PawletOS/cromite
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity
Files
create-pull-request/patch-cb3baf1
cromite/build/patches/Partitioning-all-cookies-by-top-frame-domain.patch
T
Carmelo Messina 0bf212cf9b Patches for v148
2026-05-19 10:48:25 +02:00

555 lines
28 KiB
Diff
Raw Permalink Blame History

From: uazo <uazo@users.noreply.github.com>
Date: Mon, 9 Jan 2023 12:02:05 +0000
Subject: Partitioning all cookies by top frame domain
Enables cookie partitioning by top frame etld, respecting the
user's possible wish to disable all third-party cookies.
Disabling the flag via the ui restores the normal mode, where
samesite=none first-party cookies are sent in third-party contexts.
License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
---
.../browser/chrome_content_browser_client.cc | 2 +-
.../extensions/api/cookies/cookies_helpers.cc | 4 +++
.../net/profile_network_context_service.cc | 12 +++----
.../privacy_sandbox_settings_delegate.cc | 1 +
...storage_access_grant_permission_context.cc | 13 ++++++++
.../strings/android/site_settings.grdp | 4 +--
.../core/browser/cookie_settings.cc | 6 ++--
.../core/common/cookie_settings_base.cc | 33 +------------------
...ioning-all-cookies-by-top-frame-domain.inc | 2 ++
...ioning-all-cookies-by-top-frame-domain.inc | 1 +
...ioning-all-cookies-by-top-frame-domain.inc | 1 +
...ioning-all-cookies-by-top-frame-domain.inc | 15 +++++++++
...ioning-all-cookies-by-top-frame-domain.inc | 1 +
net/cookies/canonical_cookie.cc | 5 ---
net/cookies/cookie_deletion_info.cc | 3 +-
net/cookies/cookie_monster.cc | 1 +
net/cookies/cookie_util.cc | 1 +
net/cookies/cookie_util.h | 4 +--
net/cookies/parsed_cookie.h | 6 +++-
.../sqlite/sqlite_persistent_cookie_store.cc | 8 +++++
net/url_request/url_request.cc | 3 +-
net/url_request/url_request_http_job.cc | 1 +
services/network/cookie_settings.cc | 6 ++--
services/network/cors/cors_url_loader.cc | 1 +
services/network/restricted_cookie_manager.cc | 6 ++++
services/network/url_loader.cc | 1 +
.../modules/cookie_store/cookie_init.idl | 2 +-
.../modules/cookie_store/cookie_store.cc | 3 ++
.../cookie_store_delete_options.idl | 2 +-
ui/webui/webui_allowlist.cc | 1 +
url/url_features.cc | 1 +
31 files changed, 88 insertions(+), 62 deletions(-)
create mode 100644 cromite_flags/components/content_settings/core/common/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
create mode 100644 cromite_flags/components/permissions/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
create mode 100644 cromite_flags/content/public/common/content_features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
create mode 100644 cromite_flags/net/base/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
create mode 100644 cromite_flags/services/network/public/cpp/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -3727,7 +3727,7 @@ bool ChromeContentBrowserClient::IsFullCookieAccessAllowed(
scoped_refptr<content_settings::CookieSettings> cookie_settings =
CookieSettingsFactory::GetForProfile(profile);
if (!cookie_settings) {
- return true;
+ return false;
}
return cookie_settings->IsFullCookieAccessAllowed(
url, storage_key.ToNetSiteForCookies(),
diff --git a/chrome/browser/extensions/api/cookies/cookies_helpers.cc b/chrome/browser/extensions/api/cookies/cookies_helpers.cc
--- a/chrome/browser/extensions/api/cookies/cookies_helpers.cc
+++ b/chrome/browser/extensions/api/cookies/cookies_helpers.cc
@@ -371,6 +371,10 @@ ToNetCookiePartitionKey(
bool CookieMatchesPartitionKeyCollection(
const net::CookiePartitionKeyCollection& cookie_partition_key_collection,
const net::CanonicalCookie& cookie) {
+ if (cookie_partition_key_collection.ContainsAllKeys() ||
+ cookie_partition_key_collection.IsEmpty()) {
+ return true;
+ }
if (!cookie.IsPartitioned()) {
return cookie_partition_key_collection.ContainsAllKeys() ||
cookie_partition_key_collection.IsEmpty();
diff --git a/chrome/browser/net/profile_network_context_service.cc b/chrome/browser/net/profile_network_context_service.cc
--- a/chrome/browser/net/profile_network_context_service.cc
+++ b/chrome/browser/net/profile_network_context_service.cc
@@ -1129,16 +1129,16 @@ ProfileNetworkContextService::CreateCookieManagerParams(
// UI to interact with SameSite cookies on accounts.google.com, which is used
// for displaying a list of available accounts on the NTP
// (chrome://new-tab-page), etc.
- out->secure_origin_cookies_allowed_schemes.push_back(
- content::kChromeUIScheme);
+ // out->secure_origin_cookies_allowed_schemes.push_back(
+ // content::kChromeUIScheme);
#if BUILDFLAG(ENABLE_EXTENSIONS_CORE)
// TODO(chlily): To be consistent with the content_settings version of
// CookieSettings, we should probably also add kExtensionScheme to the list of
// matching_scheme_cookies_allowed_schemes.
- out->third_party_cookies_allowed_schemes.push_back(
- extensions::kExtensionScheme);
- out->third_party_cookies_allowed_schemes.push_back(
- content::kChromeDevToolsScheme);
+ // out->third_party_cookies_allowed_schemes.push_back(
+ // extensions::kExtensionScheme);
+ // out->third_party_cookies_allowed_schemes.push_back(
+ // content::kChromeDevToolsScheme);
#endif
HostContentSettingsMap* host_content_settings_map =
diff --git a/chrome/browser/privacy_sandbox/privacy_sandbox_settings_delegate.cc b/chrome/browser/privacy_sandbox/privacy_sandbox_settings_delegate.cc
--- a/chrome/browser/privacy_sandbox/privacy_sandbox_settings_delegate.cc
+++ b/chrome/browser/privacy_sandbox/privacy_sandbox_settings_delegate.cc
@@ -144,6 +144,7 @@ bool PrivacySandboxSettingsDelegate::HasAppropriateTopicsConsent() const {
bool PrivacySandboxSettingsDelegate::PrivacySandboxRestrictedNoticeRequired()
const {
+ if ((true)) return false;
if ((true)) return true;
auto* identity_manager = IdentityManagerFactory::GetForProfile(profile_);
diff --git a/chrome/browser/storage_access_api/storage_access_grant_permission_context.cc b/chrome/browser/storage_access_api/storage_access_grant_permission_context.cc
--- a/chrome/browser/storage_access_api/storage_access_grant_permission_context.cc
+++ b/chrome/browser/storage_access_api/storage_access_grant_permission_context.cc
@@ -208,6 +208,7 @@ FederatedIdentityPermissionContext* IsAutograntViaFedCmAllowed(
const url::Origin& embedding_origin,
const net::SchemefulSite& embedding_site,
const net::SchemefulSite& requesting_site) {
+ if ((true)) return nullptr;
CHECK(browser_context);
if (!rfh->IsFeatureEnabled(
network::mojom::PermissionsPolicyFeature::kIdentityCredentialsGet)) {
@@ -462,6 +463,18 @@ void StorageAccessGrantPermissionContext::CheckForAutoGrantOrAutoDenial(
std::unique_ptr<permissions::PermissionRequestData> request_data,
permissions::BrowserPermissionCallback callback,
net::FirstPartySetMetadata metadata) {
+ if ((true)) {
+ // don't use implicit grants or heuristic, ask to user
+ PermissionContextBase::DecidePermission(std::move(request_data),
+ std::move(callback));
+ // to deny:
+ // NotifyPermissionSetInternal(request_data.id, request_data.requesting_origin,
+ // request_data.embedding_origin,
+ // std::move(callback),
+ // /*persist=*/true, CONTENT_SETTING_BLOCK,
+ // RequestOutcome::kDeniedByFirstPartySet);
+ return;
+ }
if (metadata.AreSitesInSameFirstPartySet()) {
switch (metadata.top_frame_entry()->site_type()) {
case net::SiteType::kPrimary:
diff --git a/components/browser_ui/strings/android/site_settings.grdp b/components/browser_ui/strings/android/site_settings.grdp
--- a/components/browser_ui/strings/android/site_settings.grdp
+++ b/components/browser_ui/strings/android/site_settings.grdp
@@ -53,7 +53,7 @@
Third-party cookies
</message>
<message name="IDS_THIRD_PARTY_COOKIES_LINK_ROW_SUB_LABEL_ENABLED" desc="1 of 3 possible states for the Third-party cookies setting. This text appears beneath the 'Third-party cookies' button label.">
- Third-party cookies are allowed
+ Third-party cookies are partitioned
</message>
<message name="IDS_THIRD_PARTY_COOKIES_LINK_ROW_SUB_LABEL_DISABLED" desc="3 of 3 possible states for the Third-party cookies setting. This text appears beneath the 'Third-party cookies' button label." >
Third-party cookies are blocked
@@ -685,7 +685,7 @@
A site you visit can embed content from other sites, for example, images, ads, and text. Cookies set by these other sites are called third-party cookies.
</message>
<message name="IDS_WEBSITE_SETTINGS_THIRD_PARTY_COOKIES_PAGE_ALLOW_RADIO_LABEL" desc="1 of 3 options the user has to configure cookies. See the cookies page for context: chrome://settings/cookies.">
- Allow third-party cookies
+ Partitions all cookies by top frame url
</message>
<message name="IDS_WEBSITE_SETTINGS_THIRD_PARTY_COOKIES_PAGE_BLOCK_RADIO_LABEL" desc="3 of 3 options the user has to configure cookies. See the cookies page for context: chrome://settings/cookies">
Block third-party cookies
diff --git a/components/content_settings/core/browser/cookie_settings.cc b/components/content_settings/core/browser/cookie_settings.cc
--- a/components/content_settings/core/browser/cookie_settings.cc
+++ b/components/content_settings/core/browser/cookie_settings.cc
@@ -115,6 +115,7 @@ void CookieSettings::SetTemporaryCookieGrantForHeuristic(
const GURL& first_party_url,
base::TimeDelta ttl,
bool use_schemeless_patterns) {
+ if ((true)) return;
if (url.is_empty() || first_party_url.is_empty()) {
return;
}
@@ -353,10 +354,7 @@ bool CookieSettings::ShouldBlockThirdPartyCookiesInternal() const {
}
bool CookieSettings::MitigationsEnabledFor3pcdInternal() const {
- return (base::FeatureList::IsEnabled(
- content_settings::features::kTrackingProtection3pcd) &&
- !is_incognito_) ||
- net::cookie_util::IsForceThirdPartyCookieBlockingEnabled();
+ return false;
}
void CookieSettings::OnContentSettingChanged(
diff --git a/components/content_settings/core/common/cookie_settings_base.cc b/components/content_settings/core/common/cookie_settings_base.cc
--- a/components/content_settings/core/common/cookie_settings_base.cc
+++ b/components/content_settings/core/common/cookie_settings_base.cc
@@ -575,42 +575,11 @@ CookieSettingsBase::DecideAccess(const GURL& url,
ThirdPartyCookieAllowMechanism::kAllowByGlobalSetting};
}
- if (IsThirdPartyCookiesAllowedScheme(first_party_url.GetScheme())) {
- return AllowAllCookies{ThirdPartyCookieAllowMechanism::kAllowByScheme};
- }
-
- // Site controlled mechanisms (ex: web APIs, deprecation trial):
- if (IsAllowedByTopLevelStorageAccessGrant(url, first_party_url, overrides)) {
- return AllowAllCookies{
- ThirdPartyCookieAllowMechanism::kAllowByTopLevelStorageAccess,
- IsAllowedByStorageAccessGrant(url, first_party_url, overrides)
- ? AllowedByStorageAccessType::kTopLevelAndStorageAccess
- : AllowedByStorageAccessType::kTopLevelOnly};
- }
if (IsAllowedByStorageAccessGrant(url, first_party_url, overrides)) {
return AllowAllCookies{
ThirdPartyCookieAllowMechanism::kAllowByStorageAccess,
AllowedByStorageAccessType::kStorageAccessOnly};
}
- if (IsAllowedBySandboxValue(url, first_party_url, overrides)) {
- return AllowAllCookies{
- ThirdPartyCookieAllowMechanism::kAllowBySandboxValue};
- }
-
- // Enterprise Policies:
- if (is_explicit_setting && setting_info.source == SettingSource::kPolicy) {
- return AllowAllCookies{ThirdPartyCookieAllowMechanism::
- kAllowByEnterprisePolicyCookieAllowedForUrls};
- }
-
- // Chrome controlled mechanisms (ex. 3PCD Metadata Grants):
- if (IsAllowedWithMetadata tpcd_metadata_info =
- IsAllowedBy3pcdMetadataGrantsSettings(url, first_party_url,
- overrides);
- tpcd_metadata_info.allowed) {
- return AllowAllCookies{TpcdMetadataSourceToAllowMechanism(
- tpcd_metadata_info.info.metadata.tpcd_metadata_rule_source())};
- }
if (is_explicit_setting) {
return AllowAllCookies{
@@ -646,7 +615,7 @@ CookieSettingsBase::GetCookieSettingInternal(
}
return CookieSettingWithMetadata{/*cookie_setting=*/CONTENT_SETTING_ALLOW,
/*allow_partitioned_cookies=*/true,
- /*is_explicit_setting=*/false,
+ /*is_explicit_setting=*/true,
/*third_party_cookie_allow_mechanism=*/
ThirdPartyCookieAllowMechanism::kNone,
/*is_third_party_request=*/false};
diff --git a/cromite_flags/components/content_settings/core/common/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc b/cromite_flags/components/content_settings/core/common/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/components/content_settings/core/common/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
@@ -0,0 +1,2 @@
+SET_CROMITE_FEATURE_DISABLED(kTrackingProtection3pcd);
+SET_CROMITE_FEATURE_DISABLED(kUserBypassUI);
diff --git a/cromite_flags/components/permissions/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc b/cromite_flags/components/permissions/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/components/permissions/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
@@ -0,0 +1 @@
+SET_CROMITE_FEATURE_ENABLED(kShowRelatedWebsiteSetsPermissionGrants);
diff --git a/cromite_flags/content/public/common/content_features_cc/Partitioning-all-cookies-by-top-frame-domain.inc b/cromite_flags/content/public/common/content_features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/content/public/common/content_features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
@@ -0,0 +1 @@
+// empty file
diff --git a/cromite_flags/net/base/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc b/cromite_flags/net/base/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/net/base/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
@@ -0,0 +1,15 @@
+SET_CROMITE_FEATURE_ENABLED(kCookieDomainRejectNonASCII);
+
+SET_CROMITE_FEATURE_DISABLED(kForceThirdPartyCookieBlocking);
+SET_CROMITE_FEATURE_DISABLED(kThirdPartyPartitionedStorageAllowedByDefault);
+
+SET_CROMITE_FEATURE_ENABLED(kCookieSameSiteConsidersRedirectChain);
+SET_CROMITE_FEATURE_ENABLED(kSameSiteDefaultChecksMethodRigorously);
+SET_CROMITE_FEATURE_ENABLED(kTimeLimitedInsecureCookies);
+
+SET_CROMITE_FEATURE_DISABLED(kTpcdMetadataGrants);
+SET_CROMITE_FEATURE_DISABLED(kTpcdMetadataStageControl);
+
+// Implement `Activate-Storage-Access: retry` header semantics
+// https://source.chromium.org/chromium/chromium/src/+/ca4775cd3edadea0c3e756e772c3afc766e46fd1
+// SET_CROMITE_FEATURE_DISABLED(kStorageAccessHeaderRetry);
diff --git a/cromite_flags/services/network/public/cpp/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc b/cromite_flags/services/network/public/cpp/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
new file mode 100644
--- /dev/null
+++ b/cromite_flags/services/network/public/cpp/features_cc/Partitioning-all-cookies-by-top-frame-domain.inc
@@ -0,0 +1 @@
+// intentionally empty
diff --git a/net/cookies/canonical_cookie.cc b/net/cookies/canonical_cookie.cc
--- a/net/cookies/canonical_cookie.cc
+++ b/net/cookies/canonical_cookie.cc
@@ -1077,11 +1077,6 @@ CanonicalCookie::IsCanonicalForFromStorage() const {
return Fail(CanonicalizationFailure::kEmptyNameWithHiddenPrefix);
}
- if (IsPartitioned() && !CookiePartitionKey::HasNonce(PartitionKey()) &&
- !SecureAttribute()) {
- return Fail(CanonicalizationFailure::kPartitionedInsecure);
- }
-
return Pass();
}
diff --git a/net/cookies/cookie_deletion_info.cc b/net/cookies/cookie_deletion_info.cc
--- a/net/cookies/cookie_deletion_info.cc
+++ b/net/cookies/cookie_deletion_info.cc
@@ -131,7 +131,8 @@ bool CookieDeletionInfo::Matches(const CanonicalCookie& cookie,
return false;
}
- if (cookie.IsPartitioned() &&
+ // opened bug https://bugs.chromium.org/p/chromium/issues/detail?id=1405772
+ if (cookie.IsPartitioned() && !cookie_partition_key_collection.IsEmpty() &&
!cookie_partition_key_collection.Contains(*cookie.PartitionKey())) {
return false;
}
