Commit 8a776a2c authored by Blink WPT Bot's avatar Blink WPT Bot Committed by aborovova@mozilla.com
Browse files

Bug 1967207 [wpt PR 52630] - Add WPT to check referrerpolicy in Link headers on subresources, 

Automatic update from web-platform-tests
Add WPT to check referrerpolicy in Link headers on subresources (#52630)

This CL adds WPT to ensure that referrerpolicy is set to `no-referrer`
for `Link` headers on subresources, as a follow-up for a past change,
https://crrev.com/c/6522070.

Bug: 417529151
Change-Id: I472594b7aa49f6f662f84c7b1af8f36c0538f567
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6542774


Reviewed-by: default avatarHiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: default avatarShunya Shishido <sisidovski@chromium.org>
Commit-Queue: Takashi Nakayama <tnak@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1462025}

Co-authored-by: default avatarTakashi Nakayama <tnak@chromium.org>
--

wpt-commits: eb2d81823d73f624e3ce9b82dc92685585d18ffd
wpt-pr: 52630

Differential Revision: https://phabricator.services.mozilla.com/D250697
parent f5adbf91

testing/web-platform/tests/preload/preload-referrer-policy-subresource-header.tentative.html

0 → 100644
+82 −0
Original line number Diff line number Diff line 
<!DOCTYPE html>

<meta charset=utf-8>

<title>The referrerpolicy attribute on Link header should be ignored for subresources</title>

<meta name="timeout" content="long">

<script src="resources/dummy.js?link-header-preload2"></script>

<script src="/common/get-host-info.sub.js"></script>

<script src="/common/utils.js"></script>

<script src="/resources/testharness.js"></script>

<script src="/resources/testharnessreport.js"></script>

<script src="/preload/resources/preload_helper.js"></script>

<body>

    <p>The referrerpolicy attribute on Link header should be ignored for subresources

    to prevent cross-origin referrer leakage</p>

<script>

window.referrers = {};

const {REMOTE_ORIGIN} = get_host_info();

async function loader(t, {preloadPolicy, resourcePolicy, isCrossOriginResource, hrefUrl, hrefParams}) {

    const img = document.createElement('img');

    const params = new URLSearchParams();

    params.set('href', `${hrefUrl}?${hrefParams.toString()}`);

    if (preloadPolicy === '')

        params.set('preload-policy', '');

    else

        params.set('preload-policy', `referrerpolicy=${preloadPolicy}`);

    params.set('resource-name', 'green.png');

    img.src = `${isCrossOriginResource ? REMOTE_ORIGIN : location.origin}/preload/resources/link-header-referrer-policy.py?${params.toString()}`;

    img.referrerPolicy = resourcePolicy;

    const preloaded = new Promise(resolve => img.addEventListener('load', resolve));

    t.add_cleanup(() => img.remove());

    document.body.appendChild(img);

    await preloaded;

    hrefParams.set('operation', 'take');

    const take_href = `${hrefUrl}?${hrefParams.toString()}`;

    let actualReferrer;

    for (let i = 0; i < 10; ++i) {

        actualReferrer = await fetch(take_href).then(res => res.text());

        if (actualReferrer === '') {

            // Preload request has not yet been received. Retry after timeout.

            await new Promise(resolve => t.step_timeout(resolve, 100));

        } else {

            break;

        }

    }

    return {actualReferrer, unsafe: img.src};

};



function test_referrer_policy(preloadPolicy, resourcePolicy, isCrossOriginPreload, isCrossOriginResource) {

    promise_test(async t => {

        const id = token();

        const hrefUrl = `${isCrossOriginPreload ? REMOTE_ORIGIN : location.origin}/preload/resources/stash-referrer.py`;

        const hrefParams = new URLSearchParams();

        hrefParams.set('key', id);

        hrefParams.set('operation', 'put');

        const {actualReferrer, unsafe} = await loader(t, {preloadPolicy, resourcePolicy, isCrossOriginResource, hrefUrl, hrefParams})

        assert_equals(actualReferrer, 'NO-REFERER');

    }, `referrer policy (${preloadPolicy} -> ${resourcePolicy}, ${isCrossOriginPreload ? 'cross-origin' : 'same-origin'}, ${isCrossOriginResource ? 'cross-origin' : 'same-origin'})`)

}

const policies = [

"",

"no-referrer",

"same-origin",

"origin",

"origin-when-cross-origin",

"strict-origin-when-cross-origin",

"unsafe-url"]



for (const preloadPolicy of policies) {

    for (const resourcePolicy of policies) {

        for (const isCrossOriginPreload of [true, false]) {

            for (const isCrossOriginResource of [true, false]) {

                test_referrer_policy(

                    preloadPolicy,

                    resourcePolicy,

                    isCrossOriginPreload,

                    isCrossOriginResource);

            }

        }

    }

}



</script>

</body>

testing/web-platform/tests/preload/preload-referrer-policy.html

+1 −0
Original line number Diff line number Diff line
@@ -24,6 +24,7 @@ const loaders = { 
            params.set('preload-policy', '');

        else

            params.set('preload-policy', `referrerpolicy=${preloadPolicy}`);

        params.set('resource-name', 'link-header-referrer-policy.html');

        iframe.src = `resources/link-header-referrer-policy.py?${params.toString()}`;

        t.add_cleanup(() => iframe.remove());

        const done = new Promise(resolve => {

testing/web-platform/tests/preload/resources/link-header-referrer-policy.py

+3 −3
Original line number Diff line number Diff line
@@ -3,9 +3,9 @@ def main(request, response): 
                        (request.GET.first(b"href", b""),

                         request.GET.first(b"preload-policy", b"")))]

    body = ""

    body_name_list = __file__.split(".")[:-1]

    body_name_list.append("html")

    filename = ".".join(body_name_list)

    body_name_list = __file__.split("/")[:-1]

    body_name_list.append(request.GET.first(b"resource-name",  b"").decode("utf-8"))

    filename = "/".join(body_name_list)

    with open(filename, 'r+b') as f:

        body = f.readlines()

    return (200, response_headers, body)

testing/web-platform/tests/preload/resources/stash-referrer.py

0 → 100644
+18 −0
Original line number Diff line number Diff line 
from wptserve.utils import isomorphic_decode



def main(request, response):

    response.headers.set(b'Access-Control-Allow-Origin', b'*')



    # We assume this is a string representing a UUID

    key = request.GET.first(b'key')

    operation = request.GET.first(b'operation')



    if operation == b'put':

        referer = request.headers.get(b'referer') or 'NO-REFERER'

        request.server.stash.put(key, referer)

        return "Added value to stash"

    elif operation == b'take':

        value = request.server.stash.take(key)

        return value or ''

    else:

        assert False