[ServiceWorker] Don't allow registration of the ServiceWorker scope outside the script directory.

As per discussion on https://github.com/slightlyoff/ServiceWorker/issues/468 BUG=423983 Review URL: https://codereview.chromium.org/672383003 git-svn-id: svn://svn.chromium.org/blink/trunk@184336 bbb929c8-8fbe-4397-9dbb-9b2b20218538

[ServiceWorker] Don't allow registration of the ServiceWorker scope outside the script directory.
As per discussion on https://github.com/slightlyoff/ServiceWorker/issues/468 BUG=423983 Review URL: https://codereview.chromium.org/672383003 git-svn-id: svn://svn.chromium.org/blink/trunk@184336 bbb929c8-8fbe-4397-9dbb-9b2b20218538
cbc2feb2 · horo@chromium.org · 2aa17122 · cbc2feb2 · cbc2feb2 · cbc2feb2
Commit cbc2feb2 authored Oct 24, 2014 by horo@chromium.org
27 changed files
--- a/third_party/WebKit/LayoutTests/http/tests/geofencing/apis_not_implemented.html
+++ b/third_party/WebKit/LayoutTests/http/tests/geofencing/apis_not_implemented.html
@@ -6,7 +6,7 @@
 <script src="../serviceworker/resources/test-helpers.js"></script>
 <script>
 var sw_url = 'resources/emptyworker.js';
-var sw_scope = '/service-worker-scope' + window.location.pathname;
+var sw_scope = 'resources/service-worker-scope' + window.location.pathname;
 promise_test(function(test) {
    return assert_promise_rejects(

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/ServiceWorkerGlobalScope/scope-absolute-url.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/ServiceWorkerGlobalScope/scope-absolute-url.html
@@ -6,6 +6,8 @@
 <script src="resources/scope.js"></script>
 <script>
 async_test(function(t) {
-    scope_test(t, 'resources/scope-worker.js', get_host_info().HTTP_ORIGIN);
+    scope_test(
+        t, 'resources/scope-worker.js',
+        get_host_info().HTTP_ORIGIN + base_path() + 'resources/absolute_url/');
  }, 'Verify the scope property: absolute url');
 </script>
--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/ServiceWorkerGlobalScope/scope-default.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/ServiceWorkerGlobalScope/scope-default.html
 <!DOCTYPE html>
 <title>ServiceWorkerGlobalScope: scope property is default value</title>
 <script src="../../resources/testharness.js"></script>
+<script src="../../resources/testharness-helpers.js"></script>
 <script src="../../resources/testharnessreport.js"></script>
 <script src="../resources/test-helpers.js"></script>
 <script src="resources/scope.js"></script>
 <script>
-async_test(function(t) {
-    scope_test(t, 'resources/scope-worker.js');
+promise_test(function(t) {
-  }, 'Verify the scope property: default scope');
+    return assert_promise_rejects(
+        navigator.serviceWorker.register('resources/scope-worker.js'),
+        'SecurityError',
+        'Registering a script not in the root directory for the default scope' +
+            'should fail with SecurityError.');
+  }, 'Register a script not in the root directory for the default scope.');
 </script>
--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/ServiceWorkerGlobalScope/scope-relative-path.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/ServiceWorkerGlobalScope/scope-relative-path.html
@@ -6,6 +6,7 @@
 <script src="resources/scope.js"></script>
 <script>
 async_test(function(t) {
-    scope_test(t, 'resources/scope-worker.js', '/a/b/c/');
+    scope_test(t, 'resources/scope-worker.js',
+               base_path() + 'resources/relative_path/');
  }, 'Verify the scope property: relative path');
 </script>
--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/chromium/force-refresh-registration.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/chromium/force-refresh-registration.html
@@ -7,7 +7,7 @@
 <script>
 async_test(function(t) {
-    var scope = '/force-refresh-register';
+    var scope = base_path() + '../resources/force-refresh-register';
    with_iframe('../resources/blank.html')
      .then(t.step_func(function(frame) {
          var p = new Promise(function(resolve) {

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/chromium/registration-stress.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/chromium/registration-stress.html
@@ -15,7 +15,7 @@ async_test(function(t) {
    var register_promises = [];
    for (var i = 0; i < number_of_registrations; i++) {
-      var scope = i;
+      var scope = base_path() + '../resources/registration-stress' + i;
      register_promises.push(with_iframe(scope)
        .then(step(function(f) {
            frames.push(f);

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/chromium/service-worker-gc.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/chromium/service-worker-gc.html
 <!DOCTYPE html>
 <script src="/js-test-resources/js-test.js"></script>
+<script src="../resources/test-helpers.js"></script>
 <script>
 window.jsTestIsAsync = true;
 description('Test that ServiceWorker and ServiceWorkerRegistration are not garbage collected prematurely');
 var registrationObservation = null;
 var swObservation = null;
-var scope = 'gc';
+var scope = base_path() + '../resources/gc';
 if (!window.internals) {
    testFailed('This test requires internals.observeGC');

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/extendable-event-waituntil.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/extendable-event-waituntil.html
@@ -33,7 +33,7 @@ function syncWorker(test, worker, obj) {
 async_test(function(t) {
    // Passing scope as the test switch for worker script.
-    var scope = 'install-fulfilled';
+    var scope = 'resources/install-fulfilled';
    var onRegister = function(worker) {
        var obj = {};
        wait_for_state(t, worker, 'installed')
@@ -51,7 +51,7 @@ async_test(function(t) {
  }, 'Test install event waitUntil fulfilled', properties);
 async_test(function(t) {
-    var scope = 'activate-fulfilled';
+    var scope = 'resources/activate-fulfilled';
    var onRegister = function(worker) {
        var obj = {};
        wait_for_state(t, worker, 'activating')
@@ -72,7 +72,7 @@ async_test(function(t) {
  }, 'Test activate event waitUntil fulfilled', properties);
 async_test(function(t) {
-    var scope = 'install-rejected';
+    var scope = 'resources/install-rejected';
    var onRegister = function(worker) {
        wait_for_state(t, worker, 'redundant')
          .then(function() {
@@ -84,7 +84,7 @@ async_test(function(t) {
  }, 'Test install event waitUntil rejected', properties);
 async_test(function(t) {
-    var scope = 'activate-rejected';
+    var scope = 'resources/activate-rejected';
    var onRegister = function(worker) {
        wait_for_state(t, worker, 'redundant')
          .then(function() {
@@ -96,7 +96,7 @@ async_test(function(t) {
  }, 'Test activate event waitUntil rejected.', properties);
 async_test(function(t) {
-    var scope = 'activate-multiple-fulfilled';
+    var scope = 'resources/activate-multiple-fulfilled';
    var onRegister = function(worker) {
        var obj1 = {};
        var obj2 = {};
@@ -119,7 +119,7 @@ async_test(function(t) {
  }, 'Test ExtendableEvent multiple waitUntil fulfilled.', properties);
 async_test(function(t) {
-    var scope = 'activate-reject-precedence';
+    var scope = 'resources/activate-reject-precedence';
    var onRegister = function(worker) {
        wait_for_state(t, worker, 'redundant')
          .then(function() {

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/getregistration.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/getregistration.html
@@ -15,7 +15,7 @@ async_test(function(t) {
  }, 'getRegistration');
 async_test(function(t) {
-    var scope = 'scope/worker/';
+    var scope = 'resources/scope/worker/';
    var registration;
    service_worker_unregister_and_register(t, 'resources/empty-worker.js',
                                           scope)
@@ -47,7 +47,7 @@ async_test(function(t) {
  }, 'getRegistration with a cross origin URL');
 async_test(function(t) {
-    var scope = 'scope/worker/';
+    var scope = 'resources/scope/worker/';
    service_worker_unregister_and_register(t, 'resources/empty-worker.js',
                                           scope)
      .then(function(registration) {

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/interfaces.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/interfaces.html
@@ -17,7 +17,7 @@ test(function() {
 async_test(function(t) {
    var EVENT_HANDLER = 'object';
-    var scope = 'scope/interfaces-and-attributes';
+    var scope = 'resources/scope/interfaces-and-attributes';
    var registration;
    service_worker_unregister_and_register(

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/multiple-register.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/multiple-register.html
@@ -6,7 +6,7 @@
 var worker_url = 'resources/empty-worker.js';
 async_test(function(t) {
-  var scope = 'scope/subsequent-register-from-same-window';
+  var scope = 'resources/scope/subsequent-register-from-same-window';
  var registration;
  service_worker_unregister_and_register(t, worker_url, scope)
@@ -31,7 +31,7 @@ async_test(function(t) {
 }, 'Subsequent registrations resolve to the same registration object');
 async_test(function(t) {
-  var scope = 'scope/subsequent-register-from-different-iframe';
+  var scope = 'resources/scope/subsequent-register-from-different-iframe';
  var frame;
  var registration;
@@ -89,7 +89,7 @@ async_test(function(t) {
       'registration and workers');
 async_test(function(t) {
-  var scope = 'scope/concurrent-register';
+  var scope = 'resources/scope/concurrent-register';
  service_worker_unregister(t, scope)
    .then(function() {

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/register-same-scope-different-script-url.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/register-same-scope-different-script-url.html
@@ -8,7 +8,7 @@ var script2 = normalizeURL('resources/empty-worker.js?new');
 // FIXME: The spec is in flux, this test's asserts may not be as per-spec.
 async_test(function(t) {
-    var scope = 'scope/register-new-script-concurrently';
+    var scope = 'resources/scope/register-new-script-concurrently';
    var registration;
    var register_promise1;
    var register_promise2;
@@ -54,7 +54,7 @@ async_test(function(t) {
  }, 'Register different scripts concurrently');
 async_test(function(t) {
-    var scope = 'scope/register-then-register-new-script';
+    var scope = 'resources/scope/register-then-register-new-script';
    var registration;
    service_worker_unregister_and_register(t, script1, scope)
@@ -104,7 +104,7 @@ async_test(function(t) {
  }, 'Register then register new script URL');
 async_test(function(t) {
-    var scope = 'scope/register-then-register-new-script-404';
+    var scope = 'resources/scope/register-then-register-new-script-404';
    var registration;
    service_worker_unregister_and_register(t, script1, scope)
@@ -143,7 +143,7 @@ async_test(function(t) {
  }, 'Register then register new script URL that 404s');
 async_test(function(t) {
-    var scope = 'scope/register-then-register-new-script-reject-install';
+    var scope = 'resources/scope/register-then-register-new-script-reject-install';
    var reject_script = normalizeURL('resources/reject-install-worker.js');
    var registration;
@@ -194,7 +194,7 @@ async_test(function(t) {
  }, 'Register then register new script that does not install');
 async_test(function(t) {
-    var scope = 'scope/register-new-script-controller';
+    var scope = 'resources/scope/register-new-script-controller';
    var iframe;
    var registration;

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/registration-end-to-end.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/registration-end-to-end.html
@@ -7,7 +7,7 @@
 var t = async_test('Registration: end-to-end');
 t.step(function() {
-    var scope = '/in-scope/';
+    var scope = 'resources/in-scope/';
    var serviceWorkerStates = [];
    var lastServiceWorkerState = '';
    var receivedMessageFromPort = '';

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/registration-events.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/registration-events.html
@@ -6,7 +6,7 @@
 <script>
 var t = async_test('Registration: events');
 t.step(function() {
-    var scope = '/in-scope/';
+    var scope = 'resources/in-scope/';
    service_worker_unregister_and_register(
        t, 'resources/events-worker.js', scope)
      .then(t.step_func(function(registration) {

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/registration-on-insecure-origin.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/registration-on-insecure-origin.html
@@ -8,7 +8,7 @@ if (window.location.origin != get_host_info().UNAUTHENTICATED_ORIGIN) {
    window.location = get_host_info().UNAUTHENTICATED_ORIGIN + window.location.pathname;
 } else {
    async_test(function() {
-        var scope = '/registration/';
+        var scope = 'resources/registration/';
        navigator.serviceWorker.register(
            'resources/registration-worker.js',
            {scope: scope}

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/registration-service-worker-attributes.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/registration-service-worker-attributes.html
@@ -4,7 +4,7 @@
 <script src="resources/test-helpers.js"></script>
 <script>
 async_test(function(t) {
-    var scope = 'scope/installing-waiting-active-after-registration';
+    var scope = 'resources/scope/installing-waiting-active-after-registration';
    var worker_url = 'resources/empty-worker.js';
    var expected_url = normalizeURL(worker_url);

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/registration.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/registration.html
@@ -8,7 +8,7 @@
 promise_test(function(t) {
    var script = 'resources/registration-worker.js';
-    var scope = '/registration/';
+    var scope = 'resources/registration/';
    return navigator.serviceWorker.register(script, {scope: scope})
      .then(function(registration) {
          assert_true(registration instanceof ServiceWorkerRegistration,
@@ -17,6 +17,37 @@ promise_test(function(t) {
        })
  }, 'Registering normal pattern');
+promise_test(function(t) {
+    var script = 'resources/registration-worker.js';
+    var scope = 'resources/';
+    return navigator.serviceWorker.register(script, {scope: scope})
+      .then(function(registration) {
+          assert_true(registration instanceof ServiceWorkerRegistration,
+                      'Successfully registered.');
+          service_worker_unregister_and_done(t, scope);
+        })
+  }, 'Registering same scope as the script directory');
+promise_test(function(t) {
+    var script = 'resources/registration-worker.js';
+    var scope = 'resources';
+    return assert_promise_rejects(
+        navigator.serviceWorker.register(script, {scope: scope}),
+        'SecurityError',
+        'Registering same scope as the script directory without the last ' +
+            'slash should fail with SecurityError.');
+  }, 'Registering same scope as the script directory without the last slash');
+promise_test(function(t) {
+    var script = 'resources/registration-worker.js';
+    var scope = 'different-directory/';
+    return assert_promise_rejects(
+        navigator.serviceWorker.register(script, {scope: scope}),
+        'SecurityError',
+        'Registration scope outside the script directory should fail ' +
+            'with SecurityError.');
+  }, 'Registration scope outside the script directory');
 promise_test(function(t) {
    var script = 'resources/registration-worker.js';
    var scope = 'http://example.com/';
@@ -28,40 +59,45 @@ promise_test(function(t) {
 promise_test(function(t) {
    var script = 'http://example.com/worker.js';
+    var scope = 'http://example.com/scope/';
    return assert_promise_rejects(
-        navigator.serviceWorker.register(script),
+        navigator.serviceWorker.register(script, {scope: scope}),
        'SecurityError',
        'Registration script outside domain should fail with SecurityError.');
  }, 'Registering script outside domain');
 promise_test(function(t) {
-    var script = 'no-such-worker.js';
+    var script = 'resources/no-such-worker.js';
+    var scope = 'resources/scope/no-such-worker';
    return assert_promise_rejects(
-        navigator.serviceWorker.register(script),
+        navigator.serviceWorker.register(script, {scope: scope}),
        'NetworkError',
        'Registration of non-existent script should fail.');
  }, 'Registering non-existent script');
 promise_test(function(t) {
    var script = 'resources/invalid-chunked-encoding.php';
+    var scope = 'resources/scope/invalid-chunked-encoding/';
    return assert_promise_rejects(
-        navigator.serviceWorker.register(script),
+        navigator.serviceWorker.register(script, {scope: scope}),
        'NetworkError',
        'Registration of invalid chunked encoding script should fail.');
  }, 'Registering invalid chunked encoding script');
 promise_test(function(t) {
    var script = 'resources/invalid-chunked-encoding-with-flush.php';
+    var scope = 'resources/scope/invalid-chunked-encoding-with-flush/';
    return assert_promise_rejects(
-        navigator.serviceWorker.register(script),
+        navigator.serviceWorker.register(script, {scope: scope}),
        'NetworkError',
        'Registration of invalid chunked encoding script should fail.');
  }, 'Registering invalid chunked encoding script with flush');
 promise_test(function(t) {
    var script = 'resources/plain-text-worker.php';
+    var scope = 'resources/scope/plain-text-worker/';
    return assert_promise_rejects(
-        navigator.serviceWorker.register(script),
+        navigator.serviceWorker.register(script, {scope: scope}),
        'SecurityError',
        'Registration of plain text script should fail.');
  }, 'Registering script without correct MIME type');
@@ -69,8 +105,9 @@ promise_test(function(t) {
 promise_test(function(t) {
    var script = 'resources/redirect.php?Redirect=' +
                  encodeURIComponent('/resources/registration-worker.js');
+    var scope = 'resources/sope/redirect/';
    return assert_promise_rejects(
-        navigator.serviceWorker.register(script),
+        navigator.serviceWorker.register(script, {scope: scope}),
        'SecurityError',
        'Registration of redirected script should fail.');
  }, 'Registering redirected script');

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/resources/test-helpers.js
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/resources/test-helpers.js
@@ -199,9 +199,9 @@ function wait_for_activated(test, registration) {
  };
  function service_worker_test(url, description) {
-    var scope = window.location.origin + '/service-worker-scope' +
+    var scope = new URL('./', new URL(url, window.location)) +
+      'resources/service-worker-scope' +
      window.location.pathname;
    var test = async_test(description);
    var registration;
    service_worker_unregister_and_register(test, url, scope)

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/serviceworkerobject-scripturl.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/serviceworkerobject-scripturl.html
@@ -6,7 +6,7 @@
 <script>
 function url_test(name, url) {
-  var scope = 'scope/' + name;
+  var scope = 'resources/scope/' + name;
  async_test(function(t) {
    var expectedURL = normalizeURL(url);
    service_worker_unregister_and_register(t, url, scope)

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/state.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/state.html
@@ -7,7 +7,7 @@
 (function () {
    var t = async_test('Service Worker state property and "statechange" event');
    var currentState = 'test-is-starting';
-    var scope = '/state/';
+    var scope = 'resources/state/';
    service_worker_unregister_and_register(
        t, 'resources/empty-worker.js', scope)

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/uncontrolled-page.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/uncontrolled-page.html
@@ -20,7 +20,7 @@ function fetch_url(url) {
 var worker = 'resources/fail-on-fetch-worker.js';
 async_test(function(t) {
-    var scope = '/';
+    var scope = 'resources/scope/uncontrolled-page/';
    service_worker_unregister_and_register(t, worker, scope)
      .then(function(reg) { return wait_for_activated(t, reg, scope); })
      .then(function() {

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/unregister-controller.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/unregister-controller.html
@@ -79,7 +79,7 @@ async_test(function(t) {
 async_test(function(t) {
    var scope =
-        'scope/no-new-controllee-even-if-registration-is-still-used';
+        'resources/scope/no-new-controllee-even-if-registration-is-still-used';
    var registration;
    service_worker_unregister_and_register(t, worker_url, scope)

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/unregister-then-register-new-script.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/unregister-then-register-new-script.html
@@ -6,7 +6,7 @@
 var worker_url = 'resources/empty-worker.js';
 async_test(function(t) {
-    var scope = 'scope/register-waits-for-unregistered-registration-to-clear';
+    var scope = 'resources/scope/register-waits-for-unregistered-registration-to-clear';
    var new_worker_url = worker_url + '?new';
    var iframe;
    var registration;
@@ -52,7 +52,7 @@ async_test(function(t) {
     'registration is cleared');
 async_test(function(t) {
-    var scope = 'scope/unregister-then-register-new-script-that-exists';
+    var scope = 'resources/scope/unregister-then-register-new-script-that-exists';
    var new_worker_url = worker_url + '?new';
    var iframe;
    var registration;
@@ -118,7 +118,7 @@ async_test(function(t) {
 }, 'Registering a new script URL while an unregistered registration is in use');
 async_test(function(t) {
-    var scope = 'scope/unregister-then-register-new-script-that-404s';
+    var scope = 'resources/scope/unregister-then-register-new-script-that-404s';
    var iframe;
    var registration;
@@ -162,7 +162,7 @@ async_test(function(t) {
       'unregistered registration');
 async_test(function(t) {
-    var scope = 'scope/unregister-then-register-reject-install-worker';
+    var scope = 'resources/scope/unregister-then-register-reject-install-worker';
    var iframe;
    var registration;

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/unregister-then-register.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/unregister-then-register.html
@@ -6,7 +6,7 @@
 var worker_url = 'resources/empty-worker.js';
 async_test(function(t) {
-    var scope = 'scope/re-register-resolves-to-new-value';
+    var scope = 'resources/scope/re-register-resolves-to-new-value';
    var iframe;
    var registration;
@@ -33,7 +33,7 @@ async_test(function(t) {
  }, 'Unregister then register resolves to a new value');
 async_test(function(t) {
-    var scope = 'scope/re-register-while-old-registration-in-use';
+    var scope = 'resources/scope/re-register-while-old-registration-in-use';
    var registration;
    service_worker_unregister_and_register(t, worker_url, scope)
@@ -63,7 +63,7 @@ async_test(function(t) {
         'registration is in use.');
 async_test(function(t) {
-    var scope = 'scope/re-register-does-not-affect-existing-controllee';
+    var scope = 'resources/scope/re-register-does-not-affect-existing-controllee';
    var iframe;
    var registration;
    var controller;
@@ -101,7 +101,7 @@ async_test(function(t) {
  }, 'Unregister then register does not affect existing controllee');
 async_test(function(t) {
-    var scope = 'scope/resurrection';
+    var scope = 'resources/scope/resurrection';
    var iframe;
    var registration;

--- a/third_party/WebKit/LayoutTests/http/tests/serviceworker/unregister.html
+++ b/third_party/WebKit/LayoutTests/http/tests/serviceworker/unregister.html
@@ -4,7 +4,7 @@
 <script src="resources/test-helpers.js"></script>
 <script>
 async_test(function(t) {
-    var scope = 'scope/unregister-twice';
+    var scope = 'resources/scope/unregister-twice';
    var registration;
    navigator.serviceWorker.register('resources/empty-worker.js',
                                     {scope: scope})
@@ -24,7 +24,7 @@ async_test(function(t) {
  }, 'Unregister twice');
 async_test(function(t) {
-    var scope = 'scope/successful-unregister/';
+    var scope = 'resources/scope/successful-unregister/';
    navigator.serviceWorker.register('resources/empty-worker.js',
                                     {scope: scope})
      .then(function(registration) {

--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainer.cpp
@@ -135,6 +135,11 @@ ScriptPromise ServiceWorkerContainer::registerServiceWorker(ScriptState* scriptS
        return promise;
    }
+    if (!patternURL.string().startsWith(scriptURL.baseAsString())) {
+        resolver->reject(DOMException::create(SecurityError, "The scope must be under the directory of the script URL."));
+        return promise;
+    }
    m_provider->registerServiceWorker(patternURL, scriptURL, new CallbackPromiseAdapter<ServiceWorkerRegistration, ServiceWorkerError>(resolver));
    return promise;

--- a/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainerTest.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ServiceWorkerContainerTest.cpp
@@ -228,6 +228,15 @@ TEST_F(ServiceWorkerContainerTest, Register_CrossOriginScopeIsRejected)
        ExpectDOMException("SecurityError", "The scope must match the current origin."));
 }
+TEST_F(ServiceWorkerContainerTest, Register_DifferentDirectoryThanScript)
+{
+    setPageURL("https://www.example.com/");
+    testRegisterRejected(
+        "https://www.example.com/js/worker.js",
+        "https://www.example.com/",
+        ExpectDOMException("SecurityError", "The scope must be under the directory of the script URL."));
+}
 TEST_F(ServiceWorkerContainerTest, GetRegistration_NonSecureOriginIsRejected)
 {
    setPageURL("http://www.example.com/");
@@ -320,11 +329,11 @@ TEST_F(ServiceWorkerContainerTest, RegisterUnregister_NonHttpsSecureOriginDelega
        ScriptState::Scope scriptScope(scriptState());
        RegistrationOptions options;
        options.setScope("y/");
-        container->registerServiceWorker(scriptState(), "/z/worker.js", options);
+        container->registerServiceWorker(scriptState(), "/x/y/worker.js", options);
        EXPECT_EQ(1ul, stubProvider.registerCallCount());
        EXPECT_EQ(WebURL(KURL(KURL(), "http://localhost/x/y/")), stubProvider.registerScope());
-        EXPECT_EQ(WebURL(KURL(KURL(), "http://localhost/z/worker.js")), stubProvider.registerScriptURL());
+        EXPECT_EQ(WebURL(KURL(KURL(), "http://localhost/x/y/worker.js")), stubProvider.registerScriptURL());
    }
    container->willBeDetachedFromFrame();