forked from web-platform-tests/wpt
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Reject Web Bluetooth requests with an opaque origin
The Web Bluetooth API tracks permissions using the origin of the top-level document in the frame tree. If this document has an opaque origin then there is no way to format the origin for display to the user in permission prompts or to write their decision in the preferences file. Access to the Web Bluetooth API from such contexts should therefore be blocked. Bug: 1375133 Change-Id: Idf737c1806eac4342e0fe716e2561e51aa127f53 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4113162 Reviewed-by: Reilly Grant <[email protected]> Commit-Queue: Sina Firoozabadi <[email protected]> Cr-Commit-Position: refs/heads/main@{#1089042}
- Loading branch information
1 parent
21ae69f
commit 61e57be
Showing
15 changed files
with
195 additions
and
8 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
<!DOCTYPE html> | ||
|
||
<script src="/resources/testharness.js"></script> | ||
<script src="/resources/testharnessreport.js"></script> | ||
<script> | ||
'use strict'; | ||
|
||
promise_test(async (t) => { | ||
await promise_rejects_dom( | ||
t, 'SecurityError', navigator.bluetooth.getAvailability(), | ||
'getAvailability() should throw a SecurityError DOMException when called from a context where the top-level document has an opaque origin.'); | ||
}, 'Calls to Bluetooth APIs from an origin with opaque top origin get blocked.'); | ||
</script> |
1 change: 1 addition & 0 deletions
1
bluetooth/getAvailability/reject_opaque_origin.https.html.headers
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
Content-Security-Policy: sandbox allow-scripts |
27 changes: 27 additions & 0 deletions
27
bluetooth/getAvailability/sandboxed_iframe.https.window.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,27 @@ | ||
// META: script=/resources/testdriver.js | ||
// META: script=/resources/testdriver-vendor.js | ||
// META: script=/bluetooth/resources/bluetooth-test.js | ||
// META: script=/bluetooth/resources/bluetooth-fake-devices.js | ||
|
||
'use strict'; | ||
|
||
let iframe = document.createElement('iframe'); | ||
|
||
bluetooth_test(async () => { | ||
await getConnectedHealthThermometerDevice(); | ||
await new Promise(resolve => { | ||
iframe.src = '/bluetooth/resources/health-thermometer-iframe.html'; | ||
iframe.sandbox.add('allow-scripts'); | ||
iframe.allow = 'bluetooth'; | ||
document.body.appendChild(iframe); | ||
iframe.addEventListener('load', resolve); | ||
}); | ||
await new Promise(resolve => { | ||
iframe.contentWindow.postMessage({type: 'GetAvailability'}, '*'); | ||
|
||
window.addEventListener('message', (messageEvent) => { | ||
assert_false(/^FAIL: .*/.test(messageEvent.data)); | ||
resolve(); | ||
}); | ||
}); | ||
}, 'Calls to Bluetooth APIs from a sandboxed iframe are valid.'); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
<!DOCTYPE html> | ||
|
||
<script src="/resources/testharness.js"></script> | ||
<script src="/resources/testharnessreport.js"></script> | ||
<script> | ||
'use strict'; | ||
|
||
promise_test(async (t) => { | ||
await promise_rejects_dom( | ||
t, 'SecurityError', navigator.bluetooth.getDevices(), | ||
'getDevices() should throw a SecurityError DOMException when called from a context where the top-level document has an opaque origin.'); | ||
}, 'Calls to Bluetooth APIs from an origin with opaque top origin get blocked.'); | ||
</script> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
Content-Security-Policy: sandbox allow-scripts |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,27 @@ | ||
// META: script=/resources/testdriver.js | ||
// META: script=/resources/testdriver-vendor.js | ||
// META: script=/bluetooth/resources/bluetooth-test.js | ||
// META: script=/bluetooth/resources/bluetooth-fake-devices.js | ||
|
||
'use strict'; | ||
|
||
let iframe = document.createElement('iframe'); | ||
|
||
bluetooth_test(async () => { | ||
await getConnectedHealthThermometerDevice(); | ||
await new Promise(resolve => { | ||
iframe.src = '/bluetooth/resources/health-thermometer-iframe.html'; | ||
iframe.sandbox.add('allow-scripts'); | ||
iframe.allow = 'bluetooth'; | ||
document.body.appendChild(iframe); | ||
iframe.addEventListener('load', resolve); | ||
}); | ||
await new Promise(resolve => { | ||
iframe.contentWindow.postMessage({type: 'GetDevices'}, '*'); | ||
|
||
window.addEventListener('message', (messageEvent) => { | ||
assert_false(/^FAIL: .*/.test(messageEvent.data)); | ||
resolve(); | ||
}); | ||
}); | ||
}, 'Calls to Bluetooth APIs from a sandboxed iframe are valid.'); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
<!DOCTYPE html> | ||
|
||
<script src="/resources/testharness.js"></script> | ||
<script src="/resources/testharnessreport.js"></script> | ||
<script> | ||
'use strict'; | ||
|
||
promise_test(async (t) => { | ||
await promise_rejects_dom( | ||
t, 'SecurityError', navigator.bluetooth.requestDevice(), | ||
'requestDevice() should throw a SecurityError DOMException when called from a context where the top-level document has an opaque origin.'); | ||
}, 'Calls to Bluetooth APIs from an origin with opaque top origin get blocked.'); | ||
</script> |
1 change: 1 addition & 0 deletions
1
bluetooth/requestDevice/reject_opaque_origin.https.html.headers
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
Content-Security-Policy: sandbox allow-scripts |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,27 @@ | ||
// META: script=/resources/testdriver.js | ||
// META: script=/resources/testdriver-vendor.js | ||
// META: script=/bluetooth/resources/bluetooth-test.js | ||
// META: script=/bluetooth/resources/bluetooth-fake-devices.js | ||
|
||
'use strict'; | ||
|
||
let iframe = document.createElement('iframe'); | ||
|
||
bluetooth_test(async () => { | ||
await getConnectedHealthThermometerDevice(); | ||
await new Promise(resolve => { | ||
iframe.src = '/bluetooth/resources/health-thermometer-iframe.html'; | ||
iframe.sandbox.add('allow-scripts'); | ||
iframe.allow = 'bluetooth'; | ||
document.body.appendChild(iframe); | ||
iframe.addEventListener('load', resolve); | ||
}); | ||
await new Promise(resolve => { | ||
iframe.contentWindow.postMessage({type: 'RequestDevice'}, '*'); | ||
|
||
window.addEventListener('message', (messageEvent) => { | ||
assert_false(/^FAIL: .*/.test(messageEvent.data)); | ||
resolve(); | ||
}); | ||
}); | ||
}, 'Calls to Bluetooth APIs from a sandboxed iframe are valid.'); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
<!DOCTYPE html> | ||
|
||
<script src="/resources/testharness.js"></script> | ||
<script src="/resources/testharnessreport.js"></script> | ||
<script> | ||
'use strict'; | ||
|
||
promise_test(async (t) => { | ||
await promise_rejects_dom( | ||
t, 'SecurityError', navigator.bluetooth.requestLEScan(), | ||
'requestLEScan() should throw a SecurityError DOMException when called from a context where the top-level document has an opaque origin.'); | ||
}, 'Calls to Bluetooth APIs from an origin with opaque top origin get blocked.'); | ||
</script> |
1 change: 1 addition & 0 deletions
1
bluetooth/requestLEScan/reject_opaque_origin.https.html.headers
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1 @@ | ||
Content-Security-Policy: sandbox allow-scripts |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,27 @@ | ||
// META: script=/resources/testdriver.js | ||
// META: script=/resources/testdriver-vendor.js | ||
// META: script=/bluetooth/resources/bluetooth-test.js | ||
// META: script=/bluetooth/resources/bluetooth-fake-devices.js | ||
|
||
'use strict'; | ||
|
||
let iframe = document.createElement('iframe'); | ||
|
||
bluetooth_test(async () => { | ||
await getConnectedHealthThermometerDevice(); | ||
await new Promise(resolve => { | ||
iframe.src = '/bluetooth/resources/health-thermometer-iframe.html'; | ||
iframe.sandbox.add('allow-scripts'); | ||
iframe.allow = 'bluetooth'; | ||
document.body.appendChild(iframe); | ||
iframe.addEventListener('load', resolve); | ||
}); | ||
await new Promise(resolve => { | ||
iframe.contentWindow.postMessage({type: 'RequestLEScan'}, '*'); | ||
|
||
window.addEventListener('message', (messageEvent) => { | ||
assert_false(/^FAIL: .*/.test(messageEvent.data)); | ||
resolve(); | ||
}); | ||
}); | ||
}, 'Calls to Bluetooth APIs from a sandboxed iframe are valid.'); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters