Add WPT tests for SameSite cookies in ServiceWorkers with nested frames.

This CL adds a number of new cases to the service worker SameSite cookies test. The cases break down into two general types: 1. Cases where A1 frames B frames A2, and then A2 calls window.open() to an A origin URL. 2. Cases where A1 frames B frames A2, and then A2 sets the location to an A origin URL. For (1) we expect SameSite strict cookies to be sent because window.open() creates a top-level context that will have a populated site-for-cookies and the initiator is same-origin (regardless of the cross-site ancestor chain). For (2) we expect only SameSite=None cookies to be sent. This is because setting the location results in a navigation to an A1->B->A3 nested frame with an empty site-for-cookies. We currently fail the passthrough and change-request cases for (2). We plan to fix this as part of storage partitioning with an ancestor chain bit in the StorageKey. See: privacycg/storage-partitioning#25 This CL also includes some minor cleanup of the WPT test and associated resources. Bug: 1115847 Change-Id: I9002e60a271ae95d1d702068d44b30bd0e33b5dc
web-platform-tests · Nov 19, 2021 · 35013f1 · 35013f1
1 parent 4230a15
commit 35013f1
Show file tree

Hide file tree

Showing 7 changed files with 180 additions and 27 deletions.
diff --git a/service-workers/service-worker/resources/form-poster.html b/service-workers/service-worker/resources/form-poster.html
@@ -1,4 +1,5 @@
 <!DOCTYPE html>
+<meta charset="utf-8"/>
 <meta name="referrer" content="origin">
 <form method="POST" id="form"></form>
 <script>

diff --git a/service-workers/service-worker/resources/location-setter.html b/service-workers/service-worker/resources/location-setter.html
@@ -1,4 +1,5 @@
 <!DOCTYPE html>
+<meta charset="utf-8"/>
 <meta name="referrer" content="origin">
 <script>
 function onLoad() {

diff --git a/service-workers/service-worker/resources/nested-parent.html b/service-workers/service-worker/resources/nested-parent.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="referrer" content="origin">
+<script>
+async function onLoad() {
+  self.addEventListener('message', evt => {
+    if (self.opener)
+      self.opener.postMessage(evt.data, '*');
+    else
+      self.top.postMessage(evt.data, '*');
+  }, { once: true });
+  const params = new URLSearchParams(self.location.search);
+  const frame = document.createElement('iframe');
+  frame.src = params.get('target');
+  document.body.appendChild(frame);
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/service-workers/service-worker/resources/same-site-cookies-register.html b/service-workers/service-worker/resources/same-site-cookies-register.html
@@ -5,18 +5,27 @@
   const scope = self.origin + '/cookies/resources/postToParent.py?with-sw';
   const script = './fetch-rewrite-worker.js';
   const reg = await navigator.serviceWorker.register(script, { scope: scope });
-  await new Promise(resolve => {
-    const worker = reg.installing;
-    worker.addEventListener('statechange', evt => {
-      if (worker.state === 'activated') {
-        resolve();
-      }
+  // In nested cases we may be impacted by partitioning or not depending on
+  // the browser.  With partitioning we will be installing a new worker here,
+  // but without partitioning the worker will already exist.  Handle both cases.
+  if (reg.installing) {
+    await new Promise(resolve => {
+      const worker = reg.installing;
+      worker.addEventListener('statechange', evt => {
+        if (worker.state === 'activated') {
+          resolve();
+        }
+      });
     });
-  });
-  if (reg.navigationPreload) {
-    await reg.navigationPreload.enable();
+    if (reg.navigationPreload) {
+      await reg.navigationPreload.enable();
+    }
+  }
+  if (window.opener) {
+    window.opener.postMessage({ type: 'SW-REGISTERED' }, '*');
+  } else {
+    window.top.postMessage({ type: 'SW-REGISTERED' }, '*');
   }
-  window.opener.postMessage({ type: 'SW-REGISTERED' }, '*');
 }
 self.addEventListener('load', onLoad);
 </script>
diff --git a/service-workers/service-worker/resources/same-site-cookies-unregister.html b/service-workers/service-worker/resources/same-site-cookies-unregister.html
@@ -4,8 +4,14 @@
 async function onLoad() {
   const scope = self.origin + '/cookies/resources/postToParent.py?with-sw';
   const reg = await navigator.serviceWorker.getRegistration(scope);
-  await reg.unregister();
-  window.opener.postMessage({ type: 'SW-UNREGISTERED' }, '*');
+  if (reg) {
+    await reg.unregister();
+  }
+  if (window.opener) {
+    window.opener.postMessage({ type: 'SW-UNREGISTERED' }, '*');
+  } else {
+    window.top.postMessage({ type: 'SW-UNREGISTERED' }, '*');
+  }
 }
 self.addEventListener('load', onLoad);
 </script>
diff --git a/service-workers/service-worker/resources/window-opener.html b/service-workers/service-worker/resources/window-opener.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<meta charset="utf-8"/>
+<meta name="referrer" content="origin">
+<script>
+function onLoad() {
+  self.onmessage = evt => {
+    if (self.opener)
+      self.opener.postMessage(evt.data, '*');
+    else
+      self.top.postMessage(evt.data, '*');
+  }
+  const params = new URLSearchParams(self.location.search);
+  const w = window.open(params.get('target'));
+  self.addEventListener('unload', evt => w.close());
+}
+self.addEventListener('load', onLoad);
+</script>
diff --git a/service-workers/service-worker/same-site-cookies.https.html b/service-workers/service-worker/same-site-cookies.https.html
@@ -10,19 +10,33 @@
 <body>
 <script>
 'use strict';
-async function unregister_service_worker(origin) {
-  const w = window.open(origin +
-      '/service-workers/service-worker/resources/same-site-cookies-unregister.html');
+
+function make_nested_url(nested_origins, target_url) {
+  for (let i = nested_origins.length - 1; i >= 0; --i) {
+    target_url = new URL(
+      `./resources/nested-parent.html?target=${encodeURIComponent(target_url)}`,
+      nested_origins[i] + self.location.pathname);
+  }
+  return target_url;
+}
+
+async function unregister_service_worker(origin, nested_origins=[]) {
+  let target_url = origin +
+      '/service-workers/service-worker/resources/same-site-cookies-unregister.html';
+  target_url = make_nested_url(nested_origins, target_url);
+  const w = window.open(target_url);
   try {
     await wait_for_message('SW-UNREGISTERED');
   } finally {
     w.close();
   }
 }
 
-async function register_service_worker(origin) {
-  const w = window.open(origin +
-      '/service-workers/service-worker/resources/same-site-cookies-register.html');
+async function register_service_worker(origin, nested_origins=[]) {
+  let target_url = origin +
+      '/service-workers/service-worker/resources/same-site-cookies-register.html';
+  target_url = make_nested_url(nested_origins, target_url);
+  const w = window.open(target_url);
   try {
     await wait_for_message('SW-REGISTERED');
   } finally {
@@ -31,7 +45,7 @@
 }
 
 async function run_test(t, origin, navaction, swaction, expected,
-                        redirect_origins=[]) {
+                        redirect_origins=[], nested_origins=[]) {
   const value = 'COOKIE_VALUE';
   await resetSameSiteCookies(origin, value);
   if (swaction === 'navpreload') {
@@ -59,23 +73,32 @@
   }
 
   if (navaction === 'window.open') {
-    const w = window.open(target_url);
-    t.add_cleanup(() => w.close());
+    target_url = new URL(
+        `./resources/window-opener.html?target=${encodeURIComponent(target_url)}`,
+        self.origin + self.location.pathname);
   } else if (navaction === 'form post') {
-    const poster_url =
-        `./resources/form-poster.html?target=${encodeURIComponent(target_url)}`;
-    const w = window.open(poster_url);
-    t.add_cleanup(() => w.close());
+    target_url = new URL(
+        `./resources/form-poster.html?target=${encodeURIComponent(target_url)}`,
+        self.origin + self.location.pathname);
+  } else if (navaction === 'set location') {
+    target_url = new URL(
+        `./resources/location-setter.html?target=${encodeURIComponent(target_url)}`,
+        self.origin + self.location.pathname);
   }
+
+  const w = window.open(make_nested_url(nested_origins, target_url));
+  t.add_cleanup(() => w.close());
+
   const result = await wait_for_message('COOKIES');
-  verifySameSiteCookieState(expected, value, result.data,
-                            DomSameSiteStatus.SAME_SITE);
+  verifySameSiteCookieState(expected, value, result.data);
 }
 
 promise_test(async t => {
   await register_service_worker(self.origin);
   await register_service_worker(SECURE_SUBDOMAIN_ORIGIN);
   await register_service_worker(SECURE_CROSS_SITE_ORIGIN);
+  await register_service_worker(self.origin,
+      [self.origin, SECURE_CROSS_SITE_ORIGIN]);
 }, 'Setup service workers');
 
 promise_test(t => {
@@ -236,6 +259,82 @@
 }, 'same-origin, window.open with navpreload, cross-site redirect, and ' +
    'same-origin redirect');
 
+//
+// Double-nested frame calling open.window() tests
+//
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'no-sw',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'no service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'fallback',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'fallback service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'passthrough',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'passthrough service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'change-request',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'change-request service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'window.open', 'navpreload',
+                  SameSiteStatus.STRICT, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested window.open with cross-site middle frame and ' +
+   'navpreload service worker');
+
+//
+// Double-nested frame setting location tests
+//
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'no-sw',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'no service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'fallback',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'fallback service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'passthrough',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'passthrough service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'change-request',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'change-request service worker');
+
+promise_test(t => {
+  return run_test(t, self.origin, 'set location', 'navpreload',
+                  SameSiteStatus.CROSS_SITE, [],
+                  [self.origin, SECURE_CROSS_SITE_ORIGIN]);
+}, 'same-origin, nested set location with cross-site middle frame and ' +
+   'navpreload service worker');
+
 //
 // Form POST tests
 //
@@ -379,6 +478,8 @@
   await unregister_service_worker(self.origin);
   await unregister_service_worker(SECURE_SUBDOMAIN_ORIGIN);
   await unregister_service_worker(SECURE_CROSS_SITE_ORIGIN);
+  await unregister_service_worker(self.origin,
+      [self.origin, SECURE_CROSS_SITE_ORIGIN]);
 }, 'Cleanup service workers');
 
 </script>