Specify range fetching for media #7655

noamr · 2022-02-23T17:46:12Z

At least two implementers are interested (and none opposed):
- The common cases are implemented.
Tests are written and can be reviewed and commented upon at:
- Fix expected results for video loading from multiple origins web-platform-tests/wpt#33342 (updated the test case to account for now-specified case, already implemented in all browsers)
Implementation bugs are filed:
- N/A. Currently implementations do the right thing, though some of it was not spec'ed

(See WHATWG Working Mode: Changes for more details.)

/infrastructure.html ( diff )
/media.html ( diff )

noamr · 2022-02-23T17:49:13Z

This PR attempts to resolve #2814 (comment).

It has several differences from the original PR. The key difference is that multiple opaque range responses are OK as long as they're from the same origin - they don't have to be the same URL. The key verification point is that opaque range responses are only OK if the media resource had contributions from only one origin (programmatic SW responses are considered a null origin).

It's ready for initial feedback to see if stakeholders are aligned before I spend the time required on WPTs.

noamr · 2022-02-23T18:06:52Z

/FYI @annevk @jakearchibald @yoavweiss @domenic (please CC whoever else is interested in this)

domenic

Seems like a promising start!

source

domenic · 2022-02-27T22:01:51Z

Note that this does no Resource Timing for blob-derived (i.e. "local") media resource fetches. Is that what we want / do we have tests for that?

noamr · 2022-02-28T05:42:34Z

Note that this does no Resource Timing for blob-derived (i.e. "local") media resource fetches. Is that what we want / do we have tests for that?

Regardless of media, blobs don't get resource timing entries in general - only HTTP(s). I can add a test for that but it's not a specific/novel thing.

noamr · 2022-03-14T15:46:00Z

@domenic additional review pass ? :)

source

noamr · 2022-03-22T14:22:04Z

@domenic additional review pass ? :)

^^^

domenic · 2022-03-22T14:23:21Z

There are still three outstanding review comments.

noamr · 2022-03-22T14:30:38Z

There are still three outstanding review comments.

Oh I see now, missed them for some reason. Sorry for the noise.

noamr · 2022-03-22T14:42:56Z

There are still three outstanding review comments.

I found two and fixed them. Did I miss anything?

domenic

Looks great! Let us know when the template is filled out, including tests.

See whatwg/html#7655 When loading video from multiple opaque origins (by a middleman service-worker), video loading should fail rather than be alllowed and taint the canvas. That's because some of the video responses may contain metadata such as duration that would leak to the subsequent requests. See whatwg/html#2814 (comment) for further details. This change makes the test case pass in all browsers.

karlt · 2022-03-28T05:51:10Z

The key difference is that multiple opaque range responses are OK as long as they're from the same origin - they don't have to be the same URL.

Can you elaborate on the reasons for this change in approach please?

If an attacker knows the content of some of the files from the origin being attacked, then it would seem plausible that they might be able to piece together leading bytes of their choice and so still succeed in the attacks that the URL check was intended to prevent.

noamr · 2022-03-28T06:05:24Z

The key difference is that multiple opaque range responses are OK as long as they're from the same origin - they don't have to be the same URL.

Can you elaborate on the reasons for this change in approach please?

If an attacker knows the content of some of the files from the origin being attacked, then it would seem plausible that they might be able to piece together leading bytes of their choice and so still succeed in the attacks that the URL check was intended to prevent.

This use-case remains not allowed in this PR.

What's allowed is piecing together pieces from different URLs of the same origin.
For example, the first media request redirects you to https://origin-a.com/media1.mp4 and the second media request redirects you to https://origin-a.com/media2.mp4.

Since the security issue here is a cross-origin, the checks of whether two media responses can be pieced together are same-origin checks rather than URL equality checks.

* Add two cases to preload SRI * Add test for stronger/weaker digest * Fix expected results for video loading from multiple origins See whatwg/html#7655 When loading video from multiple opaque origins (by a middleman service-worker), video loading should fail rather than be alllowed and taint the canvas. That's because some of the video responses may contain metadata such as duration that would leak to the subsequent requests. See whatwg/html#2814 (comment) for further details. This change makes the test case pass in all browsers. * Add another case

karlt

Sorry, I missed that these questions were not submitted with my other comment a few days ago.

karlt · 2022-03-28T05:21:54Z

source

+ <li><p>If <var>internalResponse</var>'s <span data-x="concept-response-status">status</span> is
+ not 206, then return false.</p></li>


Because A server MAY ignore the Range header field, a 200 (OK) response would be a valid response.
Is a 200 response intentionally rejected here?

Sorry, I missed that these questions were not submitted with my other comment a few days ago.

Thanks for the notes! I'll check (probably next week) how implementations currently handle these cases and submit WPT/spec PRs accordingly.

karlt · 2022-03-28T05:43:17Z

source

+ <var>byteRange</var>[1] is neither "<code data-x="">until end</code>" or <var>end</var>,
+ return false.</p></li>


Is the requirement that end match byteRange[1] when not "until end" necessary?
It seems inconsistent with allowing a truncated response with "until end".

The 206 (Partial Content) status code indicates that the server is successfully fulfilling a range request for the target resource by transferring one or more parts of the selected representation that correspond to the satisfiable ranges found in the request's Range header field (Section 3.1).. i.e. I'm not aware of any requirement that a response should include the entirety of a requested range.

There is precendent for expecting a response containing only a portion of the requested range to be aligned with the start of the requested range, so I guess that would be less problematic.

Apparently implementations today don't verify that the request range matches the response range.
Added a PR to remove that verification.

Also, Gecko & Chromium allow 200 responses for range requests. Added that to the PR. It's a known bug in Safari.

Automatic update from web-platform-tests Add a few cases to preload SRI (#33326) * Add two cases to preload SRI * Add test for stronger/weaker digest * Fix expected results for video loading from multiple origins See whatwg/html#7655 When loading video from multiple opaque origins (by a middleman service-worker), video loading should fail rather than be alllowed and taint the canvas. That's because some of the video responses may contain metadata such as duration that would leak to the subsequent requests. See whatwg/html#2814 (comment) for further details. This change makes the test case pass in all browsers. * Add another case -- wpt-commits: 6a214e8155265b0c4e13471302d35f27386ef550 wpt-pr: 33326

User-agents don't actually perform these verifications. The only important verification is origin of responses. See whatwg#7655 (comment)

Automatic update from web-platform-tests Add a few cases to preload SRI (#33326) * Add two cases to preload SRI * Add test for stronger/weaker digest * Fix expected results for video loading from multiple origins See whatwg/html#7655 When loading video from multiple opaque origins (by a middleman service-worker), video loading should fail rather than be alllowed and taint the canvas. That's because some of the video responses may contain metadata such as duration that would leak to the subsequent requests. See whatwg/html#2814 (comment) for further details. This change makes the test case pass in all browsers. * Add another case -- wpt-commits: 6a214e8155265b0c4e13471302d35f27386ef550 wpt-pr: 33326

Verifying media responses performs 3 verifications: * The response should also be a range response * The response's range should match the request's range * There should not be mixed origins with opaque response While the last verification is mandatory for same-origin policy, the first two are optional, and may be skipped if the user-agent decides to be lenient towards servers who don't handle range requests properly. See whatwg#7655 (comment)

f495c02 added some verification to media range responses, but in reality this verification is not present in most implementations. See discussion in #7655 (comment).

f495c02 added some verification to media range responses, but in reality this verification is not present in most implementations. See discussion in whatwg#7655 (comment).

noamr mentioned this pull request Feb 23, 2022

Specify how media elements make and validate range requests #2814

Closed

noamr changed the title ~~Rigorous fetching of media requests~~ Specify range fetching for media Feb 23, 2022

noamr mentioned this pull request Feb 23, 2022

Handling Partial Content / 206 whatwg/fetch#144

Open

noamr mentioned this pull request Feb 23, 2022

Create resource timing entries for HTML resources #6542

Closed

16 tasks

domenic reviewed Feb 27, 2022

View reviewed changes

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

source Outdated Show resolved Hide resolved

noamr force-pushed the range-requests branch from 4b8e51a to 988d99e Compare February 28, 2022 06:53

