requestStorageAccess-cross-site-sibling-iframes.sub.https.window.js (5130B)
1 // META: script=helpers.js 2 // META: script=/cookies/resources/cookie-helper.sub.js 3 // META: script=/resources/testdriver.js 4 // META: script=/resources/testdriver-vendor.js 5 // META: timeout=long 6 'use strict'; 7 8 (async function() { 9 // This is on the www subdomain, so it's cross-origin from the current document. 10 const www = "https://{{domains[www]}}:{{ports[https][0]}}"; 11 // This is on the alt host, so it's cross-site from the current document. 12 const wwwAlt = "https://{{hosts[alt][]}}:{{ports[https][0]}}"; 13 const url_suffix = "/storage-access-api/resources/script-with-cookie-header.py?script=embedded_responder.js"; 14 15 promise_test(async (t) => { 16 await MaybeSetStorageAccess("*", "*", "blocked"); 17 await SetFirstPartyCookie(wwwAlt); 18 const responder_html = `${wwwAlt}${url_suffix}`; 19 const [frame1, frame2] = await Promise.all([ 20 CreateFrame(responder_html), 21 CreateFrame(responder_html), 22 ]); 23 24 t.add_cleanup(async () => { 25 await test_driver.delete_all_cookies(); 26 await SetPermissionInFrame(frame1, [{ name: 'storage-access' }, 'prompt']); 27 await MaybeSetStorageAccess("*", "*", "allowed"); 28 }); 29 30 await SetPermissionInFrame(frame1, [{ name: 'storage-access' }, 'granted']); 31 32 const hasStorageAccess = await FrameHasStorageAccess(frame1); 33 if (hasStorageAccess) { 34 // Nothing to test here, since access is not blocked. 35 // See https://github.com/privacycg/storage-access/issues/162. 36 return; 37 } 38 assert_false(await FrameHasStorageAccess(frame2), "frame2 should not have storage access initially."); 39 40 assert_false(await HasUnpartitionedCookie(frame1), "frame1 should not have cookie access."); 41 assert_false(await HasUnpartitionedCookie(frame2), "frame2 should not have cookie access."); 42 43 assert_true(await RequestStorageAccessInFrame(frame1), "requestStorageAccess doesn't require a gesture since the permission has already been granted."); 44 45 assert_true(await FrameHasStorageAccess(frame1), "frame1 should have storage access now."); 46 assert_true(await HasUnpartitionedCookie(frame1), "frame1 should now have cookie access."); 47 48 assert_false(await FrameHasStorageAccess(frame2), "frame2 should still not have storage access."); 49 assert_false(await HasUnpartitionedCookie(frame2), "frame2 should still have cookie access."); 50 51 assert_true(await RequestStorageAccessInFrame(frame2), "frame2 should be able to get storage access without a gesture."); 52 53 assert_true(await FrameHasStorageAccess(frame2), "frame2 should have storage access after it requested it."); 54 assert_true(await HasUnpartitionedCookie(frame2), "frame2 should have cookie access after getting storage access."); 55 }, "Grants have per-frame scope"); 56 57 promise_test(async (t) => { 58 await MaybeSetStorageAccess("*", "*", "blocked"); 59 const [crossOriginFrame, crossSiteFrame] = await Promise.all([ 60 CreateFrame(`${www}${url_suffix}`), 61 CreateFrame(`${wwwAlt}${url_suffix}`), 62 ]); 63 await SetFirstPartyCookie(www, "initial-cookie=unpartitioned;Secure;SameSite=None;Path=/"); 64 await SetFirstPartyCookie(wwwAlt, "initial-cookie=unpartitioned;Secure;SameSite=None;Path=/"); 65 66 t.add_cleanup(async () => { 67 await test_driver.delete_all_cookies(); 68 await SetPermissionInFrame(crossOriginFrame, [{ name: 'storage-access' }, 'prompt']); 69 await SetPermissionInFrame(crossSiteFrame, [{ name: 'storage-access' }, 'prompt']); 70 await MaybeSetStorageAccess("*", "*", "allowed"); 71 }); 72 73 const hasStorageAccess = await FrameHasStorageAccess(crossSiteFrame); 74 if (hasStorageAccess) { 75 // Nothing to test here, since cross-site access is not blocked. 76 return; 77 } 78 79 await SetPermissionInFrame(crossOriginFrame, [{ name: 'storage-access' }, 'granted']); 80 await SetPermissionInFrame(crossSiteFrame, [{ name: 'storage-access' }, 'granted']); 81 82 assert_true(await RequestStorageAccessInFrame(crossOriginFrame), "crossOriginFrame should be able to get storage access without a gesture."); 83 assert_true(await RequestStorageAccessInFrame(crossSiteFrame), "crossSiteFrame should be able to get storage access without a gesture."); 84 85 await SetDocumentCookieFromFrame(crossOriginFrame, `cookie=monster;Secure;SameSite=None;Path=/`); 86 await SetDocumentCookieFromFrame(crossSiteFrame, `foo=bar;Secure;SameSite=None;Path=/`); 87 88 assert_true(cookieStringHasCookie("cookie", "monster", await FetchSubresourceCookiesFromFrame(crossOriginFrame, www)),"crossOriginFrame making same-origin subresource request can access cookies."); 89 assert_true(cookieStringHasCookie("foo", "bar", await FetchSubresourceCookiesFromFrame(crossSiteFrame, wwwAlt)),"crossSiteFrame making same-origin subresource request can access cookies."); 90 91 assert_false(cookieStringHasCookie("foo", "bar", await FetchSubresourceCookiesFromFrame(crossOriginFrame, wwwAlt)), "crossOriginFrame making cross-site subresource request to sibling iframe's host should not include cookies."); 92 }, "Cross-site sibling iframes should not be able to take advantage of the existing permission grant requested by others."); 93 94 })();