Skip to content

GitLab

T
tangled
Commit d3c852d2 authored by Mike West's avatar Mike West Committed by Commit Bot
Browse files
Options

Deprecate `<meta http-equiv="set-cookie" ...>` 

Intent to Deprecate: https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/0sJ8GUJO0Dw/iMmcXLIGBAAJ

Bug: 767813
Change-Id: I29868952df3e9c8d5cef85fa39c43a85d850b9e9
Reviewed-on: https://chromium-review.googlesource.com/678723
Commit-Queue: Mike West <mkwst@chromium.org>
Reviewed-by: default avatarEric Lawrence <elawrence@chromium.org>
Cr-Commit-Position: refs/heads/master@{#504322}
parent 2fe91802
Show whitespace changes
Inline Side-by-side
Showing with 45 additions and 7 deletions
third_party/WebKit/LayoutTests/http/tests/cookies/meta-expected.txt 0 → 100644
View file @ d3c852d2
CONSOLE WARNING: Setting cookies via `<meta http-equiv='Set-Cookie' ...>` is deprecated, and will stop working in M65, around March 2018. Consider switching to `document.cookie = ...`, or to `Set-Cookie` HTTP headers instead. See https://www.chromestatus.com/feature/6170540112871424 for more details.
CONSOLE ERROR: line 3: Blocked setting the `meta-set-cookie=1` cookie from a `<meta>` tag.
This is a testharness.js-based test.
PASS Cookie is not set from `<meta>`.
Harness: the test ran to completion.
third_party/WebKit/LayoutTests/http/tests/cookies/meta.html 0 → 100644
View file @ d3c852d2
<!DOCTYPE html>
<head>
<meta http-equiv="set-cookie" content="meta-set-cookie=1">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
</head>
<body>
<script>
test(t => {
assert_equals(document.cookie.indexOf('meta-set-cookie'), -1);
}, "Cookie is not set from `<meta>`.");
</script>
</body>
third_party/WebKit/Source/core/frame/Deprecation.cpp
View file @ d3c852d2
...@@ -363,6 +363,16 @@ String Deprecation::DeprecationMessage(WebFeature feature) { ...@@ -363,6 +363,16 @@ String Deprecation::DeprecationMessage(WebFeature feature) {
"https://www.chromestatus.com/feature/5669008342777856 for more " "https://www.chromestatus.com/feature/5669008342777856 for more "
"details."; "details.";
// Blocked `<meta http-equiv="set-cookie" ...>`
case WebFeature::kMetaSetCookie:
return String::Format(
"Setting cookies via `<meta http-equiv='Set-Cookie' ...>` is "
"deprecated, and will stop working in %s. Consider switching "
"to `document.cookie = ...`, or to `Set-Cookie` HTTP headers "
"instead. See %s for more details.",
milestoneString(M65),
"https://www.chromestatus.com/feature/6170540112871424");
// Powerful features on insecure origins (https://goo.gl/rStTGz) // Powerful features on insecure origins (https://goo.gl/rStTGz)
case WebFeature::kDeviceMotionInsecureOrigin: case WebFeature::kDeviceMotionInsecureOrigin:
return "The devicemotion event is deprecated on insecure origins, and " return "The devicemotion event is deprecated on insecure origins, and "
......
third_party/WebKit/Source/core/loader/HttpEquiv.cpp
View file @ d3c852d2
...@@ -7,6 +7,7 @@ ...@@ -7,6 +7,7 @@
#include "core/css/StyleEngine.h" #include "core/css/StyleEngine.h"
#include "core/dom/Document.h" #include "core/dom/Document.h"
#include "core/dom/ScriptableDocumentParser.h" #include "core/dom/ScriptableDocumentParser.h"
#include "core/frame/Deprecation.h"
#include "core/frame/LocalFrame.h" #include "core/frame/LocalFrame.h"
#include "core/frame/UseCounter.h" #include "core/frame/UseCounter.h"
#include "core/frame/csp/ContentSecurityPolicy.h" #include "core/frame/csp/ContentSecurityPolicy.h"
...@@ -120,12 +121,8 @@ void HttpEquiv::ProcessHttpEquivRefresh(Document& document, ...@@ -120,12 +121,8 @@ void HttpEquiv::ProcessHttpEquivRefresh(Document& document,
void HttpEquiv::ProcessHttpEquivSetCookie(Document& document, void HttpEquiv::ProcessHttpEquivSetCookie(Document& document,
const AtomicString& content, const AtomicString& content,
Element* element) { Element* element) {
// FIXME: make setCookie work on XML documents too; e.g. in case of Deprecation::CountDeprecation(document, WebFeature::kMetaSetCookie);
// <html:meta.....>
if (!document.IsHTMLDocument())
return;
UseCounter::Count(document, WebFeature::kMetaSetCookie);
if (!document.GetContentSecurityPolicy()->AllowInlineScript( if (!document.GetContentSecurityPolicy()->AllowInlineScript(
element, NullURL(), "", OrdinalNumber(), "", element, NullURL(), "", OrdinalNumber(), "",
ContentSecurityPolicy::InlineType::kBlock, ContentSecurityPolicy::InlineType::kBlock,
...@@ -134,8 +131,16 @@ void HttpEquiv::ProcessHttpEquivSetCookie(Document& document, ...@@ -134,8 +131,16 @@ void HttpEquiv::ProcessHttpEquivSetCookie(Document& document,
WebFeature::kMetaSetCookieWhenCSPBlocksInlineScript); WebFeature::kMetaSetCookieWhenCSPBlocksInlineScript);
} }
if (!RuntimeEnabledFeatures::BlockMetaSetCookieEnabled()) {
// Exception (for sandboxed documents) ignored. // Exception (for sandboxed documents) ignored.
document.setCookie(content, IGNORE_EXCEPTION_FOR_TESTING); document.setCookie(content, IGNORE_EXCEPTION_FOR_TESTING);
return;
}
document.AddConsoleMessage(ConsoleMessage::Create(
kSecurityMessageSource, kErrorMessageLevel,
String::Format("Blocked setting the `%s` cookie from a `<meta>` tag.",
content.Utf8().data())));
} }
} // namespace blink } // namespace blink
third_party/WebKit/Source/platform/runtime_enabled_features.json5
View file @ d3c852d2
...@@ -117,6 +117,10 @@ ...@@ -117,6 +117,10 @@
name: "BlockCredentialedSubresources", name: "BlockCredentialedSubresources",
status: "stable", status: "stable",
}, },
{
name: "BlockMetaSetCookie",
status: "experimental"
},
{ {
name: "Budget", name: "Budget",
status: "stable", status: "stable",
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment