Bug 236049 – Many CSP tests timing out with "Blocked access to external URL" error

• Component: New Bugs
• Status: NEW

[Kate Cheney]

Many CSP tests timing out with "Blocked access to external URL" error

[Kate Cheney]

Created attachment 450721 [details]
Patch

[EWS Watchlist]

This patch modifies the imported WPT tests. Please ensure that any changes on the tests (not coming from a WPT import) are exported to WPT. Please see https://trac.webkit.org/wiki/WPTExportProcess

[Kate Cheney]

Created attachment 451315 [details]
WIP 2

[youenn fablet]

Comment on attachment 451315 [details]
WIP 2

View in context: https://bugs.webkit.org/attachment.cgi?id=451315&action=review

> LayoutTests/imported/w3c/web-platform-tests/common/security-features/resources/common.sub.js:977
> +  const crossOriginHost = "127.0.0.1";

const crossOriginHost = {{hosts[alt][]}}

> LayoutTests/imported/w3c/web-platform-tests/common/security-features/subresource/subresource.py:31
> +        return "127.0.0.1"

Can we check whether subdomain is important here or whether we could use alternate here as well?

[Kate Cheney]

Comment on attachment 451315 [details]
WIP 2

View in context: https://bugs.webkit.org/attachment.cgi?id=451315&action=review

>> LayoutTests/imported/w3c/web-platform-tests/common/security-features/resources/common.sub.js:977
>> +  const crossOriginHost = "127.0.0.1";
> 
> const crossOriginHost = {{hosts[alt][]}}

Will change.

>> LayoutTests/imported/w3c/web-platform-tests/common/security-features/subresource/subresource.py:31
>> +        return "127.0.0.1"
> 
> Can we check whether subdomain is important here or whether we could use alternate here as well?

CSP tests use this to perform a swap-origin redirect, which is referenced in the wpt repo (https://github.com/web-platform-tests/wpt/pull/1856) as being when the final origin of the load after redirection is cross origin. That leads me to believe this function is only trying to get a cross origin domain and the existence of a subdomain doesn't actually matter.

This aligns with the if-else which checks the netloc and returns a cross-origin host regardless of whether it exists (e.g. a netloc of ww1.localhost returns localhost, and a netloc of localhost returns ww1.localhost).

A solution that aligns more with our http tests would be to return "127.0.0.1" if netloc is "localhost" and vice versa.

[Kate Cheney]

Created attachment 451433 [details]
WIP 3

[Kate Cheney]

Comment on attachment 451433 [details]
WIP 3

View in context: https://bugs.webkit.org/attachment.cgi?id=451433&action=review

> LayoutTests/imported/w3c/web-platform-tests/common/security-features/subresource/subresource.py:28
> +    if netloc == "localhost":

@Youenn is there a way to get localhost without hardcoding?

[Radar WebKit Bug Importer]

<rdar://problem/88724733>

[Kate Cheney]

Created attachment 451560 [details]
Patch