Commit bb6707be authored by peter@chromium.org's avatar peter@chromium.org

Revert of [ServiceWorker] Don't allow registration of the ServiceWorker scope...

Revert of [ServiceWorker] Don't allow registration of the ServiceWorker scope outside the script directory. (patchset #4 id:70001 of https://codereview.chromium.org/672383003/)

Reason for revert:
This patch seems to have broken the following two browser_tests on all platforms, as can be seen on the non-layout bots on the Blink waterfall. We won't be able to roll Blink in Chromium until this is resolved.

PushMessagingBrowserTest.RegisterFailureNoPermission
PushMessagingBrowserTest.RegisterSuccess

Example output:
http://build.chromium.org/p/chromium.webkit/builders/Linux%20Tests%20%28dbg%29/builds/4400/steps/browser_tests/logs/RegisterSuccess

[INFO:CONSOLE(7)] "SecurityError - The scope must be under the directory of the script URL.", source: https://127.0.0.1:39935/files/push_messaging/test.html (7)
../../chrome/browser/services/gcm/push_messaging_browsertest.cc:142: Failure
Value of: register_worker_result
  Actual: "SecurityError - The scope must be under the directory of the script URL."
Expected: "ok"

Original issue's description:
> [ServiceWorker] Don't allow registration of the ServiceWorker scope outside the script directory.
> 
> As per discussion on https://github.com/slightlyoff/ServiceWorker/issues/468
> 
> BUG=423983
> 
> Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=184336

TBR=falken@chromium.org,horo@chromium.org
NOTREECHECKS=true
NOTRY=true
BUG=423983

Review URL: https://codereview.chromium.org/672353003

git-svn-id: svn://svn.chromium.org/blink/trunk@184364 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent cebf66f4
......@@ -6,7 +6,7 @@
<script src="../serviceworker/resources/test-helpers.js"></script>
<script>
var sw_url = 'resources/emptyworker.js';
var sw_scope = 'resources/service-worker-scope' + window.location.pathname;
var sw_scope = '/service-worker-scope' + window.location.pathname;
promise_test(function(test) {
return assert_promise_rejects(
......
......@@ -6,8 +6,6 @@
<script src="resources/scope.js"></script>
<script>
async_test(function(t) {
scope_test(
t, 'resources/scope-worker.js',
get_host_info().HTTP_ORIGIN + base_path() + 'resources/absolute_url/');
scope_test(t, 'resources/scope-worker.js', get_host_info().HTTP_ORIGIN);
}, 'Verify the scope property: absolute url');
</script>
<!DOCTYPE html>
<title>ServiceWorkerGlobalScope: scope property is default value</title>
<script src="../../resources/testharness.js"></script>
<script src="../../resources/testharness-helpers.js"></script>
<script src="../../resources/testharnessreport.js"></script>
<script src="../resources/test-helpers.js"></script>
<script src="resources/scope.js"></script>
<script>
promise_test(function(t) {
return assert_promise_rejects(
navigator.serviceWorker.register('resources/scope-worker.js'),
'SecurityError',
'Registering a script not in the root directory for the default scope' +
'should fail with SecurityError.');
}, 'Register a script not in the root directory for the default scope.');
async_test(function(t) {
scope_test(t, 'resources/scope-worker.js');
}, 'Verify the scope property: default scope');
</script>
......@@ -6,7 +6,6 @@
<script src="resources/scope.js"></script>
<script>
async_test(function(t) {
scope_test(t, 'resources/scope-worker.js',
base_path() + 'resources/relative_path/');
scope_test(t, 'resources/scope-worker.js', '/a/b/c/');
}, 'Verify the scope property: relative path');
</script>
......@@ -7,7 +7,7 @@
<script>
async_test(function(t) {
var scope = base_path() + '../resources/force-refresh-register';
var scope = '/force-refresh-register';
with_iframe('../resources/blank.html')
.then(t.step_func(function(frame) {
var p = new Promise(function(resolve) {
......
......@@ -15,7 +15,7 @@ async_test(function(t) {
var register_promises = [];
for (var i = 0; i < number_of_registrations; i++) {
var scope = base_path() + '../resources/registration-stress' + i;
var scope = i;
register_promises.push(with_iframe(scope)
.then(step(function(f) {
frames.push(f);
......
<!DOCTYPE html>
<script src="/js-test-resources/js-test.js"></script>
<script src="../resources/test-helpers.js"></script>
<script>
window.jsTestIsAsync = true;
description('Test that ServiceWorker and ServiceWorkerRegistration are not garbage collected prematurely');
var registrationObservation = null;
var swObservation = null;
var scope = base_path() + '../resources/gc';
var scope = 'gc';
if (!window.internals) {
testFailed('This test requires internals.observeGC');
......
......@@ -33,7 +33,7 @@ function syncWorker(test, worker, obj) {
async_test(function(t) {
// Passing scope as the test switch for worker script.
var scope = 'resources/install-fulfilled';
var scope = 'install-fulfilled';
var onRegister = function(worker) {
var obj = {};
wait_for_state(t, worker, 'installed')
......@@ -51,7 +51,7 @@ async_test(function(t) {
}, 'Test install event waitUntil fulfilled', properties);
async_test(function(t) {
var scope = 'resources/activate-fulfilled';
var scope = 'activate-fulfilled';
var onRegister = function(worker) {
var obj = {};
wait_for_state(t, worker, 'activating')
......@@ -72,7 +72,7 @@ async_test(function(t) {
}, 'Test activate event waitUntil fulfilled', properties);
async_test(function(t) {
var scope = 'resources/install-rejected';
var scope = 'install-rejected';
var onRegister = function(worker) {
wait_for_state(t, worker, 'redundant')
.then(function() {
......@@ -84,7 +84,7 @@ async_test(function(t) {
}, 'Test install event waitUntil rejected', properties);
async_test(function(t) {
var scope = 'resources/activate-rejected';
var scope = 'activate-rejected';
var onRegister = function(worker) {
wait_for_state(t, worker, 'redundant')
.then(function() {
......@@ -96,7 +96,7 @@ async_test(function(t) {
}, 'Test activate event waitUntil rejected.', properties);
async_test(function(t) {
var scope = 'resources/activate-multiple-fulfilled';
var scope = 'activate-multiple-fulfilled';
var onRegister = function(worker) {
var obj1 = {};
var obj2 = {};
......@@ -119,7 +119,7 @@ async_test(function(t) {
}, 'Test ExtendableEvent multiple waitUntil fulfilled.', properties);
async_test(function(t) {
var scope = 'resources/activate-reject-precedence';
var scope = 'activate-reject-precedence';
var onRegister = function(worker) {
wait_for_state(t, worker, 'redundant')
.then(function() {
......
......@@ -15,7 +15,7 @@ async_test(function(t) {
}, 'getRegistration');
async_test(function(t) {
var scope = 'resources/scope/worker/';
var scope = 'scope/worker/';
var registration;
service_worker_unregister_and_register(t, 'resources/empty-worker.js',
scope)
......@@ -47,7 +47,7 @@ async_test(function(t) {
}, 'getRegistration with a cross origin URL');
async_test(function(t) {
var scope = 'resources/scope/worker/';
var scope = 'scope/worker/';
service_worker_unregister_and_register(t, 'resources/empty-worker.js',
scope)
.then(function(registration) {
......
......@@ -17,7 +17,7 @@ test(function() {
async_test(function(t) {
var EVENT_HANDLER = 'object';
var scope = 'resources/scope/interfaces-and-attributes';
var scope = 'scope/interfaces-and-attributes';
var registration;
service_worker_unregister_and_register(
......
......@@ -6,7 +6,7 @@
var worker_url = 'resources/empty-worker.js';
async_test(function(t) {
var scope = 'resources/scope/subsequent-register-from-same-window';
var scope = 'scope/subsequent-register-from-same-window';
var registration;
service_worker_unregister_and_register(t, worker_url, scope)
......@@ -31,7 +31,7 @@ async_test(function(t) {
}, 'Subsequent registrations resolve to the same registration object');
async_test(function(t) {
var scope = 'resources/scope/subsequent-register-from-different-iframe';
var scope = 'scope/subsequent-register-from-different-iframe';
var frame;
var registration;
......@@ -89,7 +89,7 @@ async_test(function(t) {
'registration and workers');
async_test(function(t) {
var scope = 'resources/scope/concurrent-register';
var scope = 'scope/concurrent-register';
service_worker_unregister(t, scope)
.then(function() {
......
......@@ -8,7 +8,7 @@ var script2 = normalizeURL('resources/empty-worker.js?new');
// FIXME: The spec is in flux, this test's asserts may not be as per-spec.
async_test(function(t) {
var scope = 'resources/scope/register-new-script-concurrently';
var scope = 'scope/register-new-script-concurrently';
var registration;
var register_promise1;
var register_promise2;
......@@ -54,7 +54,7 @@ async_test(function(t) {
}, 'Register different scripts concurrently');
async_test(function(t) {
var scope = 'resources/scope/register-then-register-new-script';
var scope = 'scope/register-then-register-new-script';
var registration;
service_worker_unregister_and_register(t, script1, scope)
......@@ -104,7 +104,7 @@ async_test(function(t) {
}, 'Register then register new script URL');
async_test(function(t) {
var scope = 'resources/scope/register-then-register-new-script-404';
var scope = 'scope/register-then-register-new-script-404';
var registration;
service_worker_unregister_and_register(t, script1, scope)
......@@ -143,7 +143,7 @@ async_test(function(t) {
}, 'Register then register new script URL that 404s');
async_test(function(t) {
var scope = 'resources/scope/register-then-register-new-script-reject-install';
var scope = 'scope/register-then-register-new-script-reject-install';
var reject_script = normalizeURL('resources/reject-install-worker.js');
var registration;
......@@ -194,7 +194,7 @@ async_test(function(t) {
}, 'Register then register new script that does not install');
async_test(function(t) {
var scope = 'resources/scope/register-new-script-controller';
var scope = 'scope/register-new-script-controller';
var iframe;
var registration;
......
......@@ -7,7 +7,7 @@
var t = async_test('Registration: end-to-end');
t.step(function() {
var scope = 'resources/in-scope/';
var scope = '/in-scope/';
var serviceWorkerStates = [];
var lastServiceWorkerState = '';
var receivedMessageFromPort = '';
......
......@@ -6,7 +6,7 @@
<script>
var t = async_test('Registration: events');
t.step(function() {
var scope = 'resources/in-scope/';
var scope = '/in-scope/';
service_worker_unregister_and_register(
t, 'resources/events-worker.js', scope)
.then(t.step_func(function(registration) {
......
......@@ -8,7 +8,7 @@ if (window.location.origin != get_host_info().UNAUTHENTICATED_ORIGIN) {
window.location = get_host_info().UNAUTHENTICATED_ORIGIN + window.location.pathname;
} else {
async_test(function() {
var scope = 'resources/registration/';
var scope = '/registration/';
navigator.serviceWorker.register(
'resources/registration-worker.js',
{scope: scope}
......
......@@ -4,7 +4,7 @@
<script src="resources/test-helpers.js"></script>
<script>
async_test(function(t) {
var scope = 'resources/scope/installing-waiting-active-after-registration';
var scope = 'scope/installing-waiting-active-after-registration';
var worker_url = 'resources/empty-worker.js';
var expected_url = normalizeURL(worker_url);
......
......@@ -8,7 +8,7 @@
promise_test(function(t) {
var script = 'resources/registration-worker.js';
var scope = 'resources/registration/';
var scope = '/registration/';
return navigator.serviceWorker.register(script, {scope: scope})
.then(function(registration) {
assert_true(registration instanceof ServiceWorkerRegistration,
......@@ -17,37 +17,6 @@ promise_test(function(t) {
})
}, 'Registering normal pattern');
promise_test(function(t) {
var script = 'resources/registration-worker.js';
var scope = 'resources/';
return navigator.serviceWorker.register(script, {scope: scope})
