From: uazo Date: Sun, 5 Nov 2023 18:05:19 +0000 Subject: Disable Service and Shared workers on 3P iframe Disabled by default due https://bugs.chromium.org/p/chromium/issues/detail?id=1147281 Workers can be reenabled per top-site-url using "Allow 3P Cookies" ("Block 3P Cookies" in ui to off) in site settings License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html --- .../content_settings_utils.cc | 39 +++++-------------- 1 file changed, 10 insertions(+), 29 deletions(-) diff --git a/components/embedder_support/content_settings_utils.cc b/components/embedder_support/content_settings_utils.cc --- a/components/embedder_support/content_settings_utils.cc +++ b/components/embedder_support/content_settings_utils.cc @@ -30,16 +30,7 @@ namespace { // allowed by default, and access is only blocked due to general third-party // cookie blocking (and not due to a user specified pattern) then storage // access can be allowed. -bool PartitionedStorageByDefaultAllowed( - const content_settings::CookieSettingsBase::CookieSettingWithMetadata& - cookie_settings) { - return base::FeatureList::IsEnabled( - net::features::kThirdPartyStoragePartitioning) && - base::FeatureList::IsEnabled( - net::features::kThirdPartyPartitionedStorageAllowedByDefault) && - cookie_settings.BlockedByThirdPartyCookieBlocking(); -} - +// (^^^ removed code) bool AllowWorkerStorageAccess( StorageType storage_type, const GURL& url, @@ -56,17 +47,11 @@ bool AllowWorkerStorageAccess( net::CookieSettingOverrides(), storage_key.ToCookiePartitionKey(), &cookie_settings_metadata); - if (!allow && PartitionedStorageByDefaultAllowed(cookie_settings_metadata)) { - allow = true; - } - // Allow storage when --test-third-party-cookie-phaseout is used, but ensure // that only partitioned storage is available. This developer flag is meant to // simulate Chrome's behavior when 3P cookies are turned down to help // developers test their site. - if (!allow && net::cookie_util::IsForceThirdPartyCookieBlockingEnabled()) { - allow = true; - } + // (^^^^ removed code) for (const auto& it : render_frames) { auto* rfh = content::RenderFrameHost::FromID(it); @@ -126,19 +111,16 @@ content::AllowServiceWorkerResult AllowServiceWorker( &cookie_settings_metadata); - if (!allow_cookies && - PartitionedStorageByDefaultAllowed(cookie_settings_metadata)) { - allow_cookies = true; + if (!allow_cookies && (!top_frame_origin.has_value() + || !top_frame_origin->IsSameOriginWith(scope))) { + return content::AllowServiceWorkerResult::No(); } // Allow storage when --test-third-party-cookie-phaseout is used, but ensure // that only partitioned storage is available. This developer flag is meant to // simulate Chrome's behavior when 3P cookies are turned down to help // developers test their site. - if (!allow_cookies && - net::cookie_util::IsForceThirdPartyCookieBlockingEnabled()) { - allow_cookies = true; - } + // (^^^^ removed code) return content::AllowServiceWorkerResult::FromPolicy(!allow_javascript, !allow_cookies); @@ -174,17 +156,16 @@ bool AllowSharedWorker( net::CookieSettingOverrides(), cookie_partition_key, &cookie_settings_metadata); - if (!allow && PartitionedStorageByDefaultAllowed(cookie_settings_metadata)) { - allow = true; + if (!allow && (!top_frame_origin.has_value() + || !top_frame_origin->IsSameOriginWith(worker_url))) { + return false; } // Allow storage when --test-third-party-cookie-phaseout is used, but ensure // that only partitioned storage is available. This developer flag is meant to // simulate Chrome's behavior when 3P cookies are turned down to help // developers test their site. - if (!allow && net::cookie_util::IsForceThirdPartyCookieBlockingEnabled()) { - allow = true; - } + // (^^^^ removed code) content_settings::PageSpecificContentSettings::SharedWorkerAccessed( render_process_id, render_frame_id, worker_url, name, storage_key, --