTo=http://localhost:8000/resourceLoadStatistics/resources/echo-referrer.php", function () {
+ setEnableFeature(false, finishJSTest);
+ });
+ }).catch(function(error) {
+ console.log(error.message);
+ setEnableFeature(false, finishJSTest);
+ });
+ });
+</script>
+</body>
+</html>
-Tests that only the origin is sent as referrer for prevalent resources without user interaction.
+Tests that only the origin is sent as referrer for third-party requests.
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-PASS referrer is "http://127.0.0.1:8000/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-requests.html"
+PASS referrer is "http://127.0.0.1:8000/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-requests.html"
PASS referrer is "http://127.0.0.1:8000/"
PASS successfullyParsed is true
</head>
<body>
<script>
- description("Tests that only the origin is sent as referrer in redirects to prevalent resources without user interaction.");
+ description("Tests that only the origin is sent as referrer for third-party requests.");
jsTestIsAsync = true;
testRunner.dumpChildFramesAsText();
document.body.appendChild(element);
}
- var referrer;
+ let referrer;
setEnableFeature(true, function() {
- if (testRunner.isStatisticsPrevalentResource("http://localhost"))
- testFailed("Localhost was classified as prevalent resource before the test started.");
-
fetch("resources/echo-referrer.php").then(function(response) {
return response.text();
}).then(function(data) {
referrer = data;
- shouldBeEqualToString("referrer", "http://127.0.0.1:8000/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-redirects.html");
+ shouldBeEqualToString("referrer", "http://127.0.0.1:8000/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-requests.html");
- testRunner.setStatisticsPrevalentResource("http://localhost", true, function() {
- if (!testRunner.isStatisticsPrevalentResource("http://localhost"))
- testFailed("Host did not get set as prevalent resource.");
+ fetch("http://localhost:8000/resourceLoadStatistics/resources/echo-referrer.php").then(function(response) {
+ return response.text();
+ }).then(function(data) {
+ referrer = data;
+ shouldBeEqualToString("referrer", "http://127.0.0.1:8000/");
- testRunner.statisticsUpdateCookieBlocking(function() {
- openIframe("resources/redirect.php?redirectTo=http://localhost:8000/resourceLoadStatistics/resources/echo-referrer.php", function() {
- setEnableFeature(false, finishJSTest);
- });
+ openIframe("resources/redirect.php?redirectTo=http://localhost:8000/resourceLoadStatistics/resources/echo-referrer.php", function() {
+ setEnableFeature(false, finishJSTest);
});
+
+ }).catch(function(error) {
+ console.log(error.message);
+ setEnableFeature(false, finishJSTest);
});
}).catch(function(error) {
console.log(error.message);
<html>
<body>
<script>
- var xhr = new XMLHttpRequest();
- xhr.open("GET", "http://localhost:8080/cookies/resources/setCookies.cgi", false);
- xhr.setRequestHeader("SET-COOKIE", "hello=world;path=/");
- xhr.send(null);
-</script>
+if (window.testRunner) {
+ testRunner.waitUntilDone();
+ testRunner.dumpAsText();
-<!-- This image will generate a CSP violation report. -->
-<img src="/security/resources/abe.png">
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () {
+ var xhr = new XMLHttpRequest();
+ xhr.open("GET", "http://localhost:8080/cookies/resources/setCookies.cgi", false);
+ xhr.setRequestHeader("SET-COOKIE", "hello=world;path=/");
+ xhr.send(null);
-<script src="resources/go-to-echo-report.js"></script>
+ // This image will generate a CSP violation report.
+ let imgElement = document.createElement("img");
+ imgElement.onload = imgElement.onerror = function () {
+ window.location = "/security/contentSecurityPolicy/resources/echo-report.php";
+ };
+ imgElement.src = "/security/resources/abe.png";
+ document.body.appendChild(imgElement);
+ });
+}
+</script>
</body>
</html>
<html>
<body>
<script>
- var xhr = new XMLHttpRequest();
- xhr.open("GET", "http://localhost:8080/cookies/resources/setCookies.cgi", false);
- xhr.setRequestHeader("SET-COOKIE", "hello=world;path=/");
- xhr.send(null);
-</script>
+if (window.testRunner) {
+ testRunner.waitUntilDone();
+ testRunner.dumpAsText();
-<!-- This image will generate a CSP violation report. -->
-<img src="/security/resources/abe.png">
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () {
+ var xhr = new XMLHttpRequest();
+ xhr.open("GET", "http://localhost:8080/cookies/resources/setCookies.cgi", false);
+ xhr.setRequestHeader("SET-COOKIE", "hello=world;path=/");
+ xhr.send(null);
-<script src="resources/go-to-echo-report.js"></script>
+ // This image will generate a CSP violation report.
+ let imgElement = document.createElement("img");
+ imgElement.onload = imgElement.onerror = function () {
+ window.location = "/security/contentSecurityPolicy/resources/echo-report.php";
+ };
+ imgElement.src = "/security/resources/abe.png";
+ document.body.appendChild(imgElement);
+ });
+}
+</script>
</body>
</html>
document.body.appendChild(frame);
}
-runNextTest();
+if (window.testRunner) {
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function () {
+ runNextTest();
+ });
+}
</script>
</body>
</html>
scrollingcoordinator/non-fast-scrollable-region-scaled-iframe.html [ Skip ]
scrollingcoordinator/non-fast-scrollable-region-transformed-iframe.html [ Skip ]
+# Cocoa-specific
+http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-redirects.html [ Pass ]
+http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-requests.html [ Pass ]
+
#//////////////////////////////////////////////////////////////////////////////////////////
# End platform-specific directories.
#//////////////////////////////////////////////////////////////////////////////////////////
http/tests/resourceLoadStatistics/grandfathering.html [ Pass ]
http/tests/resourceLoadStatistics/clear-in-memory-and-persistent-store.html [ Pass ]
http/tests/resourceLoadStatistics/clear-in-memory-and-persistent-store-one-hour.html [ Pass ]
-http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-redirects.html [ Pass ]
-http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-requests.html [ Pass ]
+http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-redirects.html [ Pass ]
+http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-requests.html [ Pass ]
http/tests/storageAccess/deny-storage-access-under-opener.html [ Pass ]
http/tests/storageAccess/deny-storage-access-under-opener-if-auto-dismiss.html [ Pass ]
http/tests/resourceLoadStatistics/cap-cache-max-age-for-prevalent-resource.html [ Pass ]
http/tests/security/contentSecurityPolicy/connect-src-beacon-blocked.html [ Skip ]
http/tests/security/contentSecurityPolicy/report-only-connect-src-beacon-redirect-blocked.php [ Skip ]
+# testRunner.setStatisticsShouldDowngradeReferrer() is not supported on WK1
+http/tests/referrer-policy-script/ [ Skip ]
+http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.php [ Skip ]
+http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.php [ Skip ]
+http/tests/security/referrer-policy-header.html [ Skip ]
+http/tests/navigation/ping-attribute/area-cross-origin.html [ Skip ]
+http/tests/navigation/ping-attribute/anchor-cross-origin.html [ Skip ]
+http/tests/referrer-policy/no-referrer-when-downgrade/ [ Skip ]
+http/tests/referrer-policy/unsafe-url/cross-origin-http-http.html [ Skip ]
+http/tests/referrer-policy/unsafe-url/cross-origin-http.https.html [ Skip ]
+
# Not supported on WK1
http/tests/intersection-observer [ Skip ]
imported/w3c/web-platform-tests/intersection-observer [ Skip ]
[ HighSierra+ ] http/tests/resourceLoadStatistics/clear-in-memory-and-persistent-store.html [ Pass ]
[ HighSierra+ ] http/tests/resourceLoadStatistics/clear-in-memory-and-persistent-store-one-hour.html [ Pass ]
[ HighSierra+ ] http/tests/resourceLoadStatistics/grandfathering.html [ Pass ]
-[ HighSierra+ ] http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-redirects.html [ Pass ]
-[ HighSierra+ ] http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-requests.html [ Pass ]
+[ HighSierra+ ] http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-redirects.html [ Pass ]
+[ HighSierra+ ] http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-requests.html [ Pass ]
[ HighSierra+ ] http/tests/resourceLoadStatistics/cap-cache-max-age-for-prevalent-resource.html [ Pass ]
# Skipped in general expectations since they only work on iOS and Mac, WK2.
-http/tests/security/strip-referrer-to-origin-for-third-party-redirects-in-private-mode.html [ Pass ]
-http/tests/security/strip-referrer-to-origin-for-third-party-requests-in-private-mode.html [ Pass ]
media/deactivate-audio-session.html [ Pass ]
# Link preconnect is disabled on pre-High Sierra because the CFNetwork SPI is missing.
# testRunner.setAlwaysAcceptCookies() is not implemented on Windows.
http/tests/xmlhttprequest/cross-origin-cookie-storage.html [ Skip ]
+# testRunner.setStatisticsShouldDowngradeReferrer() is not supported on Windows
+http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.php [ Skip ]
+http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.php [ Skip ]
+http/tests/navigation/ping-attribute/area-cross-origin.html [ Skip ]
+http/tests/navigation/ping-attribute/anchor-cross-origin.html [ Skip ]
+http/tests/referrer-policy/no-referrer-when-downgrade/ [ Skip ]
+http/tests/referrer-policy/unsafe-url/cross-origin-http-http.html [ Skip ]
+http/tests/referrer-policy/unsafe-url/cross-origin-http.https.html [ Skip ]
+
# Dark mode not supported on Windows
css-dark-mode [ Skip ]
http/tests/referrer-policy-iframe [ Skip ]
http/tests/referrer-policy-script [ Skip ]
+# testRunner.setStatisticsShouldDowngradeReferrer() is not supported
+http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies.php [ Skip ]
+http/tests/security/contentSecurityPolicy/report-cross-origin-no-cookies-when-private-browsing-enabled.php [ Skip ]
+http/tests/security/referrer-policy-header.html [ Skip ]
+http/tests/navigation/ping-attribute/area-cross-origin.html [ Skip ]
+http/tests/navigation/ping-attribute/anchor-cross-origin.html [ Skip ]
+http/tests/referrer-policy/no-referrer-when-downgrade/ [ Skip ]
+http/tests/referrer-policy/unsafe-url/cross-origin-http-http.html [ Skip ]
+http/tests/referrer-policy/unsafe-url/cross-origin-http.https.html [ Skip ]
+
# All timing out
http/tests/resourceLoadStatistics [ Skip ]
# These are only supported behind a compile time flag in macOS High Sierra + iOS 11, and above.
http/tests/resourceLoadStatistics/cookie-deletion.html [ Skip ]
http/tests/resourceLoadStatistics/cookies-with-and-without-user-interaction.html [ Skip ]
-http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-redirects.html [ Skip ]
-http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-prevalent-subresource-requests.html [ Skip ]
+http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-redirects.html [ Skip ]
+http/tests/resourceLoadStatistics/strip-referrer-to-origin-for-third-party-requests.html [ Skip ]
http/tests/resourceLoadStatistics/add-blocking-to-redirect.html [ Skip ]
http/tests/resourceLoadStatistics/do-not-remove-blocking-in-redirect.html [ Skip ]
http/tests/resourceLoadStatistics/non-prevalent-resources-can-access-cookies-in-a-third-party-context.html [ Skip ]
workerPort.postMessage(msg);
};
}
+
+function downgradeReferrerCallback(policy, host) {
+ let scriptElement = document.createElement("script");
+ scriptElement.src = "http://".concat(host, ":8000/referrer-policy/resources/script.php");
+ scriptElement.referrerPolicy = policy;
+ document.body.appendChild(scriptElement);
+}
self.AudioContext = self.webkitAudioContext;
self.OfflineAudioContext = self.webkitOfflineAudioContext;
}
+
+ if (testRunner.setStatisticsShouldDowngradeReferrer)
+ testRunner.setStatisticsShouldDowngradeReferrer(false, function() { });
}
if (self.internals && internals.setDisableGetDisplayMediaUserGestureConstraint)
+2019-09-26 Kate Cheney <katherine_cheney@apple.com>
+
+ Resource Load Statistics: Downgrade all third-party referrer headers
+ https://bugs.webkit.org/show_bug.cgi?id=201353
+ <rdar://problem/54895650>
+
+ Majority of this patch was written by John Wilander <wilander@apple.com>.
+
+ Reviewed by Brent Fulgham.
+
+ When tracking protections are enabled, we should downgrade all third-party
+ referrers to their origins. Note that this downgrade will be specific to
+ Cocoa so other ports will have to adopt as they see fit.
+
+ Cocoa already does this downgrade in ephemeral sessions (shipping).
+
+ The majority of these changes are test infrastructure. The functional
+ change is in WebKit::NetworkDataTaskCocoa and WebKit::NetworkSession.
+
+ * NetworkProcess/NetworkProcess.cpp:
+ (WebKit::NetworkProcess::setShouldDowngradeReferrerForTesting):
+ * NetworkProcess/NetworkProcess.h:
+ * NetworkProcess/NetworkProcess.messages.in:
+ * NetworkProcess/NetworkSession.cpp:
+ (WebKit::NetworkSession::isResourceLoadStatisticsEnabled const):
+ (WebKit::NetworkSession::setShouldDowngradeReferrerForTesting):
+ (WebKit::NetworkSession::shouldDowngradeReferrer const):
+ * NetworkProcess/NetworkSession.h:
+ * NetworkProcess/cocoa/NetworkDataTaskCocoa.h:
+ * NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
+ (WebKit::NetworkDataTaskCocoa::isThirdPartyRequest const):
+ (WebKit::NetworkDataTaskCocoa::NetworkDataTaskCocoa):
+ (WebKit::NetworkDataTaskCocoa::restrictRequestReferrerToOriginIfNeeded):
+ (WebKit::NetworkDataTaskCocoa::willPerformHTTPRedirection):
+ (WebKit::NetworkDataTaskCocoa::isThirdPartyRequest): Deleted.
+ * UIProcess/API/C/WKWebsiteDataStoreRef.cpp:
+ (WKWebsiteDataStoreSetResourceLoadStatisticsShouldDowngradeReferrerForTesting):
+ (WKWebsiteDataStoreStatisticsResetToConsistentState):
+ * UIProcess/API/C/WKWebsiteDataStoreRef.h:
+ * UIProcess/Network/NetworkProcessProxy.cpp:
+ (WebKit::NetworkProcessProxy::setShouldDowngradeReferrerForTesting):
+ * UIProcess/Network/NetworkProcessProxy.h:
+ * UIProcess/WebsiteData/WebsiteDataStore.cpp:
+ (WebKit::WebsiteDataStore::setResourceLoadStatisticsShouldDowngradeReferrerForTesting):
+ * UIProcess/WebsiteData/WebsiteDataStore.h:
+
2019-09-26 Eric Carlson <eric.carlson@apple.com>
REGRESSION (iOS 13): Trying to record just audio using HTML Media Capture crashes Safari
result = networkSession->hasIsolatedSession(domain);
completionHandler(result);
}
+
+void NetworkProcess::setShouldDowngradeReferrerForTesting(bool enabled, CompletionHandler<void()>&& completionHandler)
+{
+ forEachNetworkSession([enabled](auto& networkSession) {
+ networkSession.setShouldDowngradeReferrerForTesting(enabled);
+ });
+ completionHandler();
+}
#endif // ENABLE(RESOURCE_LOAD_STATISTICS)
bool NetworkProcess::sessionIsControlledByAutomation(PAL::SessionID sessionID) const
void resetCrossSiteLoadsWithLinkDecorationForTesting(PAL::SessionID, CompletionHandler<void()>&&);
void hasIsolatedSession(PAL::SessionID, const WebCore::RegistrableDomain&, CompletionHandler<void(bool)>&&) const;
bool isITPDatabaseEnabled() const { return m_isITPDatabaseEnabled; }
+ void setShouldDowngradeReferrerForTesting(bool, CompletionHandler<void()>&&);
#endif
using CacheStorageRootPathCallback = CompletionHandler<void(String&&)>;
ResetCrossSiteLoadsWithLinkDecorationForTesting(PAL::SessionID sessionID) -> () Async
DeleteCookiesForTesting(PAL::SessionID sessionID, WebCore::RegistrableDomain domain, bool includeHttpOnlyCookies) -> () Async
HasIsolatedSession(PAL::SessionID sessionID, WebCore::RegistrableDomain domain) -> (bool hasIsolatedSession) Async
+ SetShouldDowngradeReferrerForTesting(bool enabled) -> () Async
#endif
SetSessionIsControlledByAutomation(PAL::SessionID sessionID, bool controlled);
m_resourceLoadStatistics = WebResourceLoadStatisticsStore::create(*this, m_resourceLoadStatisticsDirectory, m_shouldIncludeLocalhostInResourceLoadStatistics);
}
+bool NetworkSession::isResourceLoadStatisticsEnabled() const
+{
+ return !!m_resourceLoadStatistics;
+}
+
void NetworkSession::notifyResourceLoadStatisticsProcessed()
{
m_networkProcess->parentProcessConnection()->send(Messages::NetworkProcessProxy::NotifyResourceLoadStatisticsProcessed(), 0);
{
m_networkProcess->registrableDomainsWithWebsiteData(m_sessionID, dataTypes, shouldNotifyPage, WTFMove(completionHandler));
}
+
+void NetworkSession::setShouldDowngradeReferrerForTesting(bool enabled)
+{
+ m_downgradeReferrer = enabled;
+}
+
+bool NetworkSession::shouldDowngradeReferrer() const
+{
+ return m_downgradeReferrer;
+}
+
#endif // ENABLE(RESOURCE_LOAD_STATISTICS)
void NetworkSession::storeAdClickAttribution(WebCore::AdClickAttribution&& adClickAttribution)
WebResourceLoadStatisticsStore* resourceLoadStatistics() const { return m_resourceLoadStatistics.get(); }
void setResourceLoadStatisticsEnabled(bool);
void recreateResourceLoadStatisticStore();
+ bool isResourceLoadStatisticsEnabled() const;
void notifyResourceLoadStatisticsProcessed();
void deleteWebsiteDataForRegistrableDomains(OptionSet<WebsiteDataType>, Vector<std::pair<WebCore::RegistrableDomain, WebsiteDataToRemove>>&&, bool shouldNotifyPage, CompletionHandler<void(const HashSet<WebCore::RegistrableDomain>&)>&&);
void registrableDomainsWithWebsiteData(OptionSet<WebsiteDataType>, bool shouldNotifyPage, CompletionHandler<void(HashSet<WebCore::RegistrableDomain>&&)>&&);
bool shouldIsolateSessionsForPrevalentTopFrames() const { return m_enableResourceLoadStatisticsNSURLSessionSwitching == EnableResourceLoadStatisticsNSURLSessionSwitching::Yes; }
virtual bool hasIsolatedSession(const WebCore::RegistrableDomain) const { return false; }
virtual void clearIsolatedSessions() { }
+ void setShouldDowngradeReferrerForTesting(bool);
+ bool shouldDowngradeReferrer() const;
#endif
void storeAdClickAttribution(WebCore::AdClickAttribution&&);
void handleAdClickAttributionConversion(WebCore::AdClickAttribution::Conversion&&, const URL& requestURL, const WebCore::ResourceRequest& redirectRequest);
WebCore::RegistrableDomain m_resourceLoadStatisticsManualPrevalentResource;
EnableResourceLoadStatisticsNSURLSessionSwitching m_enableResourceLoadStatisticsNSURLSessionSwitching { EnableResourceLoadStatisticsNSURLSessionSwitching::No };
bool m_enableResourceLoadStatisticsLogTestingEvent;
+ bool m_downgradeReferrer { true };
#endif
UniqueRef<AdClickAttributionManager> m_adClickAttribution;
bool tryPasswordBasedAuthentication(const WebCore::AuthenticationChallenge&, ChallengeCompletionHandler&);
void applySniffingPoliciesAndBindRequestToInferfaceIfNeeded(__strong NSURLRequest*&, bool shouldContentSniff, bool shouldContentEncodingSniff);
- void restrictRequestReferrerToOriginIfNeeded(WebCore::ResourceRequest&, bool shouldBlockCookies);
+ void restrictRequestReferrerToOriginIfNeeded(WebCore::ResourceRequest&);
#if ENABLE(RESOURCE_LOAD_STATISTICS)
static NSHTTPCookieStorage *statelessCookieStorage();
void blockCookies();
#endif
- bool isThirdPartyRequest(const WebCore::ResourceRequest&);
+ bool isThirdPartyRequest(const WebCore::ResourceRequest&) const;
bool isAlwaysOnLoggingAllowed() const;
RefPtr<SandboxExtension> m_sandboxExtension;
}
#endif
-bool NetworkDataTaskCocoa::isThirdPartyRequest(const WebCore::ResourceRequest& request)
+bool NetworkDataTaskCocoa::isThirdPartyRequest(const WebCore::ResourceRequest& request) const
{
return !WebCore::areRegistrableDomainsEqual(request.url(), request.firstPartyForCookies());
}
needsIsolatedSession = session.shouldIsolateSessionsForPrevalentTopFrames() && networkStorageSession->shouldBlockThirdPartyCookiesButKeepFirstPartyCookiesFor(firstParty);
}
#endif
- restrictRequestReferrerToOriginIfNeeded(request, shouldBlockCookies);
+ restrictRequestReferrerToOriginIfNeeded(request);
NSURLRequest *nsRequest = request.nsURLRequest(WebCore::HTTPBodyUpdatePolicy::UpdateHTTPBody);
applySniffingPoliciesAndBindRequestToInferfaceIfNeeded(nsRequest, shouldContentSniff == WebCore::ContentSniffingPolicy::SniffContent && !url.isLocalFile(), shouldContentEncodingSniff == WebCore::ContentEncodingSniffingPolicy::Sniff);
}
}
-void NetworkDataTaskCocoa::restrictRequestReferrerToOriginIfNeeded(WebCore::ResourceRequest& request, bool shouldBlockCookies)
+void NetworkDataTaskCocoa::restrictRequestReferrerToOriginIfNeeded(WebCore::ResourceRequest& request)
{
- if (shouldBlockCookies || (m_session->sessionID().isEphemeral() && isThirdPartyRequest(request)))
+ if ((m_session->sessionID().isEphemeral() || m_session->isResourceLoadStatisticsEnabled()) && m_session->shouldDowngradeReferrer() && isThirdPartyRequest(request))
request.setExistingHTTPReferrerToOriginString();
}
m_client->willPerformHTTPRedirection(WTFMove(redirectResponse), WTFMove(request), [completionHandler = WTFMove(completionHandler), this, weakThis = makeWeakPtr(*this)] (auto&& request) mutable {
if (!weakThis)
return completionHandler({ });
