Diff
Modified: trunk/LayoutTests/ChangeLog (233829 => 233830)
--- trunk/LayoutTests/ChangeLog 2018-07-14 00:04:30 UTC (rev 233829)
+++ trunk/LayoutTests/ChangeLog 2018-07-14 01:07:38 UTC (rev 233830)
@@ -1,3 +1,27 @@
+2018-07-13 John Wilander <[email protected]>
+
+ Flesh out WebSocket cookie tests to cover cookie policy for third-party resources
+ https://bugs.webkit.org/show_bug.cgi?id=187541
+ <rdar://problem/42048729>
+
+ Reviewed by Alex Christensen.
+
+ * http/tests/cookies/resources/cookie-utilities.js:
+ Added a function for setting a cookie in a WebSocket handshake.
+ * http/tests/websocket/tests/hybi/cookie_wsh.py:
+ (web_socket_do_extra_handshake):
+ Now sets the root path for new cookies so that they can be seen by
+ for example cookies/resources/echo-cookies.php.
+ * http/tests/websocket/tests/hybi/websocket-allowed-setting-cookie-as-third-party-expected.txt: Added.
+ * http/tests/websocket/tests/hybi/websocket-allowed-setting-cookie-as-third-party.html: Added.
+ * http/tests/websocket/tests/hybi/websocket-blocked-from-setting-cookie-as-third-party-expected.txt: Added.
+ * http/tests/websocket/tests/hybi/websocket-blocked-from-setting-cookie-as-third-party.html: Added.
+ * http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior-expected.txt:
+ * http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior.html:
+ Now tests under the condition where localhost as third-party is
+ allowed to set a new cookie as third party. It also makes sure to use
+ cookies with the path set to the root so that all cookies are visible.
+
2018-07-13 Youenn Fablet <[email protected]>
Support connecting a MediaStreamAudioDestinationNode to RTCPeerConnection
Modified: trunk/LayoutTests/http/tests/cookies/resources/cookie-utilities.js (233829 => 233830)
--- trunk/LayoutTests/http/tests/cookies/resources/cookie-utilities.js 2018-07-14 00:04:30 UTC (rev 233829)
+++ trunk/LayoutTests/http/tests/cookies/resources/cookie-utilities.js 2018-07-14 01:07:38 UTC (rev 233830)
@@ -228,3 +228,12 @@
else
testFailed(`DOM cookie "${name}" should have value ${expectedValue}. Was ${value}.`);
}
+
+function setCookieUsingWebSocketFromHost(host)
+{
+ var promise = new Promise(resolve => {
+ var websocket = new WebSocket(`ws://${host}:8880/websocket/tests/hybi/cookie?set`);
+ websocket._onclose_ = () => resolve();
+ });
+ return promise;
+}
Modified: trunk/LayoutTests/http/tests/websocket/tests/hybi/cookie_wsh.py (233829 => 233830)
--- trunk/LayoutTests/http/tests/websocket/tests/hybi/cookie_wsh.py 2018-07-14 00:04:30 UTC (rev 233829)
+++ trunk/LayoutTests/http/tests/websocket/tests/hybi/cookie_wsh.py 2018-07-14 01:07:38 UTC (rev 233830)
@@ -1,4 +1,5 @@
# Copyright (C) 2014 Google Inc. All rights reserved.
+# Copyright (C) 2018 Apple Inc. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are
@@ -38,12 +39,13 @@
command = components[4]
_ONE_DAY_LIFE_ = 'Max-Age=86400'
+ ROOT_PATH = 'path=/'
if command == 'set':
- _add_set_cookie(request, '; '.join(['foo=bar', ONE_DAY_LIFE]))
+ _add_set_cookie(request, '; '.join(['foo=bar', ONE_DAY_LIFE, ROOT_PATH]))
elif command == 'set_httponly':
_add_set_cookie(request,
- '; '.join(['httpOnlyFoo=bar', ONE_DAY_LIFE, 'httpOnly']))
+ '; '.join(['httpOnlyFoo=bar', ONE_DAY_LIFE, ROOT_PATH, 'httpOnly']))
elif command == 'clear':
_add_set_cookie(request, 'foo=0; Max-Age=0')
_add_set_cookie(request, 'httpOnlyFoo=0; Max-Age=0')
Added: trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-allowed-setting-cookie-as-third-party-expected.txt (0 => 233830)
--- trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-allowed-setting-cookie-as-third-party-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-allowed-setting-cookie-as-third-party-expected.txt 2018-07-14 01:07:38 UTC (rev 233830)
@@ -0,0 +1,19 @@
+Tests WebSocket Set-Cookie behavior for third-parties with existing cookies.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.location.host is "127.0.0.1:8000"
+
+Setting third-party cookie 'foo' through cross-origin WebSocket handshake.
+
+Opening localhost third-party iframe to check its cookies.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
+
+--------
+Frame: '<!--frame1-->'
+--------
+Cookies are: setAsFirstParty = value foo = bar
Added: trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-allowed-setting-cookie-as-third-party.html (0 => 233830)
--- trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-allowed-setting-cookie-as-third-party.html (rev 0)
+++ trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-allowed-setting-cookie-as-third-party.html 2018-07-14 01:07:38 UTC (rev 233830)
@@ -0,0 +1,48 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script src=""
+ <script src=""
+ <script>
+ window.jsTestIsAsync = true;
+
+ async function testThirdPartyCookie()
+ {
+ shouldBeEqualToString("document.location.host", "127.0.0.1:8000");
+ debug("<br>Setting third-party cookie 'foo' through cross-origin WebSocket handshake.");
+ await setCookieUsingWebSocketFromHost("localhost");
+ let iframeElement = document.createElement("iframe");
+ iframeElement.src = ""
+ iframeElement._onload_ = finishJSTest;
+ debug("<br>Opening localhost third-party iframe to check its cookies.");
+ document.body.appendChild(iframeElement);
+ }
+
+ async function runTest()
+ {
+ switch (document.location.hash) {
+ case "":
+ // Navigate to localhost to set first-party cookie 'setAsFirstParty'.
+ document.location.href = ""
+ break;
+ case "#setCookieAsFirstParty":
+ await setCookie("setAsFirstParty", "value");
+ // Navigate back to 127.0.0.1 to test third-party cookie.
+ document.location.href = ""
+ break;
+ case "#didSetCookieAsFirstParty":
+ testRunner.dumpChildFramesAsText();
+ await testThirdPartyCookie();
+ break;
+ }
+ }
+ </script>
+</head>
+<body>
+<div id="output"></div>
+<script>
+ description("Tests WebSocket Set-Cookie behavior for third-parties with existing cookies.");
+ runTest();
+</script>
+</body>
+</html>
Added: trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-blocked-from-setting-cookie-as-third-party-expected.txt (0 => 233830)
--- trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-blocked-from-setting-cookie-as-third-party-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-blocked-from-setting-cookie-as-third-party-expected.txt 2018-07-14 01:07:38 UTC (rev 233830)
@@ -0,0 +1,19 @@
+Tests WebSocket Set-Cookie behavior for third-parties without existing cookies.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS document.location.host is "127.0.0.1:8000"
+
+Attempting to set third-party cookie 'foo' through cross-origin WebSocket handshake.
+
+Opening localhost third-party iframe to check its cookies.
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
+
+--------
+Frame: '<!--frame1-->'
+--------
+Cookies are:
Added: trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-blocked-from-setting-cookie-as-third-party.html (0 => 233830)
--- trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-blocked-from-setting-cookie-as-third-party.html (rev 0)
+++ trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-blocked-from-setting-cookie-as-third-party.html 2018-07-14 01:07:38 UTC (rev 233830)
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <script src=""
+ <script src=""
+ <script>
+ window.jsTestIsAsync = true;
+
+ async function runTest()
+ {
+ testRunner.dumpChildFramesAsText();
+ shouldBeEqualToString("document.location.host", "127.0.0.1:8000");
+ debug("<br>Attempting to set third-party cookie 'foo' through cross-origin WebSocket handshake.");
+ await setCookieUsingWebSocketFromHost("localhost");
+ let iframeElement = document.createElement("iframe");
+ iframeElement.src = ""
+ iframeElement._onload_ = finishJSTest;
+ debug("<br>Opening localhost third-party iframe to check its cookies.");
+ document.getElementById("output").appendChild(iframeElement);
+ }
+ </script>
+</head>
+<body>
+<div id="output"></div>
+<script>
+ description("Tests WebSocket Set-Cookie behavior for third-parties without existing cookies.");
+ runTest();
+</script>
+</body>
+</html>
Modified: trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior-expected.txt (233829 => 233830)
--- trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior-expected.txt 2018-07-14 00:04:30 UTC (rev 233829)
+++ trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior-expected.txt 2018-07-14 01:07:38 UTC (rev 233830)
@@ -3,12 +3,16 @@
On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
-Same origin WebSocket:
-PASS cookieValue is "foo=bar"
+Setting third-party cookie 'foo' through cross-origin WebSocket handshake and checking that it doesn't write first-party cookies.