.then(function(registration) {
assert_true(registration instanceof ServiceWorkerRegistration,
'Successfully registered.');
service_worker_unregister_and_done(t, scope);
})
}, 'Registering same scope as the script directory');
promise_test(function(t) {
var script = 'resources/registration-worker.js';
var scope = 'resources';
return assert_promise_rejects(
navigator.serviceWorker.register(script, {scope: scope}),
'SecurityError',
'Registering same scope as the script directory without the last ' +
'slash should fail with SecurityError.');
}, 'Registering same scope as the script directory without the last slash');
promise_test(function(t) {
var script = 'resources/registration-worker.js';
var scope = 'different-directory/';
return assert_promise_rejects(
navigator.serviceWorker.register(script, {scope: scope}),
'SecurityError',
'Registration scope outside the script directory should fail ' +
'with SecurityError.');
}, 'Registration scope outside the script directory');
promise_test(function(t) {
var script = 'resources/registration-worker.js';
var scope = 'http://example.com/';
......@@ -59,45 +28,40 @@ promise_test(function(t) {
promise_test(function(t) {
var script = 'http://example.com/worker.js';
var scope = 'http://example.com/scope/';
return assert_promise_rejects(
navigator.serviceWorker.register(script, {scope: scope}),
navigator.serviceWorker.register(script),
'SecurityError',
'Registration script outside domain should fail with SecurityError.');
}, 'Registering script outside domain');
promise_test(function(t) {
var script = 'resources/no-such-worker.js';
var scope = 'resources/scope/no-such-worker';
var script = 'no-such-worker.js';
return assert_promise_rejects(
navigator.serviceWorker.register(script, {scope: scope}),
navigator.serviceWorker.register(script),
'NetworkError',
'Registration of non-existent script should fail.');
}, 'Registering non-existent script');
promise_test(function(t) {
var script = 'resources/invalid-chunked-encoding.php';
var scope = 'resources/scope/invalid-chunked-encoding/';
return assert_promise_rejects(
navigator.serviceWorker.register(script, {scope: scope}),
navigator.serviceWorker.register(script),
'NetworkError',
'Registration of invalid chunked encoding script should fail.');
}, 'Registering invalid chunked encoding script');
promise_test(function(t) {
var script = 'resources/invalid-chunked-encoding-with-flush.php';
var scope = 'resources/scope/invalid-chunked-encoding-with-flush/';
return assert_promise_rejects(
navigator.serviceWorker.register(script, {scope: scope}),
navigator.serviceWorker.register(script),
'NetworkError',
'Registration of invalid chunked encoding script should fail.');
}, 'Registering invalid chunked encoding script with flush');
promise_test(function(t) {
var script = 'resources/plain-text-worker.php';
var scope = 'resources/scope/plain-text-worker/';
return assert_promise_rejects(
navigator.serviceWorker.register(script, {scope: scope}),
navigator.serviceWorker.register(script),
'SecurityError',
'Registration of plain text script should fail.');
}, 'Registering script without correct MIME type');
......@@ -105,9 +69,8 @@ promise_test(function(t) {
promise_test(function(t) {
var script = 'resources/redirect.php?Redirect=' +
encodeURIComponent('/resources/registration-worker.js');
var scope = 'resources/sope/redirect/';
return assert_promise_rejects(
navigator.serviceWorker.register(script, {scope: scope}),
navigator.serviceWorker.register(script),
'SecurityError',
'Registration of redirected script should fail.');
}, 'Registering redirected script');
......
......@@ -199,9 +199,9 @@ function wait_for_activated(test, registration) {
};
function service_worker_test(url, description) {
var scope = new URL('./', new URL(url, window.location)) +
'resources/service-worker-scope' +
var scope = window.location.origin + '/service-worker-scope' +
window.location.pathname;
var test = async_test(description);
var registration;
service_worker_unregister_and_register(test, url, scope)
......
......@@ -6,7 +6,7 @@
<script>
function url_test(name, url) {
var scope = 'resources/scope/' + name;
var scope = 'scope/' + name;
async_test(function(t) {
var expectedURL = normalizeURL(url);
service_worker_unregister_and_register(t, url, scope)
......
......@@ -7,7 +7,7 @@
(function () {
var t = async_test('Service Worker state property and "statechange" event');
var currentState = 'test-is-starting';
var scope = 'resources/state/';
var scope = '/state/';
service_worker_unregister_and_register(
t, 'resources/empty-worker.js', scope)
......
......@@ -20,7 +20,7 @@ function fetch_url(url) {
var worker = 'resources/fail-on-fetch-worker.js';
async_test(function(t) {
var scope = 'resources/scope/uncontrolled-page/';
var scope = '/';
service_worker_unregister_and_register(t, worker, scope)
.then(function(reg) { return wait_for_activated(t, reg, scope); })
.then(function() {
......
......@@ -79,7 +79,7 @@ async_test(function(t) {
async_test(function(t) {
var scope =
'resources/scope/no-new-controllee-even-if-registration-is-still-used';
'scope/no-new-controllee-even-if-registration-is-still-used';
var registration;
service_worker_unregister_and_register(t, worker_url, scope)
......
......@@ -6,7 +6,7 @@
var worker_url = 'resources/empty-worker.js';
async_test(function(t) {
var scope = 'resources/scope/register-waits-for-unregistered-registration-to-clear';
var scope = 'scope/register-waits-for-unregistered-registration-to-clear';
var new_worker_url = worker_url + '?new';
var iframe;
var registration;
......@@ -52,7 +52,7 @@ async_test(function(t) {
'registration is cleared');
async_test(function(t) {
var scope = 'resources/scope/unregister-then-register-new-script-that-exists';
var scope = 'scope/unregister-then-register-new-script-that-exists';
var new_worker_url = worker_url + '?new';
var iframe;
var registration;
......@@ -118,7 +118,7 @@ async_test(function(t) {
}, 'Registering a new script URL while an unregistered registration is in use');
async_test(function(t) {
var scope = 'resources/scope/unregister-then-register-new-script-that-404s';
var scope = 'scope/unregister-then-register-new-script-that-404s';
var iframe;
var registration;
......@@ -162,7 +162,7 @@ async_test(function(t) {
'unregistered registration');
async_test(function(t) {
var scope = 'resources/scope/unregister-then-register-reject-install-worker';
var scope = 'scope/unregister-then-register-reject-install-worker';
var iframe;
var registration;
......
......@@ -6,7 +6,7 @@
var worker_url = 'resources/empty-worker.js';
async_test(function(t) {
var scope = 'resources/scope/re-register-resolves-to-new-value';
var scope = 'scope/re-register-resolves-to-new-value';
var iframe;
var registration;
......@@ -33,7 +33,7 @@ async_test(function(t) {
}, 'Unregister then register resolves to a new value');
async_test(function(t) {
var scope = 'resources/scope/re-register-while-old-registration-in-use';
var scope = 'scope/re-register-while-old-registration-in-use';
var registration;
service_worker_unregister_and_register(t, worker_url, scope)
......@@ -63,7 +63,7 @@ async_test(function(t) {
'registration is in use.');
async_test(function(t) {
var scope = 'resources/scope/re-register-does-not-affect-existing-controllee';
var scope = 'scope/re-register-does-not-affect-existing-controllee';
var iframe;
var registration;
var controller;
......@@ -101,7 +101,7 @@ async_test(function(t) {
}, 'Unregister then register does not affect existing controllee');
async_test(function(t) {
var scope = 'resources/scope/resurrection';
var scope = 'scope/resurrection';
var iframe;
var registration;
......
......@@ -4,7 +4,7 @@
<script src="resources/test-helpers.js"></script>
<script>
async_test(function(t) {
var scope = 'resources/scope/unregister-twice';
var scope = 'scope/unregister-twice';
var registration;
navigator.serviceWorker.register('resources/empty-worker.js',
{scope: scope})
......@@ -24,7 +24,7 @@ async_test(function(t) {
}, 'Unregister twice');
async_test(function(t) {
var scope = 'resources/scope/successful-unregister/';
var scope = 'scope/successful-unregister/';
navigator.serviceWorker.register('resources/empty-worker.js',
{scope: scope})
.then(function(registration) {
......
......@@ -135,11 +135,6 @@ ScriptPromise ServiceWorkerContainer::registerServiceWorker(ScriptState* scriptS
return promise;
}
if (!patternURL.string().startsWith(scriptURL.baseAsString())) {
resolver->reject(DOMException::create(SecurityError, "The scope must be under the directory of the script URL."));
return promise;
}
m_provider->registerServiceWorker(patternURL, scriptURL, new CallbackPromiseAdapter<ServiceWorkerRegistration, ServiceWorkerError>(resolver));
return promise;
......
......@@ -228,15 +228,6 @@ TEST_F(ServiceWorkerContainerTest, Register_CrossOriginScopeIsRejected)
ExpectDOMException("SecurityError", "The scope must match the current origin."));
}
TEST_F(ServiceWorkerContainerTest, Register_DifferentDirectoryThanScript)
{
setPageURL("https://www.example.com/");
testRegisterRejected(
"https://www.example.com/js/worker.js",
"https://www.example.com/",
ExpectDOMException("SecurityError", "The scope must be under the directory of the script URL."));
}
TEST_F(ServiceWorkerContainerTest, GetRegistration_NonSecureOriginIsRejected)
{
setPageURL("http://www.example.com/");
......@@ -329,11 +320,11 @@ TEST_F(ServiceWorkerContainerTest, RegisterUnregister_NonHttpsSecureOriginDelega
ScriptState::Scope scriptScope(scriptState());
RegistrationOptions options;
options.setScope("y/");
container->registerServiceWorker(scriptState(), "/x/y/worker.js", options);
container->registerServiceWorker(scriptState(), "/z/worker.js", options);
EXPECT_EQ(1ul, stubProvider.registerCallCount());
EXPECT_EQ(WebURL(KURL(KURL(), "http://localhost/x/y/")), stubProvider.registerScope());
EXPECT_EQ(WebURL(KURL(KURL(), "http://localhost/x/y/worker.js")), stubProvider.registerScriptURL());
EXPECT_EQ(WebURL(KURL(KURL(), "http://localhost/z/worker.js")), stubProvider.registerScriptURL());
}
container->willBeDetachedFromFrame();
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment