After bug 218623, imported/w3c/web-platform-tests/service-workers/service-worker/fetch-mixed-content-to-inscope.https.html imported/w3c/web-platform-tests/service-workers/service-worker/fetch-mixed-content-to-outscope.https.html are failing. They do a complicate nesting of resource loading which arrives at service-workers/service-worker/resources/fetch-mixed-content-iframe-inscope-to-*html which loads http://127.0.0.1:8800(...)fetch-access-control.py?PNGIMAGE" ./dummy?url=http://127.0.0.1:8800(...)fetch-access-control.py?PNGIMAGE" as images. The test expects page load to fail but that's no longer the case with loopback IP addresses treated as secure. The corresponding tests at wpt.live https://wpt.live/service-workers/service-worker/fetch-mixed-content-to-inscope.https.html https://wpt.live/service-workers/service-worker/fetch-mixed-content-to-outscop.https.html still pass, since they don't use loopback IP addresses. So maybe it's a problem in our test infra as suggested in bug 218623 comment 9. An alternative would be to force TrustworthyLoopbackIPAddressesEnabled to be disabled during these tests, so that these PNG images are not treated as secure, but I was not able to do that even by adding a <!-- webkit-test-runner [ TrustworthyLoopbackIPAddressesEnabled=false ] --> header in the various HTML files involved in these tests.
(In reply to Frédéric Wang (:fredw) from comment #0) > An alternative would be to force TrustworthyLoopbackIPAddressesEnabled to be > disabled during these tests, so that these PNG images are not treated as > secure, but I was not able to do that even by adding a > > <!-- webkit-test-runner [ TrustworthyLoopbackIPAddressesEnabled=false ] --> > > header in the various HTML files involved in these tests. Uh... maybe that indicates that the ServiceWorker code is missing mixed content checks where required? That seems much more likely than a problem with the preferences, right?
(In reply to Michael Catanzaro from comment #1) > (In reply to Frédéric Wang (:fredw) from comment #0) > > An alternative would be to force TrustworthyLoopbackIPAddressesEnabled to be > > disabled during these tests, so that these PNG images are not treated as > > secure, but I was not able to do that even by adding a > > > > <!-- webkit-test-runner [ TrustworthyLoopbackIPAddressesEnabled=false ] --> > > > > header in the various HTML files involved in these tests. > > Uh... maybe that indicates that the ServiceWorker code is missing mixed > content checks where required? That seems much more likely than a problem > with the preferences, right? Yes, that makes sense. I guess we'll need to investigate this a bit more...
<rdar://problem/71529894>