+PASS cookieValue is ""
-Cross origin WebSocket:
-PASS cookieValue is ""
+Opening localhost third-party iframe to check its cookies.
PASS successfullyParsed is true
TEST COMPLETE
+
+--------
+Frame: '<!--frame1-->'
+--------
+Cookies are: setAsFirstParty = value foo = bar
Modified: trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior.html (233829 => 233830)
--- trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior.html 2018-07-14 00:04:30 UTC (rev 233829)
+++ trunk/LayoutTests/http/tests/websocket/tests/hybi/websocket-cookie-overwrite-behavior.html 2018-07-14 01:07:38 UTC (rev 233830)
@@ -2,6 +2,7 @@
<html>
<head>
<script src=""
+<script src=""
<script>
window.jsTestIsAsync = true;
@@ -9,18 +10,9 @@
function clearCookie()
{
- document.cookie = "foo=0; Max-Age=0"; // The key "foo" must match the key used in the WebSocket Set-Cookie header.
+ document.cookie = "foo=0; Max-Age=0; path=/"; // The key "foo" must match the key used in the WebSocket Set-Cookie header.
}
-function setCookieFromHost(host)
-{
- var promise = new Promise(resolve => {
- var websocket = new WebSocket(`ws://${host}:8880/websocket/tests/hybi/cookie?set`);
- websocket._onclose_ = () => resolve();
- });
- return promise;
-}
-
function echoCookie()
{
return document.cookie;
@@ -29,8 +21,8 @@
async function testSameOriginCookie()
{
clearCookie();
- document.cookie = "foo=should_be_overwritten_by_websocket_set_cookie";
- await setCookieFromHost("127.0.0.1");
+ document.cookie = "foo=should_be_overwritten_by_websocket_set_cookie; path=/";
+ await setCookieUsingWebSocketFromHost("127.0.0.1");
cookieValue = echoCookie();
shouldBeEqualToString("cookieValue", "foo=bar");
}
@@ -38,7 +30,7 @@
async function testCrossOriginCookie()
{
clearCookie();
- await setCookieFromHost("localhost");
+ await setCookieUsingWebSocketFromHost("localhost");
cookieValue = echoCookie();
shouldBeEmptyString("cookieValue");
}
@@ -45,11 +37,31 @@
async function runTests()
{
- debug("Same origin WebSocket:");
- await testSameOriginCookie();
- debug("<br>Cross origin WebSocket:");
- await testCrossOriginCookie();
- finishJSTest();
+ switch (document.location.hash) {
+ case "":
+ await testSameOriginCookie();
+ // Test that a third-party without pre-existing cookies does not write first-party cookies.
+ await testCrossOriginCookie();
+ // Navigate to localhost to set first-party cookie 'setAsFirstParty'.
+ document.location.href = ""
+ break;
+ case "#setCookieAsFirstParty":
+ await setCookie("setAsFirstParty", "value");
+ // Navigate back to 127.0.0.1 to test third-party cookie.
+ document.location.href = ""
+ break;
+ case "#didSetCookieAsFirstParty":
+ testRunner.dumpChildFramesAsText();
+ // Test that a third-party with a pre-existing cookie does not write first-party cookies.
+ debug("Setting third-party cookie 'foo' through cross-origin WebSocket handshake and checking that it doesn't write first-party cookies.");
+ await testCrossOriginCookie();
+ let iframeElement = document.createElement("iframe");
+ iframeElement.src = ""
+ iframeElement._onload_ = finishJSTest;
+ debug("<br>Opening localhost third-party iframe to check its cookies.");
+ document.body.appendChild(iframeElement);
+ break;
+ }
}
</script>
</head>
