Bug 183292 - Investigate usage of XMLHttpRequest's Permissions Policy usage
Summary: Investigate usage of XMLHttpRequest's Permissions Policy usage
Status: RESOLVED DUPLICATE of bug 202098
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified All
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks: 183300
  Show dependency tree / graph
 
Reported: 2018-03-02 09:35 PST by Ian Clelland
Modified: 2024-03-16 01:00 PDT (History)
7 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ian Clelland 2018-03-02 09:35:00 PST 
XMLHttpRequest objects can have their behavior controlled by feature policy
(https://github.com/whatwg/xhr/pull/177, not merged yet)

If the policy in the active document disallows the 'sync-xhr' feature, then calling .send() on the XMLHttpRequest object should throw a NetworkError (and ideally log a message to the developer console)

Demo: https://xhr.featurepolicy.rocks/
GitHub issue: https://github.com/whatwg/xhr/issues/178
Web Platform Tests: https://wpt.fyi/xhr/xmlhttprequest-sync-default-feature-policy.sub.html

Feature policy itself has been partially implemented as part of https://bugs.webkit.org/show_bug.cgi?id=167430, but I haven't found another bug for the rest of the implementation. Let me know if I should file that as well.
Comment 1 youenn fablet 2018-03-02 09:46:55 PST 
Hi Ian,

I guess that if there are other bugs related to feature policy that are filed, maybe having an umbrella bug might be useful.

The current feature policy "implementation" is minimal in that it only checks for the iframe attribute, (no headers checking) and is specific to media capture.
Comment 2 Ian Clelland 2018-03-02 13:21:04 PST 
Thanks, Youenn --- I filed https://bugs.webkit.org/show_bug.cgi?id=183300; I'm not sure if bugzilla allows me to declare a dependency of this bug on that one.
Comment 3 Anne van Kesteren 2024-03-15 05:58:15 PDT 
Letting a top-level site adjust the control flow of an embedded site is generally not a good idea. This has also been removed from XMLHttpRequest.
Comment 4 Anne van Kesteren 2024-03-15 06:08:36 PDT 
Actually, there is something implemented. Maybe that needs to be removed.
Comment 5 Anne van Kesteren 2024-03-16 01:00:23 PDT 

*** This bug has been marked as a duplicate of bug 202098 ***