Skip to content

Commit 056e52a

Browse files
hiroshige-gChromium LUCI CQ
hiroshige-g
authored and
Chromium LUCI CQ
committed
[WPT/referrer-policy] Use unsafe-url as "another policy"
Previously, `no-referrer` was used as the Document's referrer policy that shouldn't be used. But using the Document's referrer policy unexpectedly didn't cause test failures, because web-platform-tests/wpt#29434 made the tests to allow UA-specific policies more strict than expected, and using `no-referrer` is always allowed. This CL uses `unsafe-url` instead as long as possible, to make tests fail if the policy is used unexpectedly. `unsafe-url` is likely to result in less strict referrers that aren't allowed as UA-specific policies. Bug: 1235205, web-platform-tests/wpt#29434 Change-Id: I7e9aa4f5e5fbd4d8ff5a984f6647845ae0d0e2f1 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3123715 Reviewed-by: Emily Stark <estark@chromium.org> Reviewed-by: Dominic Farolino <dom@chromium.org> Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org> Cr-Commit-Position: refs/heads/main@{#918861}
1 parent b721f0a commit 056e52a

File tree

361 files changed

+373
-361
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

361 files changed

+373
-361
lines changed

‎third_party/blink/web_tests/external/wpt/common/security-features/tools/util.py‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,19 @@ def to_json(self):
149149
def get_another_policy(self, delivery_type):
150150
# type: (str) -> PolicyDelivery
151151
if self.key == 'referrerPolicy':
152-
if self.value == 'no-referrer':
152+
# Return 'unsafe-url' (i.e. more unsafe policy than `self.value`)
153+
# as long as possible, to make sure the tests to fail if the
154+
# returned policy is used unexpectedly instead of `self.value`.
155+
# Using safer policy wouldn't be distinguishable from acceptable
156+
# arbitrary policy enforcement by user agents, as specified at
157+
# Step 7 of
158+
# https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer:
159+
# "The user agent MAY alter referrerURL or referrerOrigin at this
160+
# point to enforce arbitrary policy considerations in the
161+
# interests of minimizing data leakage."
162+
# See also the comments at `referrerUrlResolver` in
163+
# `wpt/referrer-policy/generic/test-case.sub.js`.
164+
if self.value != 'unsafe-url':
153165
return PolicyDelivery(delivery_type, self.key, 'unsafe-url')
154166
else:
155167
return PolicyDelivery(delivery_type, self.key, 'no-referrer')

‎third_party/blink/web_tests/external/wpt/referrer-policy/gen/iframe.http-rp/no-referrer-when-downgrade/a-tag.http.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<head>
55
<meta charset="utf-8">
66
<meta name="timeout" content="long">
7-
<meta name="referrer" content="no-referrer">
7+
<meta name="referrer" content="unsafe-url">
88
<script src="/resources/testharness.js"></script>
99
<script src="/resources/testharnessreport.js"></script>
1010
<script src="/common/security-features/resources/common.sub.js"></script>

‎third_party/blink/web_tests/external/wpt/referrer-policy/gen/iframe.http-rp/no-referrer-when-downgrade/fetch.http.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<head>
55
<meta charset="utf-8">
66
<meta name="timeout" content="long">
7-
<meta name="referrer" content="no-referrer">
7+
<meta name="referrer" content="unsafe-url">
88
<script src="/resources/testharness.js"></script>
99
<script src="/resources/testharnessreport.js"></script>
1010
<script src="/common/security-features/resources/common.sub.js"></script>

‎third_party/blink/web_tests/external/wpt/referrer-policy/gen/iframe.http-rp/no-referrer-when-downgrade/iframe-tag.http.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<head>
55
<meta charset="utf-8">
66
<meta name="timeout" content="long">
7-
<meta name="referrer" content="no-referrer">
7+
<meta name="referrer" content="unsafe-url">
88
<script src="/resources/testharness.js"></script>
99
<script src="/resources/testharnessreport.js"></script>
1010
<script src="/common/security-features/resources/common.sub.js"></script>

‎third_party/blink/web_tests/external/wpt/referrer-policy/gen/iframe.http-rp/no-referrer-when-downgrade/img-tag.http.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<head>
55
<meta charset="utf-8">
66
<meta name="timeout" content="long">
7-
<meta name="referrer" content="no-referrer">
7+
<meta name="referrer" content="unsafe-url">
88
<script src="/resources/testharness.js"></script>
99
<script src="/resources/testharnessreport.js"></script>
1010
<script src="/common/security-features/resources/common.sub.js"></script>

‎third_party/blink/web_tests/external/wpt/referrer-policy/gen/iframe.http-rp/no-referrer-when-downgrade/script-tag.http.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<head>
55
<meta charset="utf-8">
66
<meta name="timeout" content="long">
7-
<meta name="referrer" content="no-referrer">
7+
<meta name="referrer" content="unsafe-url">
88
<script src="/resources/testharness.js"></script>
99
<script src="/resources/testharnessreport.js"></script>
1010
<script src="/common/security-features/resources/common.sub.js"></script>

‎third_party/blink/web_tests/external/wpt/referrer-policy/gen/iframe.http-rp/no-referrer-when-downgrade/sharedworker-classic.http.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<head>
55
<meta charset="utf-8">
66
<meta name="timeout" content="long">
7-
<meta name="referrer" content="no-referrer">
7+
<meta name="referrer" content="unsafe-url">
88
<script src="/resources/testharness.js"></script>
99
<script src="/resources/testharnessreport.js"></script>
1010
<script src="/common/security-features/resources/common.sub.js"></script>

‎third_party/blink/web_tests/external/wpt/referrer-policy/gen/iframe.http-rp/no-referrer-when-downgrade/sharedworker-module.http.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<head>
55
<meta charset="utf-8">
66
<meta name="timeout" content="long">
7-
<meta name="referrer" content="no-referrer">
7+
<meta name="referrer" content="unsafe-url">
88
<script src="/resources/testharness.js"></script>
99
<script src="/resources/testharnessreport.js"></script>
1010
<script src="/common/security-features/resources/common.sub.js"></script>

‎third_party/blink/web_tests/external/wpt/referrer-policy/gen/iframe.http-rp/no-referrer-when-downgrade/worker-classic.http.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<head>
55
<meta charset="utf-8">
66
<meta name="timeout" content="long">
7-
<meta name="referrer" content="no-referrer">
7+
<meta name="referrer" content="unsafe-url">
88
<script src="/resources/testharness.js"></script>
99
<script src="/resources/testharnessreport.js"></script>
1010
<script src="/common/security-features/resources/common.sub.js"></script>

‎third_party/blink/web_tests/external/wpt/referrer-policy/gen/iframe.http-rp/no-referrer-when-downgrade/worker-module.http.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
<head>
55
<meta charset="utf-8">
66
<meta name="timeout" content="long">
7-
<meta name="referrer" content="no-referrer">
7+
<meta name="referrer" content="unsafe-url">
88
<script src="/resources/testharness.js"></script>
99
<script src="/resources/testharnessreport.js"></script>
1010
<script src="/common/security-features/resources/common.sub.js"></script>

0 commit comments

Comments
 (0)