- if (!request.isNull()) {
-#if ENABLE(RESOURCE_LOAD_STATISTICS)
- bool shouldBlockCookies = m_session->networkStorageSession() && m_session->networkStorageSession()->shouldBlockCookies(request, m_frameID, m_pageID);
-#else
- bool shouldBlockCookies = false;
-#endif
- restrictRequestReferrerToOriginIfNeeded(request, shouldBlockCookies);
- }
+ if (!request.isNull())
+ restrictRequestReferrerToOriginIfNeeded(request);
completionHandler(WTFMove(request));
});
else {
#endif
}
+void WKWebsiteDataStoreSetResourceLoadStatisticsShouldDowngradeReferrerForTesting(WKWebsiteDataStoreRef dataStoreRef, bool enabled, void* context, WKWebsiteDataStoreSetResourceLoadStatisticsShouldDowngradeReferrerForTestingFunction completionHandler)
+{
+#if ENABLE(RESOURCE_LOAD_STATISTICS)
+ WebKit::toImpl(dataStoreRef)->setResourceLoadStatisticsShouldDowngradeReferrerForTesting(enabled, [context, completionHandler] {
+ completionHandler(context);
+ });
+#else
+ completionHandler(context);
+#endif
+}
+
void WKWebsiteDataStoreStatisticsResetToConsistentState(WKWebsiteDataStoreRef dataStoreRef, void* context, WKWebsiteDataStoreStatisticsResetToConsistentStateFunction completionHandler)
{
#if ENABLE(RESOURCE_LOAD_STATISTICS)
store.clearResourceLoadStatisticsInWebProcesses([callbackAggregator = callbackAggregator.copyRef()] { });
store.resetCacheMaxAgeCapForPrevalentResources([callbackAggregator = callbackAggregator.copyRef()] { });
store.resetCrossSiteLoadsWithLinkDecorationForTesting([callbackAggregator = callbackAggregator.copyRef()] { });
+ store.setResourceLoadStatisticsShouldDowngradeReferrerForTesting(true, [callbackAggregator = callbackAggregator.copyRef()] { });
store.resetParametersToDefaultValues([callbackAggregator = callbackAggregator.copyRef()] { });
store.scheduleClearInMemoryAndPersistent(WebKit::ShouldGrandfatherStatistics::No, [callbackAggregator = callbackAggregator.copyRef()] { });
#else
WK_EXPORT void WKWebsiteDataStoreSetStatisticsCacheMaxAgeCap(WKWebsiteDataStoreRef dataStoreRef, double seconds, void* context, WKWebsiteDataStoreSetStatisticsCacheMaxAgeCapFunction);
typedef void (*WKWebsiteDataStoreStatisticsHasIsolatedSessionFunction)(bool hasIsolatedSession, void* functionContext);
WK_EXPORT void WKWebsiteDataStoreStatisticsHasIsolatedSession(WKWebsiteDataStoreRef dataStoreRef, WKStringRef host, void* context, WKWebsiteDataStoreStatisticsHasIsolatedSessionFunction callback);
+typedef void (*WKWebsiteDataStoreSetResourceLoadStatisticsShouldDowngradeReferrerForTestingFunction)(void* functionContext);
+WK_EXPORT void WKWebsiteDataStoreSetResourceLoadStatisticsShouldDowngradeReferrerForTesting(WKWebsiteDataStoreRef dataStoreRef, bool enabled, void* context, WKWebsiteDataStoreSetResourceLoadStatisticsShouldDowngradeReferrerForTestingFunction completionHandler);
typedef void (*WKWebsiteDataStoreStatisticsResetToConsistentStateFunction)(void* functionContext);
WK_EXPORT void WKWebsiteDataStoreStatisticsResetToConsistentState(WKWebsiteDataStoreRef dataStoreRef, void* context, WKWebsiteDataStoreStatisticsResetToConsistentStateFunction completionHandler);
sendWithAsyncReply(Messages::NetworkProcess::HasIsolatedSession(sessionID, domain), WTFMove(completionHandler));
}
+void NetworkProcessProxy::setShouldDowngradeReferrerForTesting(bool enabled, CompletionHandler<void()>&& completionHandler)
+{
+ if (!canSendMessage()) {
+ completionHandler();
+ return;
+ }
+
+ sendWithAsyncReply(Messages::NetworkProcess::SetShouldDowngradeReferrerForTesting(enabled), WTFMove(completionHandler));
+}
#endif // ENABLE(RESOURCE_LOAD_STATISTICS)
void NetworkProcessProxy::sendProcessWillSuspendImminently()