diff --git a/net/cookies/cookie_monster.cc b/net/cookies/cookie_monster.cc
--- a/net/cookies/cookie_monster.cc
+++ b/net/cookies/cookie_monster.cc
@@ -2258,6 +2258,7 @@ size_t CookieMonster::GarbageCollectPartitionedCookies(
if (cookie_partition_it == partitioned_cookies_.end())
return num_deleted;
+ if ((false))
if (NumBytesInCookieMapForKey(*cookie_partition_it->second.get(), key) >
kPerPartitionDomainMaxCookieBytes ||
cookie_partition_it->second->count(key) > kPerPartitionDomainMaxCookies) {
diff --git a/net/cookies/cookie_util.cc b/net/cookies/cookie_util.cc
--- a/net/cookies/cookie_util.cc
+++ b/net/cookies/cookie_util.cc
@@ -828,6 +828,7 @@ bool IsCookiePartitionedValid(
base::optional_ref<const GURL> url,
bool secure,
base::optional_ref<const CookiePartitionKey> partition_key) {
+ if ((true)) return true;
if (!partition_key || CookiePartitionKey::HasNonce(partition_key)) {
return true;
}
diff --git a/net/cookies/cookie_util.h b/net/cookies/cookie_util.h
--- a/net/cookies/cookie_util.h
+++ b/net/cookies/cookie_util.h
@@ -112,7 +112,7 @@ enum class StorageAccessStatusOutcome {
enum class ActivateStorageAccessLoadOutcome {
// Applies when the `Activate-Storage-Access` header behavior is not enabled
// under the existing feature flags or content settings.
- // kFailureHeaderDisabled = 0, // Deprecated (feature is always enabled).
+ kFailureHeaderDisabled = 0, // Deprecated (feature is always enabled).
// Applies when a response includes the `Activate-Storage-Access: load`
// header, but its corresponding request either has an omitted storage access
// status, or has a storage access status of `none`.
@@ -133,7 +133,7 @@ enum class ActivateStorageAccessLoadOutcome {
enum class ActivateStorageAccessRetryOutcome {
// Applies when the `Activate-Storage-Access` header behavior is not enabled
// under the existing feature flags or content settings.
- // kFailureHeaderDisabled = 0, // Deprecated (feature is always enabled).
+ kFailureHeaderDisabled = 0, // Deprecated (feature is always enabled).
// Applies when a response includes a well-formed
// `Activate-Storage-Access: retry; ..." header, but the corresponding
// request's `Sec-Fetch-Storage-Access` header is not `inactive`.
diff --git a/net/cookies/parsed_cookie.h b/net/cookies/parsed_cookie.h
--- a/net/cookies/parsed_cookie.h
+++ b/net/cookies/parsed_cookie.h
@@ -14,6 +14,7 @@
#include "base/compiler_specific.h"
#include "base/functional/function_ref.h"
+#include "net/base/features.h"
#include "net/base/net_export.h"
#include "net/cookies/cookie_constants.h"
@@ -85,7 +86,10 @@ class NET_EXPORT ParsedCookie {
// attribute value.
std::pair<CookieSameSite, CookieSameSiteString> SameSite() const;
CookiePriority Priority() const;
- bool IsPartitioned() const { return partitioned_index_ != 0; }
+ bool IsPartitioned() const {
+ if ((true)) return true;
+ return partitioned_index_ != 0;
+ }
bool HasInternalHtab() const { return internal_htab_; }
std::optional<NamelessCookieLineParseType>
NamelessCookieLineParseTypeForMetrics() const {
diff --git a/net/extras/sqlite/sqlite_persistent_cookie_store.cc b/net/extras/sqlite/sqlite_persistent_cookie_store.cc
--- a/net/extras/sqlite/sqlite_persistent_cookie_store.cc
+++ b/net/extras/sqlite/sqlite_persistent_cookie_store.cc
@@ -830,6 +830,14 @@ bool SQLitePersistentCookieStore::Backend::DoInitializeDatabase() {
if (!restore_old_session_cookies_)
DeleteSessionCookiesOnStartup();
+ // Since there is no automatic transition to partitioned cookies
+ // (the information would be missing), we clean the current ones
+ // present because they would otherwise be sent in third-party contexts
+ // even if the flag is active.
+ if (!db()->Execute("DELETE FROM cookies WHERE top_frame_site_key = ''")) {
+ LOG(WARNING) << "Unable to delete unpartitioned cookies.";
+ }
+
return true;
}
diff --git a/net/url_request/url_request.cc b/net/url_request/url_request.cc
--- a/net/url_request/url_request.cc
+++ b/net/url_request/url_request.cc
@@ -1413,8 +1413,7 @@ StorageAccessStatusCache URLRequest::CalculateStorageAccessStatus() const {
// `deferred_redirect_info_` that has to be used when calculating new storage
// access status.
std::optional<net::cookie_util::StorageAccessStatus> storage_access_status =
- network_delegate()->GetStorageAccessStatus(*this,
- deferred_redirect_info_);
+ std::nullopt; // disable storage access headers
base::UmaHistogramEnumeration(
"API.StorageAccessHeader.StorageAccessStatusOutcome",
storage_access_status
diff --git a/net/url_request/url_request_http_job.cc b/net/url_request/url_request_http_job.cc
--- a/net/url_request/url_request_http_job.cc
+++ b/net/url_request/url_request_http_job.cc
@@ -1654,6 +1654,7 @@ bool URLRequestHttpJob::NeedsRetryWithStorageAccess() {
auto determine_storage_access_retry_outcome =
[&]() -> cookie_util::ActivateStorageAccessRetryOutcome {
using enum cookie_util::ActivateStorageAccessRetryOutcome;
+ if ((true)) return kFailureHeaderDisabled; // disable storage access headers
if (!ShouldAddCookieHeader() ||
request_->storage_access_status() !=
cookie_util::StorageAccessStatus::kInactive ||
diff --git a/services/network/cookie_settings.cc b/services/network/cookie_settings.cc
--- a/services/network/cookie_settings.cc
+++ b/services/network/cookie_settings.cc
@@ -45,8 +45,7 @@ namespace network {
namespace {
bool ShouldApply3pcdRelatedReasons(const net::CanonicalCookie& cookie) {
- return cookie.SameSite() == net::CookieSameSite::NO_RESTRICTION &&
- !cookie.IsPartitioned();
+ return cookie.SameSite() == net::CookieSameSite::NO_RESTRICTION;
}
bool IsValidType(ContentSettingsType type) {
@@ -122,8 +121,7 @@ bool IsOriginOpaqueHttpOrHttps(
// static
bool CookieSettings::IsCookieAllowed(const net::CanonicalCookie& cookie,
const CookieSettingWithMetadata& setting) {
- return IsAllowed(setting.cookie_setting()) ||
- (cookie.IsPartitioned() && setting.allow_partitioned_cookies());
+ return IsAllowed(setting.cookie_setting());
}
// static
diff --git a/services/network/cors/cors_url_loader.cc b/services/network/cors/cors_url_loader.cc
--- a/services/network/cors/cors_url_loader.cc
+++ b/services/network/cors/cors_url_loader.cc
@@ -917,6 +917,7 @@ void CorsURLLoader::StartRequest() {
}
if (request_.credentials_mode == mojom::CredentialsMode::kInclude &&
+ ((false)) && // storage access headers disabled by default
GetStorageAccessStatus() ==
net::cookie_util::StorageAccessStatus::kInactive) {
// Lower layers will add the Sec-Fetch-Storage-Access header, and the
diff --git a/services/network/restricted_cookie_manager.cc b/services/network/restricted_cookie_manager.cc
--- a/services/network/restricted_cookie_manager.cc
+++ b/services/network/restricted_cookie_manager.cc
@@ -987,6 +987,12 @@ void RestrictedCookieManager::SetCookieFromString(
shared_memory_region = GetAndPrepareSharedMemoryRegion(url);
}
+ // https://bugs.chromium.org/p/chromium/issues/detail?id=911299
+ bool site_for_cookies_ok =
+ BoundSiteForCookies().IsEquivalent(site_for_cookies);
+ bool top_frame_origin_ok = top_frame_origin == BoundTopFrameOrigin();
+ if (!site_for_cookies_ok || !top_frame_origin_ok) return;
+
net::CookieInclusionStatus status;
std::unique_ptr<net::CanonicalCookie> parsed_cookie =
net::CanonicalCookie::Create(
diff --git a/services/network/url_loader.cc b/services/network/url_loader.cc
--- a/services/network/url_loader.cc
+++ b/services/network/url_loader.cc
@@ -2638,6 +2638,7 @@ bool URLLoader::ShouldSetLoadWithStorageAccess() const {
auto determine_storage_access_load_outcome =
[&]() -> net::cookie_util::ActivateStorageAccessLoadOutcome {
+ if ((true)) return net::cookie_util::ActivateStorageAccessLoadOutcome::kFailureHeaderDisabled;
if (!url_request_->storage_access_status().IsSet()) {
url_request_->set_storage_access_status(
url_request_->CalculateStorageAccessStatus());
diff --git a/third_party/blink/renderer/modules/cookie_store/cookie_init.idl b/third_party/blink/renderer/modules/cookie_store/cookie_init.idl
--- a/third_party/blink/renderer/modules/cookie_store/cookie_init.idl
+++ b/third_party/blink/renderer/modules/cookie_store/cookie_init.idl
@@ -17,6 +17,6 @@ dictionary CookieInit {
USVString path = "/";
DOMHighResTimeStamp? expires = null;
CookieSameSite sameSite = "strict";
- boolean partitioned = false;
+ boolean partitioned = true;
[RuntimeEnabled=CookieStoreAPIMaxAge] long long? maxAge;
};
diff --git a/third_party/blink/renderer/modules/cookie_store/cookie_store.cc b/third_party/blink/renderer/modules/cookie_store/cookie_store.cc
--- a/third_party/blink/renderer/modules/cookie_store/cookie_store.cc
+++ b/third_party/blink/renderer/modules/cookie_store/cookie_store.cc
@@ -407,6 +407,7 @@ ScriptPromise<IDLUndefined> CookieStore::set(ScriptState* script_state,
CookieInit* set_options = CookieInit::Create();
set_options->setName(name);
set_options->setValue(value);
+ set_options->setPartitioned(true);
return set(script_state, set_options, exception_state);
}
@@ -431,6 +432,7 @@ ScriptPromise<IDLUndefined> CookieStore::Delete(
set_options->setName(stripped_name);
set_options->setValue(stripped_name.empty() ? "deleted" : "");
set_options->setExpires(0);
+ set_options->setPartitioned(true);
return DoWrite(script_state, set_options, exception_state);
}
@@ -447,6 +449,7 @@ ScriptPromise<IDLUndefined> CookieStore::Delete(
set_options->setPath(options->path());
set_options->setSameSite(V8CookieSameSite::Enum::kStrict);
set_options->setPartitioned(options->partitioned());
+ set_options->setPartitioned(true);
return DoWrite(script_state, set_options, exception_state);
}
diff --git a/third_party/blink/renderer/modules/cookie_store/cookie_store_delete_options.idl b/third_party/blink/renderer/modules/cookie_store/cookie_store_delete_options.idl
--- a/third_party/blink/renderer/modules/cookie_store/cookie_store_delete_options.idl
+++ b/third_party/blink/renderer/modules/cookie_store/cookie_store_delete_options.idl
@@ -8,5 +8,5 @@ dictionary CookieStoreDeleteOptions {
required USVString name;
USVString? domain = null;
USVString path = "/";
- boolean partitioned = false;
+ boolean partitioned = true;
};
diff --git a/ui/webui/webui_allowlist.cc b/ui/webui/webui_allowlist.cc
--- a/ui/webui/webui_allowlist.cc
+++ b/ui/webui/webui_allowlist.cc
@@ -75,6 +75,7 @@ void WebUIAllowlist::RegisterAutoGrantedPermissions(
void WebUIAllowlist::RegisterAutoGrantedThirdPartyCookies(
const url::Origin& top_level_origin,
const std::vector<ContentSettingsPattern>& origin_patterns) {
+ if ((true)) return;
DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
diff --git a/url/url_features.cc b/url/url_features.cc
--- a/url/url_features.cc
+++ b/url/url_features.cc
@@ -9,6 +9,7 @@ namespace url {
BASE_FEATURE(kDisallowSpaceCharacterInURLHostParsing,
base::FEATURE_DISABLED_BY_DEFAULT);
+SET_CROMITE_FEATURE_ENABLED(kDisallowSpaceCharacterInURLHostParsing);
bool IsDisallowingSpaceCharacterInURLHostParsing() {
// If the FeatureList isn't available yet, fall back to the feature's default
--
Reference in New Issue View Git Blame Copy Permalink