Skip to content

GitLab

T
tangled
Commit 16fdb6c5 authored by Nate Chapin's avatar Nate Chapin Committed by Commit Bot
Browse files
Options

Disable framebusting intervention for M66. 

Will reenable on trunk after the M66 branch point passes. M67 is the new target.

Bug: 624061
Change-Id: Ied8563bbc21d3df3182a80aa5f5d1706ed0224d4

TBR=nasko@chromium.org,ojan@chromium.org,japhet@chromium.org

Change-Id: Ied8563bbc21d3df3182a80aa5f5d1706ed0224d4
Reviewed-on: https://chromium-review.googlesource.com/941615
Commit-Queue: Nate Chapin <japhet@chromium.org>
Reviewed-by: default avatarNate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/heads/master@{#539998}
parent 6e761114
Hide whitespace changes
Inline Side-by-side
Showing with 10 additions and 19 deletions
content/public/common/content_features.cc
View file @ 16fdb6c5
...@@ -121,7 +121,7 @@ const base::Feature kFontCacheScaling{"FontCacheScaling", ...@@ -121,7 +121,7 @@ const base::Feature kFontCacheScaling{"FontCacheScaling",
// same-origin to the top frame, or if a user gesture is being processed. // same-origin to the top frame, or if a user gesture is being processed.
const base::Feature kFramebustingNeedsSameOriginOrUserGesture{ const base::Feature kFramebustingNeedsSameOriginOrUserGesture{
"FramebustingNeedsSameOriginOrUserGesture", "FramebustingNeedsSameOriginOrUserGesture",
base::FEATURE_ENABLED_BY_DEFAULT}; base::FEATURE_DISABLED_BY_DEFAULT};
// Enables extended Gamepad API features like motion tracking and haptics. // Enables extended Gamepad API features like motion tracking and haptics.
const base::Feature kGamepadExtensions{"GamepadExtensions", const base::Feature kGamepadExtensions{"GamepadExtensions",
......
third_party/WebKit/LayoutTests/http/tests/security/frameNavigation/resources/iframe-that-performs-top-navigation-without-user-gesture.html
View file @ 16fdb6c5
<html> <html>
<body> <body>
The navigation should fail. This text should be visible. The navigation should succeed. This text shouldn't appear.
<script> <script>
window.onload = function() window.onload = function()
{ {
try { try {
top.location = "http://localhost:8000/security/frameNavigation/resources/navigation-changed-iframe.html"; top.location = "http://localhost:8000/security/frameNavigation/resources/navigation-changed-iframe.html";
top.postMessage("FAIL", "*");
} catch(e) {
top.postMessage("PASS", "*"); top.postMessage("PASS", "*");
} catch(e) {
top.postMessage("FAIL", "*");
} }
} }
</script> </script>
......
third_party/WebKit/LayoutTests/http/tests/security/frameNavigation/xss-DENIED-top-navigation-user-gesture-in-parent-expected.txt
View file @ 16fdb6c5
localhost
PASSED: Navigation succeeded.
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
The navigation should fail. This text should be visible.
third_party/WebKit/LayoutTests/http/tests/security/frameNavigation/xss-DENIED-top-navigation-without-user-gesture-expected.txt
View file @ 16fdb6c5
CONSOLE ERROR: line 8: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/frameNavigation/xss-DENIED-top-navigation-without-user-gesture.html' from frame with URL 'http://localhost:8000/security/frameNavigation/resources/iframe-that-performs-top-navigation-without-user-gesture.html'. The frame attempting navigation is targeting its top-level window, but is neither same-origin with its target nor has it received a user gesture. See https://www.chromestatus.com/features/5851021045661696. CONSOLE WARNING: line 8: Frame with URL 'http://localhost:8000/security/frameNavigation/resources/iframe-that-performs-top-navigation-without-user-gesture.html' attempted to navigate its top-level window with URL 'http://127.0.0.1:8000/security/frameNavigation/xss-DENIED-top-navigation-without-user-gesture.html'. Navigating the top-level window from a cross-origin iframe will soon require that the iframe has received a user gesture. See https://www.chromestatus.com/features/5851021045661696.
localhost
PASSED: Navigation succeeded.
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
The navigation should fail. This text should be visible.
third_party/WebKit/Source/platform/runtime_enabled_features.json5
View file @ 16fdb6c5
...@@ -450,7 +450,7 @@ ...@@ -450,7 +450,7 @@
{ {
name: "FramebustingNeedsSameOriginOrUserGesture", name: "FramebustingNeedsSameOriginOrUserGesture",
settable_from_internals: true, settable_from_internals: true,
status: "stable", status: "experimental",
}, },
{ {
name: "FramesTimingFunction", name: "FramesTimingFunction",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment