Skip to content

GitLab

T
tangled
Commit 9fdf19ad authored by Nate Chapin's avatar Nate Chapin Committed by Commit Bot
Browse files
Options

Disable framebusting intervention for M67 

Bug: 624061
Change-Id: Ibe1c69d7329590ce86d53463e030e594ff079bf4
Reviewed-on: https://chromium-review.googlesource.com/1040787Reviewed-by: default avatarNasko Oskov <nasko@chromium.org>
Commit-Queue: Nate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/heads/master@{#555631}
parent d717ddc6
Hide whitespace changes
Inline Side-by-side
Showing with 10 additions and 19 deletions
content/public/common/content_features.cc
View file @ 9fdf19ad
...@@ -129,7 +129,7 @@ const base::Feature kFontCacheScaling{"FontCacheScaling", ...@@ -129,7 +129,7 @@ const base::Feature kFontCacheScaling{"FontCacheScaling",
// same-origin to the top frame, or if a user gesture is being processed. // same-origin to the top frame, or if a user gesture is being processed.
const base::Feature kFramebustingNeedsSameOriginOrUserGesture{ const base::Feature kFramebustingNeedsSameOriginOrUserGesture{
"FramebustingNeedsSameOriginOrUserGesture", "FramebustingNeedsSameOriginOrUserGesture",
base::FEATURE_ENABLED_BY_DEFAULT}; base::FEATURE_DISABLED_BY_DEFAULT};
// Enables extended Gamepad API features like motion tracking and haptics. // Enables extended Gamepad API features like motion tracking and haptics.
const base::Feature kGamepadExtensions{"GamepadExtensions", const base::Feature kGamepadExtensions{"GamepadExtensions",
......
third_party/WebKit/LayoutTests/http/tests/security/frameNavigation/resources/iframe-that-performs-top-navigation-without-user-gesture.html
View file @ 9fdf19ad
<html> <html>
<body> <body>
The navigation should fail. This text should be visible. The navigation should succeed. This text shouldn't appear.
<script> <script>
window.onload = function() window.onload = function()
{ {
try { try {
top.location = "http://localhost:8000/security/frameNavigation/resources/navigation-changed-iframe.html"; top.location = "http://localhost:8000/security/frameNavigation/resources/navigation-changed-iframe.html";
top.postMessage("FAIL", "*");
} catch(e) {
top.postMessage("PASS", "*"); top.postMessage("PASS", "*");
} catch(e) {
top.postMessage("FAIL", "*");
} }
} }
</script> </script>
......
third_party/WebKit/LayoutTests/http/tests/security/frameNavigation/xss-DENIED-top-navigation-user-gesture-in-parent-expected.txt
View file @ 9fdf19ad
localhost
PASSED: Navigation succeeded.
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
The navigation should fail. This text should be visible.
third_party/WebKit/LayoutTests/http/tests/security/frameNavigation/xss-DENIED-top-navigation-without-user-gesture-expected.txt
View file @ 9fdf19ad
CONSOLE ERROR: line 8: Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1:8000/security/frameNavigation/xss-DENIED-top-navigation-without-user-gesture.html' from frame with URL 'http://localhost:8000/security/frameNavigation/resources/iframe-that-performs-top-navigation-without-user-gesture.html'. The frame attempting navigation is targeting its top-level window, but is neither same-origin with its target nor has it received a user gesture. See https://www.chromestatus.com/features/5851021045661696. CONSOLE WARNING: line 8: Frame with URL 'http://localhost:8000/security/frameNavigation/resources/iframe-that-performs-top-navigation-without-user-gesture.html' attempted to navigate its top-level window with URL 'http://127.0.0.1:8000/security/frameNavigation/xss-DENIED-top-navigation-without-user-gesture.html'. Navigating the top-level window from a cross-origin iframe will soon require that the iframe has received a user gesture. See https://www.chromestatus.com/features/5851021045661696.
localhost
PASSED: Navigation succeeded.
--------
Frame: '<!--framePath //<!--frame0-->-->'
--------
The navigation should fail. This text should be visible.
third_party/blink/renderer/platform/runtime_enabled_features.json5
View file @ 9fdf19ad
...@@ -530,7 +530,7 @@ ...@@ -530,7 +530,7 @@
{ {
name: "FramebustingNeedsSameOriginOrUserGesture", name: "FramebustingNeedsSameOriginOrUserGesture",
settable_from_internals: true, settable_from_internals: true,
status: "stable", status: "experimental",
}, },
{ {
name: "FramesTimingFunction", name: "FramesTimingFunction",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment