Skip to content

Commit 33a575c

Browse files
Remove broken NoCorsSubresourceCookiesFromFrame helper (#50613)
If a request's mode is no-cors, then the response is opaque to JavaScript. This helper relies on reading the response via the `Response.text()` method, so it can't return anything except the empty string. Change-Id: I77828ab229d3175f607a4ed62a9e4895fc9f7185 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6243093 Commit-Queue: Dylan Cutler <[email protected]> Auto-Submit: Chris Fredrickson <[email protected]> Reviewed-by: Dylan Cutler <[email protected]> Cr-Commit-Position: refs/heads/main@{#1418242} Co-authored-by: Chris Fredrickson <[email protected]>
1 parent b8263dc commit 33a575c

File tree

3 files changed

+8
-13
lines changed

3 files changed

+8
-13
lines changed

storage-access-api/helpers.js

+3-10
Original file line numberDiff line numberDiff line change
@@ -277,21 +277,14 @@ function FetchFromFrame(frame, url) {
277277
{ command: "cors fetch", url }, frame.contentWindow);
278278
}
279279

280-
// Makes a subresource request to the provided host in the given frame with
281-
// the mode set to 'no-cors'
280+
// Makes a subresource request to the provided host in the given frame with the
281+
// mode set to 'no-cors'. Returns a promise that resolves with undefined, since
282+
// no-cors responses are opaque to JavaScript.
282283
function NoCorsFetchFromFrame(frame, url) {
283284
return PostMessageAndAwaitReply(
284285
{ command: "no-cors fetch", url }, frame.contentWindow);
285286
}
286287

287-
// Makes a subresource request to the provided host in the given frame with
288-
// the mode set to 'no-cors', and returns the cookies that were included in the
289-
// request.
290-
function NoCorsSubresourceCookiesFromFrame(frame, host) {
291-
const url = `${host}/storage-access-api/resources/echo-cookie-header.py`;
292-
return NoCorsFetchFromFrame(frame, url);
293-
}
294-
295288
// Tries to set storage access policy, ignoring any errors.
296289
//
297290
// Note: to discourage the writing of tests that assume unpartitioned cookie

storage-access-api/requestStorageAccess-cross-site-sibling-iframes.sub.https.window.js

-1
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,6 @@
7676

7777
assert_false(cookieStringHasCookie("foo", "bar", await FetchSubresourceCookiesFromFrame(crossOriginFrame, wwwAlt)), "crossOriginFrame making cross-site subresource request to sibling iframe's host should not include cookies.");
7878

79-
assert_false(cookieStringHasCookie("foo", "bar", await NoCorsSubresourceCookiesFromFrame(crossOriginFrame, www)), "crossSiteFrame making no-cors cross-site subresource request to sibling iframe's host should not include cookies.");
8079
assert_false(cookieStringHasCookie("cookie", "monster", await FetchSubresourceCookiesFromFrame(crossSiteFrame, www)),"crossSiteFrame making cross-site subresource request to sibling iframe's host should not include cookies.");
8180

8281
}, "Cross-site sibling iframes should not be able to take advantage of the existing permission grant requested by others.");

storage-access-api/resources/embedded_responder.js

+5-2
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,12 @@ window.addEventListener("message", async (event) => {
8282
case "cors fetch":
8383
reply(await fetch(event.data.url, {mode: 'cors', credentials: 'include'}).then((resp) => resp.text()));
8484
break;
85-
case "no-cors fetch":
86-
reply(await fetch(event.data.url, {mode: 'no-cors', credentials: 'include'}).then((resp) => resp.text()));
85+
case "no-cors fetch": {
86+
const resp = await fetch(event.data.url, {mode: 'no-cors', credentials: 'include'});
87+
await resp.text();
88+
reply(undefined);
8789
break;
90+
}
8891
case "start_dedicated_worker":
8992
worker = new Worker("embedded_worker.py");
9093
reply(undefined);

0 commit comments

Comments
 (0)