COOP: test COOP popup from a CSP-sandboxed popup

[zcorpan]

Part of #18354.

[annevk]

It'd be interesting to also navigate the CSP popup to a COOP document as that should work (since it's the document that's sandboxed and not the browsing context).

[annevk]

Is this meant to be the same origin?

[zcorpan]

Hmm, yes, but I realize now that get_host_info isn't needed, it can just be a relative URL instead.

[ParisMeuleman]

It'd be interesting to also navigate the CSP popup to a COOP document as that should work (since it's the document that's sandboxed and not the browsing context).

Thanks for that comment, it helped clarify a doubt in Chromium's implem: https://crrev.com/c/1995268/3/content/browser/cross_origin_opener_policy_browsertest.cc

Hence, I think adding this test is a good idea!

cc: @camillelamy @ArthurSonzogni @hemeryar

[zcorpan]

@annevk

It'd be interesting to also navigate the CSP popup to a COOP document as that should work (since it's the document that's sandboxed and not the browsing context).

Now added in 1fc0b75

[zcorpan]

Similarly to #20873 (comment) , changing common.js makes stability checks time out.

[annevk]

Since you have a reference to the popup and it won't be replaced, can't you assert something about the popup? That it's not closed and that it's document is no longer same-origin? I guess that doesn't work for the case where allow-same-origin isn't set.

[zcorpan]

But closed should be true after the navigation? The CSP sandbox doesn't have COOP, and then when navigating to the COOP document the browsing context is swapped.

The "is no longer same origin" is interesting. Should it not be same-origin for any of these 2 cases?

[annevk]

I misread the test.

[annevk]

This looks good at a high-level, but seems like it still needs conflicts resolved.

[zcorpan]

I added a same-origin check, and have different results between Firefox and Chrome:

Test	Firefox	Chrome
CSP: sandbox allow-popups allow-scripts allow-same-origin; CSP sandbox popup navigate to Cross-Origin-Opener-Policy document should work	Fail	Fail
CSP: sandbox allow-popups allow-scripts; CSP sandbox popup navigate to Cross-Origin-Opener-Policy document should work	Pass	Fail

I'm not sure what is right. Should the popup after navigation (which causes a BC swap) not be same-origin with the opener?

[annevk]

Looking at html/cross-origin-opener-policy/coop-csp-sandbox-navigate.https.html I think Firefox is correct. In particular assert_throws_dom("SecurityError", () => { popup.document; }, 'same-origin check'); should not throw when the CSP popup has allow-same-origin. Note that popup cannot have a reference to the document being navigated to as it's already closed (and replaced by a new thing you cannot have a reference to by design) at that point.

[zcorpan]

@annevk thank you for explaining that, I had misremembered how Window/WindowProxy works on navigation. popup is the old window which still has the CSP sandbox applied. I've fixed the test and added comments.

[annevk]

Will you file a bug against Chrome? It seems they made a mistake somewhere (or you/I analyzed incorrectly).

[zcorpan]

Of course: https://bugs.chromium.org/p/chromium/issues/detail?id=1122582

[zcorpan]

I'll admin-merge this, see #21111 (comment)