noamr mentioned this pull request Mar 13, 2022

Multi-spec non-feature TODOs for web performance WG w3c/web-performance#38

Closed

20 tasks

domenic added the topic: media label Mar 14, 2022

domenic reviewed Mar 14, 2022

View reviewed changes

noamr force-pushed the range-requests branch from 3b10891 to 911fee1 Compare March 14, 2022 17:30

domenic added the needs tests Moving the issue forward requires someone to write tests label Mar 22, 2022

domenic approved these changes Mar 22, 2022

View reviewed changes

noamr mentioned this pull request Mar 24, 2022

Fix expected results for video loading from multiple origins web-platform-tests/wpt#33342

Closed

noamr added 3 commits March 31, 2022 17:31

Rigorous fetching of media requests

98b85e8

nit

9499d4b

nit

9adeeb2

noamr and others added 7 commits March 31, 2022 17:31

inline finalize

e7fe0cf

Refactor to not require a set

b872918

Small refactor

5420efe

nit

877dd3e

Nits

b2f1633

Minor fixes

9d780f0

Fix CR comments

e80eebb

noamr force-pushed the range-requests branch from ed70665 to e80eebb Compare March 31, 2022 14:31

domenic removed the needs tests Moving the issue forward requires someone to write tests label Mar 31, 2022

domenic merged commit f495c02 into whatwg:main Mar 31, 2022

karlt reviewed Mar 31, 2022

View reviewed changes

noamr added a commit to noamr/html that referenced this pull request Apr 4, 2022

Don't verify range values in range responses

89aeded

User-agents don't actually perform these verifications. The only important verification is origin of responses. See whatwg#7655 (comment)

noamr mentioned this pull request Apr 4, 2022

Range verification should not fail media responses #7782

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Specify range fetching for media #7655

Specify range fetching for media #7655

noamr commented Feb 23, 2022 •

edited by pr-preview bot

Loading

noamr commented Feb 23, 2022 •

edited

Loading

noamr commented Feb 23, 2022

domenic left a comment

domenic commented Feb 27, 2022

noamr commented Feb 28, 2022

noamr commented Mar 14, 2022

noamr commented Mar 22, 2022

domenic commented Mar 22, 2022

noamr commented Mar 22, 2022

noamr commented Mar 22, 2022

domenic left a comment

karlt commented Mar 28, 2022

noamr commented Mar 28, 2022 •

edited

Loading

karlt left a comment •

edited

Loading

karlt Mar 28, 2022

noamr Apr 1, 2022

karlt Mar 28, 2022

noamr Apr 4, 2022

		<li><p>If <var>internalResponse</var>'s <span data-x="concept-response-status">status</span> is
		not 206, then return false.</p></li>

		<var>byteRange</var>[1] is neither "<code data-x="">until end</code>" or <var>end</var>,
		return false.</p></li>

Specify range fetching for media #7655

Specify range fetching for media #7655

Conversation

noamr commented Feb 23, 2022 • edited by pr-preview bot Loading

noamr commented Feb 23, 2022 • edited Loading

noamr commented Feb 23, 2022

domenic left a comment

Choose a reason for hiding this comment

domenic commented Feb 27, 2022

noamr commented Feb 28, 2022

noamr commented Mar 14, 2022

noamr commented Mar 22, 2022

domenic commented Mar 22, 2022

noamr commented Mar 22, 2022

noamr commented Mar 22, 2022

domenic left a comment

Choose a reason for hiding this comment

karlt commented Mar 28, 2022

noamr commented Mar 28, 2022 • edited Loading

karlt left a comment • edited Loading

Choose a reason for hiding this comment

karlt Mar 28, 2022

Choose a reason for hiding this comment

noamr Apr 1, 2022

Choose a reason for hiding this comment

karlt Mar 28, 2022

Choose a reason for hiding this comment

noamr Apr 4, 2022

Choose a reason for hiding this comment

noamr commented Feb 23, 2022 •

edited by pr-preview bot

Loading

noamr commented Feb 23, 2022 •

edited

Loading

noamr commented Mar 28, 2022 •

edited

Loading

karlt left a comment •

edited

Loading