From d7f9bb10974d1d951f19e4d827657a59619434af Mon Sep 17 00:00:00 2001 From: Andrew Williams Date: Fri, 1 Nov 2024 19:44:09 -0700 Subject: [PATCH] [Blob URL] Add tests for enforcing noopener on a / area clicks For cross-top-level-site navigations via clicking "a" and "area" links that use `target="_blank" rel="opener"`, we should enforce noopener as part of Blob URL partitioning. "window.opener" can also get set on form submissions, but from testing in Chrome, Firefox, and Safari, we can't successfully perform a form submission to a Blob URL (if the method is GET, it seems that the appended '?' breaks the Blob URL lookup, and POST doesn't work either because it is an unsupported method for Blob URLs). For more information, see: https://docs.google.com/document/d/1Xk73RLlLgfVw1p2tYBGqlP7ROQxaMh6kxfusSMm9exM/edit?usp=sharing Bug: 361751872 Change-Id: I723a0cf0df73ebb2f81f3fced496248d5c7a9798 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5979376 Reviewed-by: Steven Bingler Commit-Queue: Andrew Williams Cr-Commit-Position: refs/heads/main@{#1377218} --- ...-partition-navigation.tentative.https.html | 142 +++++++++++++++--- 1 file changed, 120 insertions(+), 22 deletions(-) diff --git a/FileAPI/BlobURL/cross-partition-navigation.tentative.https.html b/FileAPI/BlobURL/cross-partition-navigation.tentative.https.html index 05f54b0ae0afa9..ee879b0d95508a 100644 --- a/FileAPI/BlobURL/cross-partition-navigation.tentative.https.html +++ b/FileAPI/BlobURL/cross-partition-navigation.tentative.https.html @@ -64,7 +64,25 @@ return [cross_site_iframe_uuid, same_site_iframe_uuid]; } -// Tests navigating blob URL for same and cross partition iframes. +const opener_check_frame_html = (noopener_response_queue) => ` + + + + - \ No newline at end of file +