void deleteCookiesForTesting(PAL::SessionID, const RegistrableDomain&, bool includeHttpOnlyCookies, CompletionHandler<void()>&&);
void deleteWebsiteDataInUIProcessForRegistrableDomains(PAL::SessionID, OptionSet<WebsiteDataType>, OptionSet<WebsiteDataFetchOption>, Vector<RegistrableDomain>, CompletionHandler<void(HashSet<WebCore::RegistrableDomain>&&)>&&);
void hasIsolatedSession(PAL::SessionID, const RegistrableDomain&, CompletionHandler<void(bool)>&&);
+ void setShouldDowngradeReferrerForTesting(bool, CompletionHandler<void()>&&);
#endif
void processReadyToSuspend();
}
ASSERT(!completionHandler);
}
+
+void WebsiteDataStore::setResourceLoadStatisticsShouldDowngradeReferrerForTesting(bool enabled, CompletionHandler<void()>&& completionHandler)
+{
+ auto callbackAggregator = CallbackAggregator::create(WTFMove(completionHandler));
+
+ for (auto& processPool : processPools()) {
+ if (auto* networkProcess = processPool->networkProcess()) {
+ networkProcess->setShouldDowngradeReferrerForTesting(enabled, [callbackAggregator = callbackAggregator.copyRef()] { });
+ ASSERT(processPools().size() == 1);
+ break;
+ }
+ }
+ ASSERT(!completionHandler);
+}
#endif // ENABLE(RESOURCE_LOAD_STATISTICS)
void WebsiteDataStore::setCacheMaxAgeCapForPrevalentResources(Seconds seconds, CompletionHandler<void()>&& completionHandler)
void deleteCookiesForTesting(const URL&, bool includeHttpOnlyCookies, CompletionHandler<void()>&&);
void hasLocalStorageForTesting(const URL&, CompletionHandler<void(bool)>&&) const;
void hasIsolatedSessionForTesting(const URL&, CompletionHandler<void(bool)>&&) const;
+ void setResourceLoadStatisticsShouldDowngradeReferrerForTesting(bool, CompletionHandler<void()>&&);
#endif
void setCacheMaxAgeCapForPrevalentResources(Seconds, CompletionHandler<void()>&&);
void resetCacheMaxAgeCapForPrevalentResources(CompletionHandler<void()>&&);
+2019-09-26 Kate Cheney <katherine_cheney@apple.com>
+
+ Resource Load Statistics: Downgrade all third-party referrer headers
+ https://bugs.webkit.org/show_bug.cgi?id=201353
+ <rdar://problem/54895650>
+
+ Majority of this patch was written by John Wilander <wilander@apple.com>.
+
+ Reviewed by Brent Fulgham.
+
+ The changes to the TestRunner facilitates an opt-out for test cases
+ that either test the referrer mechanism explicitly or tests that
+ rely on the full referrer to be sent.
+
+ The new boolean variable and early return in
+ TestRunner::setStatisticsShouldDowngradeReferrer() prevent the same
+ event from trying to set multiple TestRunner callbacks.
+
+ * WebKitTestRunner/InjectedBundle/Bindings/TestRunner.idl:
+ * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+ (WTR::InjectedBundle::didReceiveMessageToPage):
+ * WebKitTestRunner/InjectedBundle/TestRunner.cpp:
+ (WTR::TestRunner::setStatisticsShouldDowngradeReferrer):
+ (WTR::TestRunner::statisticsCallDidSetShouldDowngradeReferrerCallback):
+ * WebKitTestRunner/InjectedBundle/TestRunner.h:
+ * WebKitTestRunner/TestController.cpp:
+ (WTR::TestController::setStatisticsShouldDowngradeReferrer):
+ * WebKitTestRunner/TestController.h:
+ * WebKitTestRunner/TestInvocation.cpp:
+ (WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle):
+ (WTR::TestInvocation::didSetShouldDowngradeReferrer):
+ * WebKitTestRunner/TestInvocation.h:
+
2019-09-26 Dean Jackson <dino@apple.com>
Build fix.
void setStatisticsCacheMaxAgeCap(double seconds);
void statisticsResetToConsistentState(object completionHandler);
boolean hasStatisticsIsolatedSession(DOMString hostName);
+ void setStatisticsShouldDowngradeReferrer(boolean value, object callback);
// Injected bundle form client.
void installTextDidChangeInTextFieldCallback(object callback);
return;
}
+ if (WKStringIsEqualToUTF8CString(messageName, "CallDidSetShouldDowngradeReferrer")) {
+ m_testRunner->statisticsCallDidSetShouldDowngradeReferrerCallback();
+ return;
+ }
+
if (WKStringIsEqualToUTF8CString(messageName, "CallDidResetStatisticsToConsistentState")) {
m_testRunner->statisticsCallDidResetToConsistentStateCallback();
return;
StatisticsDidClearThroughWebsiteDataRemovalCallbackID,
StatisticsDidResetToConsistentStateCallbackID,
StatisticsDidSetBlockCookiesForHostCallbackID,
+ StatisticsDidSetShouldDowngradeReferrerCallbackID,
AllStorageAccessEntriesCallbackID,
DidRemoveAllSessionCredentialsCallbackID,
GetApplicationManifestCallbackID,
return WKBooleanGetValue(adoptWK(static_cast<WKBooleanRef>(returnData)).get());
}
+void TestRunner::setStatisticsShouldDowngradeReferrer(bool value, JSValueRef completionHandler)
+{
+ if (m_hasSetDowngradeReferrerCallback)
+ return;
+
+ cacheTestRunnerCallback(StatisticsDidSetShouldDowngradeReferrerCallbackID, completionHandler);
+ WKRetainPtr<WKStringRef> messageName = adoptWK(WKStringCreateWithUTF8CString("SetStatisticsShouldDowngradeReferrer"));
+ WKRetainPtr<WKBooleanRef> messageBody = adoptWK(WKBooleanCreate(value));
+ WKBundlePostSynchronousMessage(InjectedBundle::singleton().bundle(), messageName.get(), messageBody.get(), nullptr);
+ m_hasSetDowngradeReferrerCallback = true;
+}
+
+void TestRunner::statisticsCallDidSetShouldDowngradeReferrerCallback()
+{
+ callTestRunnerCallback(StatisticsDidSetShouldDowngradeReferrerCallbackID);
+}
+
void TestRunner::statisticsCallClearThroughWebsiteDataRemovalCallback()
{
callTestRunnerCallback(StatisticsDidClearThroughWebsiteDataRemovalCallbackID);
bool isStatisticsHasLocalStorage(JSStringRef hostName);
void setStatisticsCacheMaxAgeCap(double seconds);
bool hasStatisticsIsolatedSession(JSStringRef hostName);
+ void setStatisticsShouldDowngradeReferrer(bool, JSValueRef callback);
+ void statisticsCallDidSetShouldDowngradeReferrerCallback();
void statisticsResetToConsistentState(JSValueRef completionHandler);
void statisticsCallDidResetToConsistentStateCallback();
bool m_userStyleSheetEnabled { false };
bool m_dumpAllHTTPRedirectedResponseHeaders { false };
+ bool m_hasSetDowngradeReferrerCallback { false };
};
} // namespace WTR
return context.result;
}
+void TestController::setStatisticsShouldDowngradeReferrer(bool value)
+{
+ ResourceStatisticsCallbackContext context(*this);
+ WKWebsiteDataStoreSetResourceLoadStatisticsShouldDowngradeReferrerForTesting(TestController::websiteDataStore(), value, &context, resourceStatisticsVoidResultCallback);
+ runUntil(context.done, noTimeout);
+ m_currentInvocation->didSetShouldDowngradeReferrer();
+}
+
void TestController::statisticsResetToConsistentState()
{
ResourceStatisticsCallbackContext context(*this);
bool isStatisticsHasLocalStorage(WKStringRef hostName);
void setStatisticsCacheMaxAgeCap(double seconds);
bool hasStatisticsIsolatedSession(WKStringRef hostName);
+ void setStatisticsShouldDowngradeReferrer(bool value);
void statisticsResetToConsistentState();
void getAllStorageAccessEntries();
return result;
}
+ if (WKStringIsEqualToUTF8CString(messageName, "SetStatisticsShouldDowngradeReferrer")) {
+ ASSERT(WKGetTypeID(messageBody) == WKBooleanGetTypeID());
+ WKBooleanRef value = static_cast<WKBooleanRef>(messageBody);
+ TestController::singleton().setStatisticsShouldDowngradeReferrer(WKBooleanGetValue(value));
+ return nullptr;
+ }
+
if (WKStringIsEqualToUTF8CString(messageName, "RemoveAllSessionCredentials")) {
TestController::singleton().removeAllSessionCredentials();
return nullptr;
WKPagePostMessageToInjectedBundle(TestController::singleton().mainWebView()->page(), messageName.get(), 0);
}
+void TestInvocation::didSetShouldDowngradeReferrer()
+{
+ WKRetainPtr<WKStringRef> messageName = adoptWK(WKStringCreateWithUTF8CString("CallDidSetShouldDowngradeReferrer"));
+ WKPagePostMessageToInjectedBundle(TestController::singleton().mainWebView()->page(), messageName.get(), 0);
+}
+
void TestInvocation::didResetStatisticsToConsistentState()
{
WKRetainPtr<WKStringRef> messageName = adoptWK(WKStringCreateWithUTF8CString("CallDidResetStatisticsToConsistentState"));
void notifyDownloadDone();
void didClearStatisticsThroughWebsiteDataRemoval();
+ void didSetShouldDowngradeReferrer();
void didResetStatisticsToConsistentState();
void didSetBlockCookiesForHost();
void didSetStatisticsDebugMode();
git://git.webkit.org / WebKit-https.git / commitdiff