228291 2021-07-26 12:07:08 -0700 Referrer-Policy not properly applying with iframe redirections 2021-08-02 12:08:28 -0700 1 1 1 Unclassified WebKit Page Loading WebKit Local Build Unspecified Unspecified NEW http://wpt.live/referrer-policy/gen/top.http-rp/same-origin/iframe-tag.http.html InRadar P2 Normal --- 1 gsnedders achristensen achristensen beidson bfulgham cdumez ews-watchlist japhet webkit-bug-importer wilander oldest_to_newest 1779505 0 gsnedders 2021-07-26 12:07:08 -0700 wpt.fyi shows a variety of iframe-related failures: https://wpt.fyi/results/referrer-policy/gen?label=master&label=experimental&product=chrome&product=firefox&product=webkitgtk&aligned&q=count%3A2%28status%3Apass%29%20none%28status%3Amissing%7Cstatus%3Anotrun%29%20%21sharedworker (using WebKitGTK as it contains more recent fixes in this area than the latest STP run) Essentially, regardless of where the policy is specified, we fail to apply a policy on redirection from same (HTTP, not HTTPS) origin, and hence end up sending the Referrer when we shouldn't. 1780267 1 434478 achristensen 2021-07-28 17:06:15 -0700 Created attachment 434478 Patch 1780278 2 434478 achristensen 2021-07-28 17:44:49 -0700 Comment on attachment 434478 Patch This also breaks several other tests. This isn't quite right. 1780297 3 achristensen 2021-07-28 19:12:39 -0700 SubresourceLoader::checkRedirectionCrossOriginAccessControl is also a good place to look around 1781347 4 webkit-bug-importer 2021-08-02 12:08:28 -0700 <rdar://problem/81423168> 434478 2021-07-28 17:06:15 -0700 2021-07-28 18:48:08 -0700 Patch bug-228291-20210728170614.patch text/plain 2348 achristensen U3VidmVyc2lvbiBSZXZpc2lvbjogMjgwMzkwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMDdiMDczOGQ1MjQ2ODQz Yjg0Njc4NTNkYTZjYWY4NGRhYzZjYmIxYy4uZmIwOWIxYmM1ZjNkZjRiNjU4NDU5MDM5ZDQ3ZTQ4 OTM1NTk1MWIzZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDIxLTA3LTI4ICBBbGV4 IENocmlzdGVuc2VuICA8YWNocmlzdGVuc2VuQHdlYmtpdC5vcmc+CisKKyAgICAgICAgUmVmZXJy ZXItUG9saWN5IG5vdCBwcm9wZXJseSBhcHBseWluZyB3aXRoIGlmcmFtZSByZWRpcmVjdGlvbnMK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyODI5MQor CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoaXMgZml4 ZXMgYSB0ZXN0IHdlIGhhdmVuJ3QgaW1wb3J0ZWQgYmVjYXVzZSBvZiBsYWNrIG9mIGNyb3NzLW9y aWdpbiBzdXBwb3J0IGluIG91ciBXUFQgcnVubmVyOgorICAgICAgICBodHRwOi8vd3B0LmxpdmUv cmVmZXJyZXItcG9saWN5L2dlbi9pZnJhbWUuaHR0cC1ycC9zYW1lLW9yaWdpbi9pZnJhbWUtdGFn Lmh0dHAuaHRtbAorCisgICAgICAgICogbG9hZGVyL1N1YmZyYW1lTG9hZGVyLmNwcDoKKyAgICAg ICAgKFdlYkNvcmU6OkZyYW1lTG9hZGVyOjpTdWJmcmFtZUxvYWRlcjo6bG9hZE9yUmVkaXJlY3RT dWJmcmFtZSk6CisKIDIwMjEtMDctMjggIFJ5b3N1a2UgTml3YSAgPHJuaXdhQHdlYmtpdC5vcmc+ CiAKICAgICAgICAgRGVwbG95IG1vcmUgdXNlIG9mIHNtYXJ0IHBvaW50ZXJzIGluIERvY3VtZW50 LmNwcApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvbG9hZGVyL1N1YmZyYW1lTG9hZGVyLmNw cCBiL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9TdWJmcmFtZUxvYWRlci5jcHAKaW5kZXggMGQ5ZGM2 NjBkMzI4OGY2MDMzYjVmNDgwYTZlN2I3ODI1ZWFiNTY3ZC4uMTYxMGUyNjAzMTMyYTQ3NmZjMWY0 OGFmN2JiOTY1NTRjOGU0YmQyZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvbG9hZGVyL1N1 YmZyYW1lTG9hZGVyLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvU3ViZnJhbWVMb2Fk ZXIuY3BwCkBAIC0yNDYsMTAgKzI0NiwxMyBAQCBGcmFtZSogRnJhbWVMb2FkZXI6OlN1YmZyYW1l TG9hZGVyOjpsb2FkT3JSZWRpcmVjdFN1YmZyYW1lKEhUTUxGcmFtZU93bmVyRWxlbWVudAogICAg IGluaXRpYXRpbmdEb2N1bWVudC5jb250ZW50U2VjdXJpdHlQb2xpY3koKS0+dXBncmFkZUluc2Vj dXJlUmVxdWVzdElmTmVlZGVkKHVwZ3JhZGVkUmVxdWVzdFVSTCwgQ29udGVudFNlY3VyaXR5UG9s aWN5OjpJbnNlY3VyZVJlcXVlc3RUeXBlOjpMb2FkKTsKIAogICAgIFJlZlB0cjxGcmFtZT4gZnJh bWUgPSBtYWtlUmVmUHRyKG93bmVyRWxlbWVudC5jb250ZW50RnJhbWUoKSk7CisKKyAgICBhdXRv IHJlZmVycmVyID0gU2VjdXJpdHlQb2xpY3k6OmdlbmVyYXRlUmVmZXJyZXJIZWFkZXIobV9mcmFt ZS5sb2FkZXIoKS5lZmZlY3RpdmVSZWZlcnJlclBvbGljeSgpLCByZXF1ZXN0VVJMLCBtX2ZyYW1l LmxvYWRlcigpLm91dGdvaW5nUmVmZXJyZXIoKSk7CisKICAgICBpZiAoZnJhbWUpCi0gICAgICAg IGZyYW1lLT5uYXZpZ2F0aW9uU2NoZWR1bGVyKCkuc2NoZWR1bGVMb2NhdGlvbkNoYW5nZShpbml0 aWF0aW5nRG9jdW1lbnQsIGluaXRpYXRpbmdEb2N1bWVudC5zZWN1cml0eU9yaWdpbigpLCB1cGdy YWRlZFJlcXVlc3RVUkwsIG1fZnJhbWUubG9hZGVyKCkub3V0Z29pbmdSZWZlcnJlcigpLCBsb2Nr SGlzdG9yeSwgbG9ja0JhY2tGb3J3YXJkTGlzdCk7CisgICAgICAgIGZyYW1lLT5uYXZpZ2F0aW9u U2NoZWR1bGVyKCkuc2NoZWR1bGVMb2NhdGlvbkNoYW5nZShpbml0aWF0aW5nRG9jdW1lbnQsIGlu aXRpYXRpbmdEb2N1bWVudC5zZWN1cml0eU9yaWdpbigpLCB1cGdyYWRlZFJlcXVlc3RVUkwsIHJl ZmVycmVyLCBsb2NrSGlzdG9yeSwgbG9ja0JhY2tGb3J3YXJkTGlzdCk7CiAgICAgZWxzZQotICAg ICAgICBmcmFtZSA9IGxvYWRTdWJmcmFtZShvd25lckVsZW1lbnQsIHVwZ3JhZGVkUmVxdWVzdFVS TCwgZnJhbWVOYW1lLCBtX2ZyYW1lLmxvYWRlcigpLm91dGdvaW5nUmVmZXJyZXIoKSk7CisgICAg ICAgIGZyYW1lID0gbG9hZFN1YmZyYW1lKG93bmVyRWxlbWVudCwgdXBncmFkZWRSZXF1ZXN0VVJM LCBmcmFtZU5hbWUsIHJlZmVycmVyKTsKIAogICAgIGlmICghZnJhbWUpCiAgICAgICAgIHJldHVy biBudWxscHRyOwo=