| <!DOCTYPE html><!-- webkit-test-runner [ IPCTestingAPIEnabled=true ] --> |
| <title>Test that LoadPing validates firstPartyForCookies via MESSAGE_CHECK</title> |
| <script src="../resources/testharness.js"></script> |
| <script src="../resources/testharnessreport.js"></script> |
| <body> |
| <script> |
| promise_test(async (t) => { |
| if (!window.IPC) { |
| done(); |
| return; |
| } |
| |
| const { CoreIPC, ArgumentSerializer } = await import('./coreipc.js'); |
| |
| const forgedFirstParty = 'http://localhost:8080/'; |
| |
| const resourceLoadParameters = { |
| webPageProxyID: BigInt(IPC.webPageProxyID), |
| webPageID: BigInt(IPC.pageID), |
| webFrameID: BigInt(IPC.frameID), |
| request: { |
| getRequestDataToSerialize: { |
| variantType: 'WebCore::ResourceRequest::RequestData', |
| variant: { |
| m_url: { string: forgedFirstParty }, |
| m_firstPartyForCookies: { string: forgedFirstParty }, |
| m_timeoutInterval: 60.0, |
| m_httpMethod: 'GET', |
| m_httpHeaderFields: { commonHeaders: [], uncommonHeaders: [] }, |
| m_responseContentDispositionEncodingFallbackArray: [], |
| m_cachePolicy: 0, |
| m_sameSiteDisposition: 1, |
| m_priority: 2, |
| m_requester: 0, |
| m_allowCookies: true, |
| m_isTopSite: true, |
| m_isAppInitiated: true, |
| m_privacyProxyFailClosedForUnreachableNonMainHosts: false, |
| m_useAdvancedPrivacyProtections: false, |
| m_didFilterLinkDecoration: false, |
| m_isPrivateTokenUsageByThirdPartyAllowed: false, |
| m_wasSchemeOptimisticallyUpgraded: false, |
| m_targetAddressSpace: 0, |
| }, |
| }, |
| cachePartition: '', |
| shouldBlockThirdPartyStorage: false, |
| hiddenFromInspector: false, |
| }, |
| requestBody: { data: {}, sandboxExtensionHandles: [] }, |
| topOrigin: {}, |
| sourceOrigin: {}, |
| parentPID: { alias: 0 }, |
| contentSniffingPolicy: 0, |
| contentEncodingSniffingPolicy: 0, |
| storedCredentialsPolicy: 1, |
| clientCredentialPolicy: 0, |
| shouldClearReferrerOnHTTPSToHTTPRedirect: true, |
| needsCertificateInfo: false, |
| isMainFrameNavigation: false, |
| navigationLosesFrameSpecificStorageAccess: false, |
| mainResourceNavigationDataForAnyFrame: {}, |
| shouldPreconnectOnly: 0, |
| isNavigatingToAppBoundDomain: {}, |
| hadMainFrameMainResourcePrivateRelayed: false, |
| allowPrivacyProxy: true, |
| advancedPrivacyProtections: 0, |
| mayBlockNetworkRequest: false, |
| requiredCookiesVersion: 0n, |
| identifier: { optionalValue: 99001n }, |
| requestBodySandboxExtensions: [], |
| resourceSandboxExtension: {}, |
| maximumBufferingTime: { value: 0 }, |
| options: { |
| destination: 0, |
| mode: 0, |
| credentials: 0, |
| cache: 0, |
| redirect: 0, |
| referrerPolicy: 0, |
| keepAlive: true, |
| integrity: '', |
| clientIdentifier: {}, |
| resultingClientIdentifier: {}, |
| }, |
| cspResponseHeaders: {}, |
| parentFrameURL: { string: '' }, |
| frameURL: { string: '' }, |
| parentCrossOriginEmbedderPolicy: { |
| value: 0, |
| reportOnlyValue: 0, |
| reportingEndpoint: '', |
| reportOnlyReportingEndpoint: '', |
| }, |
| crossOriginEmbedderPolicy: { |
| value: 0, |
| reportOnlyValue: 0, |
| reportingEndpoint: '', |
| reportOnlyReportingEndpoint: '', |
| }, |
| originalRequestHeaders: { commonHeaders: [], uncommonHeaders: [] }, |
| preflightPolicy: 0, |
| shouldEnableCrossOriginResourcePolicy: false, |
| frameAncestorOrigins: [], |
| pageHasResourceLoadClient: false, |
| parentFrameID: {}, |
| crossOriginAccessControlCheckEnabled: false, |
| documentURL: { string: '' }, |
| isCrossOriginOpenerPolicyEnabled: false, |
| isClearSiteDataHeaderEnabled: false, |
| isClearSiteDataExecutionContextEnabled: false, |
| isDisplayingInitialEmptyDocument: false, |
| effectiveSandboxFlags: { alias: 0 }, |
| openerURL: { string: '' }, |
| sourceCrossOriginOpenerPolicy: { |
| value: 0, |
| reportOnlyValue: 0, |
| reportingEndpoint: '', |
| reportOnlyReportingEndpoint: '', |
| }, |
| navigationID: {}, |
| navigationRequester: {}, |
| serviceWorkersMode: 1, |
| serviceWorkerRegistrationIdentifier: {}, |
| httpHeadersToKeep: 0, |
| navigationPreloadIdentifier: {}, |
| workerIdentifier: { alias: { variantType: 'std::monostate', variant: null } }, |
| mainDocumentURL: { string: '' }, |
| userContentControllerIdentifier: {}, |
| pageHasLoadedWebExtensions: false, |
| linkPreconnectEarlyHintsEnabled: false, |
| shouldRecordFrameLoadForStorageAccess: false, |
| isInitiatorPrefetch: false, |
| isInitiatedByDedicatedWorker: false, |
| globalPrivacyControlEnabled: false, |
| shouldConsiderEnhancedSecurityForInsecureResponse:false, |
| originalNavigationStartTime: { secondsSinceEpochSeconds: 0 }, |
| }; |
| |
| CoreIPC.Networking.NetworkConnectionToWebProcess.TakeInvalidMessageStringForTesting(0, {}, () => { }); |
| |
| CoreIPC.Networking.NetworkConnectionToWebProcess.LoadPing(0, { resourceLoadParameters: resourceLoadParameters }); |
| |
| let messageCheck = null; |
| CoreIPC.Networking.NetworkConnectionToWebProcess.TakeInvalidMessageStringForTesting(0, {}, |
| reply => messageCheck = reply.error); |
| |
| assert_true(!!messageCheck && messageCheck.includes('Message check failed'), |
| 'LoadPing with forged firstPartyForCookies should trigger MESSAGE_CHECK, got: "' + messageCheck + '"'); |
| |
| }, 'LoadPing rejects forged firstPartyForCookies via MESSAGE_CHECK'); |
| |
| done(); |
| </script> |
| </body> |
