• Lukasz Anforowicz's avatar
    Enable CorbAllowlistAlsoAppliesToOorCors by default. · b69bd735
    Lukasz Anforowicz authored
    CorbAllowlistAlsoAppliesToOorCors (aka CORS-for-content-scripts) has
    been shipping to the stable channel with Chrome85 since Aug 25th (~2
    weeks ago).  There have been just a handful of allowlisting requests so
    far - therefore, it seems okay to declare that this change has
    successfully shipped to the stable channel.
    
    This CL transitions enabling CorbAllowlistAlsoAppliesToOorCors away from
    1) fieldtrial_testing_config.json and 2) field trial config (this
    includes preserving/copying the allowlisted extensions from
    site_isolation/data/CorsAndCorbAllowlist.gcl to
    //extensions/browser/url_loader_factory_manager.cc).
    
    After this CL we still retain an ability to allowlist extensions:
    1. Via field trial config (affecting Chrome versions prior to this CL
       - Chrome 85, Chrome 86 and a little bit of Chrome 87)
    2. Via the hardcoded allowlist in
      //extensions/browser/url_loader_factory_manager.cc (although this
      ability will go away soon - after https://crrev.com/c/2388709).
    
    This CL unblocks the following follow-up CLs:
    1. Adding |max_version| to the field trial config
       (google3 - cl/330527651)
    2. Starting deprecation of the allowlist
       (chromium3 - https://crrev.com/c/2388709)
    
    Bug: 920638
    Change-Id: I635eb0777dc83a7ad448f57b9de388ae071e0c9b
    Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2359393
    Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
    Reviewed-by: default avatarCharlie Reis <creis@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#805490}
    b69bd735
compromised-renderers.md 16.5 KB