classic script's base URL should be sanitized when muted errors flag is set #5751

hiroshige-g · 2020-07-22T07:13:35Z

For external classic scripts with muted errors flag is set, like

cross-origin <script src="https://cross-origin.example.com/path/to/a.js"></script> without crossorigin attrubutes
cross-origin importScripts()ed scripts

The base URL of such a classic script is script's response's url, which shouldn't be accessible from JavaScript (Fetch API doesn't expose it, because the fetch resulted in an opaque response).
However, (the dirname part of) classic script's base URL can be obeserved by service workers intercepting dynamic import() requests from the classic script. e.g. if https://cross-origin.example.com/path/to/a.js contains import("./foo.js"), then the URL https://cross-origin.example.com/path/to/foo.js is exposed to service workers.

To avoid this leak of script's response URL, classic script's base URL should be sanitized when muted errors flag is set.

Design doc (including alternatives considered):
https://docs.google.com/document/d/1Nmj4smaMsKnjbHBsAXcYIhz1LAn8GU6oBzTGmdgSz14/edit

cc/ @domenic @youennf @annevk @nyaxt

The text was updated successfully, but these errors were encountered:

…lag is set Fixes whatwg#5751.

This CL checks base URL used in resolving relative URL-like specifiers in dynamic imports() from - `<script>`s, - worker top-level scripts, and - worker scripts imported by `importScripts()`. This is for whatwg/html#5751. Bug: 1082086 Change-Id: I778fb4d34b2e61f57799600006963c93aee5272c

wanderview · 2020-07-22T15:19:28Z

This seems very similar to @supports in a cross-origin stylesheet (w3c/ServiceWorker#719). It would seem observing the import request at all leaks information, regardless of the base URL component.

Should this be an issue on the service worker repo? Do we have use counter data on how many loads would be affected by a change here?

hiroshige-g · 2020-07-22T23:11:26Z

w3c/ServiceWorker#719

Yes it's related, but I think it's better to fix script's base URL separately, because:

"no-cors" CSS SOP violation w3c/ServiceWorker#719 is harder to fix, as many more requests will be affected (so far dynamic imports are much less popular than no-CORS CSS)
script's base URL can be used for other purposes in the future and can be exposed without "no-cors" CSS SOP violation w3c/ServiceWorker#719.

Fixes #5751.

This CL checks base URL used in resolving relative URL-like specifiers in dynamic imports() from - `<script>`s, - worker top-level scripts, and - worker scripts imported by `importScripts()`. This is for whatwg/html#5751. Bug: 1082086 Change-Id: I778fb4d34b2e61f57799600006963c93aee5272c

This CL checks base URL used in resolving relative URL-like specifiers in dynamic imports() from - `<script>`s, - worker top-level scripts, and - worker scripts imported by `importScripts()`. This is for whatwg/html#5751. Bug: 1082086 Change-Id: I778fb4d34b2e61f57799600006963c93aee5272c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2198835 Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org> Reviewed-by: Domenic Denicola <domenic@chromium.org> Cr-Commit-Position: refs/heads/master@{#794492}

This reverts commit 7e3a7255699cf3f8ac9bd3e31dadc69db293e06b. Reason for revert: Consistent failures of external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub.html in blink_web_tests on multiple builders started after this change landed. Original change's description: > [WPT] Test script's base URL used in dynamic imports > > This CL checks base URL used in resolving relative URL-like > specifiers in dynamic imports() from > > - `<script>`s, > - worker top-level scripts, and > - worker scripts imported by `importScripts()`. > > This is for whatwg/html#5751. > > Bug: 1082086 > Change-Id: I778fb4d34b2e61f57799600006963c93aee5272c > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2198835 > Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org> > Reviewed-by: Domenic Denicola <domenic@chromium.org> > Cr-Commit-Position: refs/heads/master@{#794492} TBR=hiroshige@chromium.org,domenic@chromium.org Change-Id: I2fd1c341c96d0364a6dbe6cce31a8c2630403b27 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: 1082086 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2335460 Reviewed-by: Rebekah Potter <rbpotter@chromium.org> Commit-Queue: Rebekah Potter <rbpotter@chromium.org> Cr-Commit-Position: refs/heads/master@{#794657}

This CL checks base URL used in resolving relative URL-like specifiers in dynamic imports() from - `<script>`s, - worker top-level scripts, and - worker scripts imported by `importScripts()`. This is for whatwg/html#5751. This CL relands https://chromium-review.googlesource.com/c/chromium/src/+/2198835/ with a fix: `base-url-worker.sub.html` was flaky due to race between two `fetch_tests_from_worker()`s. In this reland, a `fetch_tests_from_worker()` is moved to a new file `base-url-worker-importScripts.html`, having at most one `fetch_tests_from_worker()` per file. Bug: 1082086, 1112844 Change-Id: I59c9817a7829e950f40878d376ccb5216207b7e8

This reverts commit 7e3a725. Reason for revert: Consistent failures of external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub.html in blink_web_tests on multiple builders started after this change landed. Original change's description: > [WPT] Test script's base URL used in dynamic imports > > This CL checks base URL used in resolving relative URL-like > specifiers in dynamic imports() from > > - `<script>`s, > - worker top-level scripts, and > - worker scripts imported by `importScripts()`. > > This is for whatwg/html#5751. > > Bug: 1082086 > Change-Id: I778fb4d34b2e61f57799600006963c93aee5272c > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2198835 > Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org> > Reviewed-by: Domenic Denicola <domenic@chromium.org> > Cr-Commit-Position: refs/heads/master@{#794492} TBR=hiroshige@chromium.org,domenic@chromium.org Change-Id: I2fd1c341c96d0364a6dbe6cce31a8c2630403b27 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: 1082086 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2335460 Reviewed-by: Rebekah Potter <rbpotter@chromium.org> Commit-Queue: Rebekah Potter <rbpotter@chromium.org> Cr-Commit-Position: refs/heads/master@{#794657}

This CL checks base URL used in resolving relative URL-like specifiers in dynamic imports() from - `<script>`s, - worker top-level scripts, and - worker scripts imported by `importScripts()`. This is for whatwg/html#5751. This CL relands https://chromium-review.googlesource.com/c/chromium/src/+/2198835/ with a fix: `base-url-worker.sub.html` was flaky due to race between two `fetch_tests_from_worker()`s. In this reland, a `fetch_tests_from_worker()` is moved to a new file `base-url-worker-importScripts.html`, having at most one `fetch_tests_from_worker()` per file. Bug: 1082086, 1112844 Change-Id: I59c9817a7829e950f40878d376ccb5216207b7e8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2337194 Reviewed-by: Domenic Denicola <domenic@chromium.org> Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org> Cr-Commit-Position: refs/heads/master@{#794865}

This CL checks base URL used in resolving relative URL-like specifiers in dynamic imports() from - `<script>`s, - worker top-level scripts, and - worker scripts imported by `importScripts()`. This is for whatwg/html#5751. This CL relands https://chromium-review.googlesource.com/c/chromium/src/+/2198835/ with a fix: `base-url-worker.sub.html` was flaky due to race between two `fetch_tests_from_worker()`s. In this reland, a `fetch_tests_from_worker()` is moved to a new file `base-url-worker-importScripts.html`, having at most one `fetch_tests_from_worker()` per file. Bug: 1082086, 1112844 Change-Id: I59c9817a7829e950f40878d376ccb5216207b7e8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2337194 Reviewed-by: Domenic Denicola <domenic@chromium.org> Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org> Cr-Commit-Position: refs/heads/master@{#794865}

…d in dynamic imports", a=testonly Automatic update from web-platform-tests Revert "[WPT] Test script's base URL used in dynamic imports" This reverts commit 7e3a7255699cf3f8ac9bd3e31dadc69db293e06b. Reason for revert: Consistent failures of external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub.html in blink_web_tests on multiple builders started after this change landed. Original change's description: > [WPT] Test script's base URL used in dynamic imports > > This CL checks base URL used in resolving relative URL-like > specifiers in dynamic imports() from > > - `<script>`s, > - worker top-level scripts, and > - worker scripts imported by `importScripts()`. > > This is for whatwg/html#5751. > > Bug: 1082086 > Change-Id: I778fb4d34b2e61f57799600006963c93aee5272c > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2198835 > Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org> > Reviewed-by: Domenic Denicola <domenic@chromium.org> > Cr-Commit-Position: refs/heads/master@{#794492} TBR=hiroshige@chromium.org,domenic@chromium.org Change-Id: I2fd1c341c96d0364a6dbe6cce31a8c2630403b27 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: 1082086 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2335460 Reviewed-by: Rebekah Potter <rbpotter@chromium.org> Commit-Queue: Rebekah Potter <rbpotter@chromium.org> Cr-Commit-Position: refs/heads/master@{#794657} -- wpt-commits: af4aba71a5d7d993e1fe4db51478e72b6657ef13 wpt-pr: 24877

…e URL used in dynamic imports, a=testonly Automatic update from web-platform-tests [WPT] Reland with fix: Test script's base URL used in dynamic imports This CL checks base URL used in resolving relative URL-like specifiers in dynamic imports() from - `<script>`s, - worker top-level scripts, and - worker scripts imported by `importScripts()`. This is for whatwg/html#5751. This CL relands https://chromium-review.googlesource.com/c/chromium/src/+/2198835/ with a fix: `base-url-worker.sub.html` was flaky due to race between two `fetch_tests_from_worker()`s. In this reland, a `fetch_tests_from_worker()` is moved to a new file `base-url-worker-importScripts.html`, having at most one `fetch_tests_from_worker()` per file. Bug: 1082086, 1112844 Change-Id: I59c9817a7829e950f40878d376ccb5216207b7e8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2337194 Reviewed-by: Domenic Denicola <domenic@chromium.org> Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org> Cr-Commit-Position: refs/heads/master@{#794865} -- wpt-commits: ad99a9e949c6006cc0f609501de77a0edb1e593a wpt-pr: 24878

…d in dynamic imports", a=testonly Automatic update from web-platform-tests Revert "[WPT] Test script's base URL used in dynamic imports" This reverts commit 7e3a7255699cf3f8ac9bd3e31dadc69db293e06b. Reason for revert: Consistent failures of external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub.html in blink_web_tests on multiple builders started after this change landed. Original change's description: > [WPT] Test script's base URL used in dynamic imports > > This CL checks base URL used in resolving relative URL-like > specifiers in dynamic imports() from > > - `<script>`s, > - worker top-level scripts, and > - worker scripts imported by `importScripts()`. > > This is for whatwg/html#5751. > > Bug: 1082086 > Change-Id: I778fb4d34b2e61f57799600006963c93aee5272c > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2198835 > Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org> > Reviewed-by: Domenic Denicola <domenic@chromium.org> > Cr-Commit-Position: refs/heads/master@{#794492} TBR=hiroshige@chromium.org,domenic@chromium.org Change-Id: I2fd1c341c96d0364a6dbe6cce31a8c2630403b27 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: 1082086 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2335460 Reviewed-by: Rebekah Potter <rbpotter@chromium.org> Commit-Queue: Rebekah Potter <rbpotter@chromium.org> Cr-Commit-Position: refs/heads/master@{#794657} -- wpt-commits: af4aba71a5d7d993e1fe4db51478e72b6657ef13 wpt-pr: 24877

…e URL used in dynamic imports, a=testonly Automatic update from web-platform-tests [WPT] Reland with fix: Test script's base URL used in dynamic imports This CL checks base URL used in resolving relative URL-like specifiers in dynamic imports() from - `<script>`s, - worker top-level scripts, and - worker scripts imported by `importScripts()`. This is for whatwg/html#5751. This CL relands https://chromium-review.googlesource.com/c/chromium/src/+/2198835/ with a fix: `base-url-worker.sub.html` was flaky due to race between two `fetch_tests_from_worker()`s. In this reland, a `fetch_tests_from_worker()` is moved to a new file `base-url-worker-importScripts.html`, having at most one `fetch_tests_from_worker()` per file. Bug: 1082086, 1112844 Change-Id: I59c9817a7829e950f40878d376ccb5216207b7e8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2337194 Reviewed-by: Domenic Denicola <domenic@chromium.org> Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org> Cr-Commit-Position: refs/heads/master@{#794865} -- wpt-commits: ad99a9e949c6006cc0f609501de77a0edb1e593a wpt-pr: 24878

…d in dynamic imports", a=testonly Automatic update from web-platform-tests Revert "[WPT] Test script's base URL used in dynamic imports" This reverts commit 7e3a7255699cf3f8ac9bd3e31dadc69db293e06b. Reason for revert: Consistent failures of external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub.html in blink_web_tests on multiple builders started after this change landed. Original change's description: > [WPT] Test script's base URL used in dynamic imports > > This CL checks base URL used in resolving relative URL-like > specifiers in dynamic imports() from > > - `<script>`s, > - worker top-level scripts, and > - worker scripts imported by `importScripts()`. > > This is for whatwg/html#5751. > > Bug: 1082086 > Change-Id: I778fb4d34b2e61f57799600006963c93aee5272c > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2198835 > Commit-Queue: Hiroshige Hayashizaki <hiroshigechromium.org> > Reviewed-by: Domenic Denicola <domenicchromium.org> > Cr-Commit-Position: refs/heads/master{#794492} TBR=hiroshigechromium.org,domenicchromium.org Change-Id: I2fd1c341c96d0364a6dbe6cce31a8c2630403b27 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: 1082086 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2335460 Reviewed-by: Rebekah Potter <rbpotterchromium.org> Commit-Queue: Rebekah Potter <rbpotterchromium.org> Cr-Commit-Position: refs/heads/master{#794657} -- wpt-commits: af4aba71a5d7d993e1fe4db51478e72b6657ef13 wpt-pr: 24877 UltraBlame original commit: f39400495c95bbd2d0ab6d95ef3e8b675d1ddeb7

…e URL used in dynamic imports, a=testonly Automatic update from web-platform-tests [WPT] Reland with fix: Test script's base URL used in dynamic imports This CL checks base URL used in resolving relative URL-like specifiers in dynamic imports() from - `<script>`s, - worker top-level scripts, and - worker scripts imported by `importScripts()`. This is for whatwg/html#5751. This CL relands https://chromium-review.googlesource.com/c/chromium/src/+/2198835/ with a fix: `base-url-worker.sub.html` was flaky due to race between two `fetch_tests_from_worker()`s. In this reland, a `fetch_tests_from_worker()` is moved to a new file `base-url-worker-importScripts.html`, having at most one `fetch_tests_from_worker()` per file. Bug: 1082086, 1112844 Change-Id: I59c9817a7829e950f40878d376ccb5216207b7e8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2337194 Reviewed-by: Domenic Denicola <domenicchromium.org> Commit-Queue: Hiroshige Hayashizaki <hiroshigechromium.org> Cr-Commit-Position: refs/heads/master{#794865} -- wpt-commits: ad99a9e949c6006cc0f609501de77a0edb1e593a wpt-pr: 24878 UltraBlame original commit: 0f2204acb9caeeea4da648565aa1d31a46e93f8c

…d in dynamic imports", a=testonly Automatic update from web-platform-tests Revert "[WPT] Test script's base URL used in dynamic imports" This reverts commit 7e3a7255699cf3f8ac9bd3e31dadc69db293e06b. Reason for revert: Consistent failures of external/wpt/html/semantics/scripting-1/the-script-element/module/dynamic-import/alpha/base-url-worker.sub.html in blink_web_tests on multiple builders started after this change landed. Original change's description: > [WPT] Test script's base URL used in dynamic imports > > This CL checks base URL used in resolving relative URL-like > specifiers in dynamic imports() from > > - `<script>`s, > - worker top-level scripts, and > - worker scripts imported by `importScripts()`. > > This is for whatwg/html#5751. > > Bug: 1082086 > Change-Id: I778fb4d34b2e61f57799600006963c93aee5272c > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2198835 > Commit-Queue: Hiroshige Hayashizaki <hiroshigechromium.org> > Reviewed-by: Domenic Denicola <domenicchromium.org> > Cr-Commit-Position: refs/heads/master{#794492} TBR=hiroshigechromium.org,domenicchromium.org Change-Id: I2fd1c341c96d0364a6dbe6cce31a8c2630403b27 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: 1082086 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2335460 Reviewed-by: Rebekah Potter <rbpotterchromium.org> Commit-Queue: Rebekah Potter <rbpotterchromium.org> Cr-Commit-Position: refs/heads/master{#794657} -- wpt-commits: af4aba71a5d7d993e1fe4db51478e72b6657ef13 wpt-pr: 24877 UltraBlame original commit: 57e86fee309c083701b4de7ea11c58f9a6f99d12

…e URL used in dynamic imports, a=testonly Automatic update from web-platform-tests [WPT] Reland with fix: Test script's base URL used in dynamic imports This CL checks base URL used in resolving relative URL-like specifiers in dynamic imports() from - `<script>`s, - worker top-level scripts, and - worker scripts imported by `importScripts()`. This is for whatwg/html#5751. This CL relands https://chromium-review.googlesource.com/c/chromium/src/+/2198835/ with a fix: `base-url-worker.sub.html` was flaky due to race between two `fetch_tests_from_worker()`s. In this reland, a `fetch_tests_from_worker()` is moved to a new file `base-url-worker-importScripts.html`, having at most one `fetch_tests_from_worker()` per file. Bug: 1082086, 1112844 Change-Id: I59c9817a7829e950f40878d376ccb5216207b7e8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2337194 Reviewed-by: Domenic Denicola <domenicchromium.org> Commit-Queue: Hiroshige Hayashizaki <hiroshigechromium.org> Cr-Commit-Position: refs/heads/master{#794865} -- wpt-commits: ad99a9e949c6006cc0f609501de77a0edb1e593a wpt-pr: 24878 UltraBlame original commit: ca847b5bfdb17dbed4654b7a7bea81b5c9fbc411