Skip to content

GitLab

T
tangled
Commit 64f4e318 authored by Nate Chapin's avatar Nate Chapin Committed by Commit Bot
Browse files
Options

Reenable framebusting intervention for M67+ 

This reverts commit 16fdb6c5.

Reason for revert: this was disabled just before the M66 branch point, reenabling on trunk. 
Original change's description:
> Disable framebusting intervention for M66.
> 
> Will reenable on trunk after the M66 branch point passes. M67 is the new target.
> 
> Bug: 624061
> Change-Id: Ied8563bbc21d3df3182a80aa5f5d1706ed0224d4
> 
> TBR=nasko@chromium.org,ojan@chromium.org,japhet@chromium.org
> 
> Change-Id: Ied8563bbc21d3df3182a80aa5f5d1706ed0224d4
> Reviewed-on: https://chromium-review.googlesource.com/941615
> Commit-Queue: Nate Chapin <japhet@chromium.org>
> Reviewed-by: Nate Chapin <japhet@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#539998}

TBR=nasko@chromium.org,ojan@chromium.org,japhet@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: 624061
Change-Id: I2db91d03d134cb8aa2febcd5f7d923d45bf41814
Reviewed-on: https://chromium-review.googlesource.com/980896Reviewed-by: default avatarNate Chapin <japhet@chromium.org>
Commit-Queue: Nate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/heads/master@{#546141}
parent 5d97f053
Hide whitespace changes
Inline Side-by-side
Showing with 19 additions and 10 deletions
content/public/common/content_features.cc
View file @ 64f4e318
...@@ -115,7 +115,7 @@ const base::Feature kFontCacheScaling{"FontCacheScaling", ...@@ -115,7 +115,7 @@ const base::Feature kFontCacheScaling{"FontCacheScaling",
// same-origin to the top frame, or if a user gesture is being processed. // same-origin to the top frame, or if a user gesture is being processed.
const base::Feature kFramebustingNeedsSameOriginOrUserGesture{ const base::Feature kFramebustingNeedsSameOriginOrUserGesture{
"FramebustingNeedsSameOriginOrUserGesture", "FramebustingNeedsSameOriginOrUserGesture",
base::FEATURE_DISABLED_BY_DEFAULT}; base::FEATURE_ENABLED_BY_DEFAULT};
// Enables extended Gamepad API features like motion tracking and haptics. // Enables extended Gamepad API features like motion tracking and haptics.
const base::Feature kGamepadExtensions{"GamepadExtensions", const base::Feature kGamepadExtensions{"GamepadExtensions",
......
third_party/WebKit/LayoutTests/http/tests/security/frameNavigation/resources/iframe-that-performs-top-navigation-without-user-gesture.html
View file @ 64f4e318
<html> <html>
<body> <body>
The navigation should succeed. This text shouldn't appear. The navigation should fail. This text should be visible.
<script> <script>
window.onload = function() window.onload = function()
{ {
try { try {
top.location = "http://localhost:8000/security/frameNavigation/resources/navigation-changed-iframe.html"; top.location = "http://localhost:8000/security/frameNavigation/resources/navigation-changed-iframe.html";
top.postMessage("PASS", "*");
} catch(e) {
top.postMessage("FAIL", "*"); top.postMessage("FAIL", "*");
} catch(e) {
top.postMessage("PASS", "*");
} }
} }
</script> </script>
......
third_party/WebKit/LayoutTests/http/tests/security/frameNavigation/xss-DENIED-top-navigation-user-gesture-in-parent-expected.txt
View file @ 64f4e318
localhost
PASSED: Navigation succeeded.
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
The navigation should fail. This text should be visible.
third_party/WebKit/LayoutTests/http/tests/security/frameNavigation/xss-DENIED-top-navigation-without-user-gesture-expected.txt
View file @ 64f4e318
CONSOLE WARNING: line 8: Frame with URL 'http://localhost:8000/security/frameNavigation/resources/iframe-that-performs-top-navigation-without-user-gesture.html' attempted to navigate its top-level window with URL 'http://127.0.0.1:8000/security/frameNavigation/xss-DENIED-top-navigation-without-user-gesture.html'. Navigating the top-level window from a cross-origin iframe will soon require that the iframe has received a user gesture. See https://www.chromestatus.com/features/5851021045661696. CONSOLE ERROR: line 8: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/frameNavigation/xss-DENIED-top-navigation-without-user-gesture.html' from frame with URL 'http://localhost:8000/security/frameNavigation/resources/iframe-that-performs-top-navigation-without-user-gesture.html'. The frame attempting navigation is targeting its top-level window, but is neither same-origin with its target nor has it received a user gesture. See https://www.chromestatus.com/features/5851021045661696.
localhost
PASSED: Navigation succeeded.
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
The navigation should fail. This text should be visible.
third_party/WebKit/Source/platform/runtime_enabled_features.json5
View file @ 64f4e318
...@@ -501,7 +501,7 @@ ...@@ -501,7 +501,7 @@
{ {
name: "FramebustingNeedsSameOriginOrUserGesture", name: "FramebustingNeedsSameOriginOrUserGesture",
settable_from_internals: true, settable_from_internals: true,
status: "experimental", status: "stable",
}, },
{ {
name: "FramesTimingFunction", name: "FramesTimingFunction",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment