0

iwa: Remove --isolated-app-origins flag

This flag is deprecated now that IWAs are properly supported by dPWA
infrastructure.

Bug: 1412210
Change-Id: Iab2183e366ae682aa2abc2348b5bb37413e514e5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4219393
Commit-Queue: Robbie McElrath <rmcelrath@chromium.org>
Reviewed-by: Yann Dago <ydago@chromium.org>
Code-Coverage: Findit <findit-for-me@appspot.gserviceaccount.com>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1102400}
This commit is contained in:
Robbie McElrath
2023-02-07 21:59:13 +00:00
committed by Chromium LUCI CQ
parent 423a131e9b
commit 4e8596dd9e
26 changed files with 33 additions and 244 deletions

@ -4179,9 +4179,6 @@ const FeatureEntry kFeatureEntries[] = {
{"isolate-origins", flag_descriptions::kIsolateOriginsName,
flag_descriptions::kIsolateOriginsDescription, kOsAll,
ORIGIN_LIST_VALUE_TYPE(switches::kIsolateOrigins, "")},
{"isolated-app-origins", flag_descriptions::kIsolatedAppOriginsName,
flag_descriptions::kIsolatedAppOriginsDescription, kOsAll,
ORIGIN_LIST_VALUE_TYPE(switches::kIsolatedAppOrigins, "")},
{about_flags::kSiteIsolationTrialOptOutInternalName,
flag_descriptions::kSiteIsolationOptOutName,
flag_descriptions::kSiteIsolationOptOutDescription, kOsAll,

@ -2448,8 +2448,7 @@ void ChromeContentBrowserClient::PersistIsolatedOrigin(
bool ChromeContentBrowserClient::ShouldUrlUseApplicationIsolationLevel(
content::BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) {
const GURL& url) {
#if BUILDFLAG(ENABLE_EXTENSIONS)
if (!content::IsolatedWebAppsPolicy::AreIsolatedWebAppsEnabled(

@ -236,8 +236,7 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
override;
bool ShouldUrlUseApplicationIsolationLevel(
content::BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) override;
const GURL& url) override;
bool IsIsolatedContextAllowedForUrl(content::BrowserContext* browser_context,
const GURL& lock_url) override;
bool IsGetDisplayMediaSetSelectAllScreensAllowed(

@ -856,8 +856,7 @@ TEST_F(ChromeContentBrowserClientStoragePartitionTest,
EXPECT_EQ(CreateDefaultStoragePartitionConfig(), config);
EXPECT_FALSE(
test_content_browser_client.ShouldUrlUseApplicationIsolationLevel(
&profile_, GURL(kHttpsScope),
/*origin_matches_flag=*/false));
&profile_, GURL(kHttpsScope)));
}
TEST_F(ChromeContentBrowserClientStoragePartitionTest,
@ -866,10 +865,9 @@ TEST_F(ChromeContentBrowserClientStoragePartitionTest,
base::test::ScopedFeatureList scoped_feature_list;
scoped_feature_list.InitAndEnableFeature(features::kIsolatedWebApps);
EXPECT_THAT(
test_content_browser_client.ShouldUrlUseApplicationIsolationLevel(
&profile_, GURL(kIsolatedAppScope), /*origin_matches_flag=*/false),
IsTrue());
EXPECT_THAT(test_content_browser_client.ShouldUrlUseApplicationIsolationLevel(
&profile_, GURL(kIsolatedAppScope)),
IsTrue());
}
TEST_F(
@ -881,8 +879,7 @@ TEST_F(
scoped_feature_list.InitAndDisableFeature(features::kIsolatedWebApps);
EXPECT_THAT(test_content_browser_client.ShouldUrlUseApplicationIsolationLevel(
&profile_, GURL(kIsolatedAppScope),
/*origin_matches_flag=*/false),
&profile_, GURL(kIsolatedAppScope)),
IsFalse());
}
@ -894,8 +891,7 @@ TEST_F(ChromeContentBrowserClientStoragePartitionTest,
scoped_feature_list.InitAndEnableFeature(features::kIsolatedWebApps);
EXPECT_THAT(test_content_browser_client.ShouldUrlUseApplicationIsolationLevel(
&profile_, GURL(kHttpsScope),
/*origin_matches_flag=*/false),
&profile_, GURL(kHttpsScope)),
IsFalse());
}
@ -909,8 +905,7 @@ TEST_F(ChromeContentBrowserClientStoragePartitionTest,
EXPECT_EQ(CreateDefaultStoragePartitionConfig(), config);
EXPECT_FALSE(
test_content_browser_client.ShouldUrlUseApplicationIsolationLevel(
&profile_, GURL(kIsolatedAppScope),
/*origin_matches_flag=*/false));
&profile_, GURL(kIsolatedAppScope)));
}
TEST_F(ChromeContentBrowserClientStoragePartitionTest,
@ -918,9 +913,6 @@ TEST_F(ChromeContentBrowserClientStoragePartitionTest,
base::test::ScopedFeatureList scoped_feature_list;
scoped_feature_list.InitAndEnableFeature(features::kIsolatedWebApps);
base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
switches::kIsolatedAppOrigins, kIsolatedAppScope);
TestChromeContentBrowserClient test_content_browser_client;
content::StoragePartitionConfig config =
test_content_browser_client.GetStoragePartitionConfigForSite(
@ -933,8 +925,7 @@ TEST_F(ChromeContentBrowserClientStoragePartitionTest,
/*in_memory=*/false);
EXPECT_EQ(expected_config, config);
EXPECT_TRUE(test_content_browser_client.ShouldUrlUseApplicationIsolationLevel(
&profile_, GURL(kIsolatedAppScope),
/*origin_matches_flag=*/false));
&profile_, GURL(kIsolatedAppScope)));
}
#endif // BUILDFLAG(ENABLE_EXTENSIONS)

@ -4454,11 +4454,6 @@
// only applies to some sites.
"expiry_milestone": 122
},
{
"name": "isolated-app-origins",
"owners": [ "peletskyi@google.com", "desktop-pwas-team@google.com" ],
"expiry_milestone": 115
},
{
"name": "isolation-by-default",
"owners": [ "mkwst", "clamy" ],

@ -763,12 +763,6 @@ const char kDisruptiveNotificationPermissionRevocationDescription[] =
"disruptive notifications unless the permission was granted through a "
"prompt that informed the user about this possibility.";
const char kIsolatedAppOriginsName[] = "Isolated App Origins";
const char kIsolatedAppOriginsDescription[] =
"Enables Isolated App policy enforcement and related APIs (e.g. Direct "
"Sockets API) for development purposes for a set of origins, specified as "
"a comma-separated list.";
const char kDoubleBufferCompositingName[] = "Double buffered compositing";
const char kDoubleBufferCompositingDescription[] =
"Use double buffer for compositing (instead of triple-buffering). "

@ -556,9 +556,6 @@ extern const char kDeviceForceScheduledRebootDescription[];
extern const char kDevicePostureName[];
extern const char kDevicePostureDescription[];
extern const char kIsolatedAppOriginsName[];
extern const char kIsolatedAppOriginsDescription[];
extern const char kEnablePreinstalledWebAppDuplicationFixerName[];
extern const char kEnablePreinstalledWebAppDuplicationFixerDescription[];

@ -142,11 +142,6 @@ static const char* kBadFlags[] = {
// A flag to bypass the WebHID blocklist for testing purposes.
switches::kDisableHidBlocklist,
// This flag enables restricted APIs (which unlock capabilities
// with a high potential for security / privacy abuse) for specified
// origins.
switches::kIsolatedAppOrigins,
// This flag tells Chrome to automatically install an Isolated Web App in
// developer mode. The flag should contain the path to an unsigned Web
// Bundle containing the IWA. Paths will be resolved relative to the

@ -296,10 +296,8 @@ const char kNonAppHost[] = "other.com";
class IsolatedWebAppContentBrowserClient : public ContentBrowserClient {
public:
bool ShouldUrlUseApplicationIsolationLevel(
BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) override {
bool ShouldUrlUseApplicationIsolationLevel(BrowserContext* browser_context,
const GURL& url) override {
return url.host() == kAppHost;
}
};

@ -162,8 +162,7 @@ IsolatedWebAppContentBrowserClient::IsolatedWebAppContentBrowserClient(
bool IsolatedWebAppContentBrowserClient::ShouldUrlUseApplicationIsolationLevel(
BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) {
const GURL& url) {
return isolated_app_origin_ == url::Origin::Create(url);
}

@ -177,8 +177,7 @@ class IsolatedWebAppContentBrowserClient : public ShellContentBrowserClient {
const url::Origin& isolated_app_origin);
bool ShouldUrlUseApplicationIsolationLevel(BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) override;
const GURL& url) override;
absl::optional<blink::ParsedPermissionsPolicy>
GetPermissionsPolicyForIsolatedWebApp(

@ -40,10 +40,8 @@ class IsolatedWebAppContentBrowserClient : public ContentBrowserClient {
app_origin_ = url::Origin::Create(app_url);
}
bool ShouldUrlUseApplicationIsolationLevel(
BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) override {
bool ShouldUrlUseApplicationIsolationLevel(BrowserContext* browser_context,
const GURL& url) override {
return url.host() == kAppHost;
}

@ -39,10 +39,8 @@ static constexpr RenderFrameHost::WebExposedIsolationLevel
class IsolatedWebAppContentBrowserClient : public ContentBrowserClient {
public:
bool ShouldUrlUseApplicationIsolationLevel(
BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) override {
bool ShouldUrlUseApplicationIsolationLevel(BrowserContext* browser_context,
const GURL& url) override {
return url.host() == GURL(kAppUrl).host();
}

@ -704,10 +704,8 @@ class ScopedIsolatedAppBrowserClient : public ContentBrowserClient {
SetBrowserClientForTesting(old_client_);
}
bool ShouldUrlUseApplicationIsolationLevel(
BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) override {
bool ShouldUrlUseApplicationIsolationLevel(BrowserContext* browser_context,
const GURL& url) override {
return url.host() == isolated_host_;
}

@ -5534,10 +5534,8 @@ class IsolatedWebAppContentBrowserClient : public ContentBrowserClient {
public:
IsolatedWebAppContentBrowserClient() = default;
bool ShouldUrlUseApplicationIsolationLevel(
BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) override {
bool ShouldUrlUseApplicationIsolationLevel(BrowserContext* browser_context,
const GURL& url) override {
return url.host() == kAppHost;
}
};

@ -3389,7 +3389,6 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
switches::kFullMemoryCrashReport,
switches::kGaiaUrl,
switches::kIPCConnectionTimeout,
switches::kIsolatedAppOrigins,
switches::kLogBestEffortTasks,
switches::kLogFile,
switches::kLoggingLevel,

@ -69,116 +69,10 @@ TEST(SiteIsolationPolicyTest, DisableSiteIsolationForPolicySwitch) {
class ApplicationIsolationEnablingBrowserClient : public ContentBrowserClient {
public:
bool ShouldUrlUseApplicationIsolationLevel(
BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) override {
return origin_matches_flag || url.SchemeIs("isolated-app");
bool ShouldUrlUseApplicationIsolationLevel(BrowserContext* browser_context,
const GURL& url) override {
return url.SchemeIs("isolated-app");
}
};
class SiteIsolationPolicyIsolatedApplicationTest : public testing::Test {
public:
void SetUp() override {
SiteIsolationPolicy::DisableFlagCachingForTesting();
old_client_ = SetBrowserClientForTesting(&test_client_);
}
void TearDown() override { SetBrowserClientForTesting(old_client_); }
private:
BrowserTaskEnvironment task_environment_;
ApplicationIsolationEnablingBrowserClient test_client_;
raw_ptr<ContentBrowserClient> old_client_;
};
TEST_F(SiteIsolationPolicyIsolatedApplicationTest, Disabled) {
GURL origin_url("https://www.bar.com");
EXPECT_FALSE(SiteIsolationPolicy::ShouldUrlUseApplicationIsolationLevel(
/*browser_context=*/nullptr, origin_url));
}
TEST_F(SiteIsolationPolicyIsolatedApplicationTest, MatchingOrigin) {
base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
switches::kIsolatedAppOrigins, "https://www.foo.com,https://www.bar.com");
GURL origin_url("https://www.bar.com");
EXPECT_TRUE(SiteIsolationPolicy::ShouldUrlUseApplicationIsolationLevel(
/*browser_context=*/nullptr, origin_url));
}
TEST_F(SiteIsolationPolicyIsolatedApplicationTest, NotMatchingOrigin) {
base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
switches::kIsolatedAppOrigins, "https://www.foo.com,https://www.bar.com");
GURL origin_url("https://www.not-allowed.com");
EXPECT_FALSE(SiteIsolationPolicy::ShouldUrlUseApplicationIsolationLevel(
/*browser_context=*/nullptr, origin_url));
}
TEST_F(SiteIsolationPolicyIsolatedApplicationTest, InvalidOrigin) {
std::string origin_string = "hdsdhdfhdh";
base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
switches::kIsolatedAppOrigins, origin_string);
// Fails to convert into an origin, which leads to an empty origin.
GURL origin_url(origin_string);
EXPECT_FALSE(SiteIsolationPolicy::ShouldUrlUseApplicationIsolationLevel(
/*browser_context=*/nullptr, origin_url));
}
TEST_F(SiteIsolationPolicyIsolatedApplicationTest, FlagTypo) {
// Verifies user typo in the origin for the command line flag
// doesn't accidentally allow all origins.
std::string invalid_origin_string = "htps://www.app.com";
std::string valid_origin_string = "https://www.app.com";
base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
switches::kIsolatedAppOrigins, invalid_origin_string);
GURL valid_origin_url(valid_origin_string);
EXPECT_FALSE(SiteIsolationPolicy::ShouldUrlUseApplicationIsolationLevel(
/*browser_context=*/nullptr, valid_origin_url));
}
TEST_F(SiteIsolationPolicyIsolatedApplicationTest, PortRemoved) {
// Verifies that ports given to kIsolatedAppOrigins are ignored, and all
// ports on the provided scheme+hostname pair will gain restricted API access.
std::string origin_string = "https://app.com:1234";
base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
switches::kIsolatedAppOrigins, origin_string);
EXPECT_TRUE(SiteIsolationPolicy::ShouldUrlUseApplicationIsolationLevel(
/*browser_context=*/nullptr, GURL(origin_string)));
EXPECT_TRUE(SiteIsolationPolicy::ShouldUrlUseApplicationIsolationLevel(
/*browser_context=*/nullptr, GURL("https://app.com")));
EXPECT_TRUE(SiteIsolationPolicy::ShouldUrlUseApplicationIsolationLevel(
/*browser_context=*/nullptr, GURL("https://app.com:443")));
}
TEST_F(
SiteIsolationPolicyIsolatedApplicationTest,
ShouldSchemeUseApplicationIsolationLevelOverridesIsolatedAppOriginsFlag) {
base::CommandLine::ForCurrentProcess()->RemoveSwitch(
switches::kIsolatedAppOrigins);
// For the format of isolated app identifier see
// https://github.com/WICG/isolated-web-apps/blob/main/Scheme.md
EXPECT_TRUE(SiteIsolationPolicy::ShouldUrlUseApplicationIsolationLevel(
/*browser_context=*/nullptr,
GURL(
R"(isolated-app://aerugqztij5biqquuk3mfwpsaibuegaqcitgfchwuosuofdjabzqaaic)")));
}
TEST_F(
SiteIsolationPolicyIsolatedApplicationTest,
ShouldSchemeUseApplicationIsolationLevelIsDisableForNonIsolatedAppScheme) {
base::CommandLine::ForCurrentProcess()->RemoveSwitch(
switches::kIsolatedAppOrigins);
EXPECT_FALSE(SiteIsolationPolicy::ShouldUrlUseApplicationIsolationLevel(
/*browser_context=*/nullptr, GURL("http://example.com")));
}
} // namespace content

@ -78,8 +78,7 @@ class SmartCardTestContentBrowserClient : public ContentBrowserClient {
SmartCardDelegate* GetSmartCardDelegate(
content::BrowserContext* browser_context) override;
bool ShouldUrlUseApplicationIsolationLevel(BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) override;
const GURL& url) override;
absl::optional<blink::ParsedPermissionsPolicy>
GetPermissionsPolicyForIsolatedWebApp(
content::BrowserContext* browser_context,
@ -186,8 +185,7 @@ void SmartCardTestContentBrowserClient::SetSmartCardDelegate(
bool SmartCardTestContentBrowserClient::ShouldUrlUseApplicationIsolationLevel(
BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) {
const GURL& url) {
return true;
}

@ -405,7 +405,6 @@ void SetRuntimeFeaturesFromCommandLine(const base::CommandLine& command_line) {
true},
{wrf::EnableWebGPUDeveloperFeatures,
switches::kEnableWebGPUDeveloperFeatures, true},
{wrf::EnableDirectSockets, switches::kIsolatedAppOrigins, true},
{wrf::EnableDirectSockets, switches::kEnableIsolatedWebAppsInRenderer,
true},
};

@ -330,8 +330,7 @@ ContentBrowserClient::GetAdditionalSiteIsolationModes() {
bool ContentBrowserClient::ShouldUrlUseApplicationIsolationLevel(
BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag) {
const GURL& url) {
return false;
}

@ -634,13 +634,10 @@ class CONTENT_EXPORT ContentBrowserClient {
// Returns true if the given URL needs be loaded with the "isolated
// application" isolation level. COOP/COEP headers must also be properly set
// in order to enable the application isolation level. `origin_matches_flag`
// specifies whether the URL's origin is allowed to use application isolation
// according to the content-level `kIsolatedAppOrigins` switch.
// in order to enable the application isolation level.
virtual bool ShouldUrlUseApplicationIsolationLevel(
BrowserContext* browser_context,
const GURL& url,
bool origin_matches_flag);
const GURL& url);
// Allows the embedder to enable access to Isolated Context Web APIs for the
// given |lock_url| -- the URL to which the renderer process is locked.

@ -78,48 +78,6 @@ bool IsSiteIsolationDisabled(SiteIsolationMode site_isolation_mode) {
site_isolation_mode);
}
url::Origin RemovePort(const url::Origin& origin) {
return url::Origin::CreateFromNormalizedTuple(origin.scheme(), origin.host(),
/*port=*/0);
}
base::flat_set<url::Origin> CreateIsolatedAppOriginSet() {
std::string cmdline_origins(
base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
switches::kIsolatedAppOrigins));
std::vector<std::string> origin_strings = base::SplitString(
cmdline_origins, ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
base::flat_set<url::Origin> origin_set;
for (const std::string& origin_string : origin_strings) {
GURL allowed_url(origin_string);
url::Origin allowed_origin = url::Origin::Create(allowed_url);
if (!allowed_origin.opaque()) {
// Site isolation is currently based on Site URLs, which don't include
// ports. Ideally we'd use origin-based isolation for the origins in
// kIsolatedAppOrigins, but long term the origins used in the flag will
// be equivalent to their Site URL-ified version. Because of this, we
// just remove the port here instead of hooking up origin-based isolation
// that won't be needed long term.
if (allowed_url.has_port()) {
LOG(WARNING) << "Ignoring port number for Isolated App origin: "
<< allowed_origin;
}
origin_set.insert(RemovePort(allowed_origin));
} else {
LOG(ERROR) << "Error parsing Isolated App origin: " << origin_string;
}
}
return origin_set;
}
const base::flat_set<url::Origin>& GetIsolatedAppOriginSet() {
static base::NoDestructor<base::flat_set<url::Origin>> kIsolatedAppOrigins(
CreateIsolatedAppOriginSet());
return *kIsolatedAppOrigins;
}
} // namespace
// static
@ -342,12 +300,8 @@ bool SiteIsolationPolicy::ShouldUrlUseApplicationIsolationLevel(
BrowserContext* browser_context,
const GURL& url) {
DCHECK_CURRENTLY_ON(BrowserThread::UI);
url::Origin origin = RemovePort(url::Origin::Create(url));
bool origin_matches_flag = g_disable_flag_caching_for_tests
? CreateIsolatedAppOriginSet().contains(origin)
: GetIsolatedAppOriginSet().contains(origin);
return GetContentClient()->browser()->ShouldUrlUseApplicationIsolationLevel(
browser_context, url, origin_matches_flag);
browser_context, url);
}
// static

@ -506,11 +506,6 @@ const char kInProcessGPU[] = "in-process-gpu";
// connection from the browser before killing itself.
const char kIPCConnectionTimeout[] = "ipc-connection-timeout";
// Enable Isolated App restrictions for a set of origins, specified as a
// comma-separated list. For example:
// --isolated-app-origins=https://www.foo.com,https://www.bar.com
const char kIsolatedAppOrigins[] = "isolated-app-origins";
// Require dedicated processes for a set of origins, specified as a
// comma-separated list. For example:
// --isolate-origins=https://www.foo.com,https://www.bar.com

@ -154,7 +154,6 @@ CONTENT_EXPORT extern const char kGpuStartupDialog[];
extern const char kHideScrollbars[];
CONTENT_EXPORT extern const char kInProcessGPU[];
CONTENT_EXPORT extern const char kIPCConnectionTimeout[];
CONTENT_EXPORT extern const char kIsolatedAppOrigins[];
CONTENT_EXPORT extern const char kIsolateOrigins[];
CONTENT_EXPORT extern const char kIsolationByDefault[];
CONTENT_EXPORT extern const char kJavaScriptHarmony[];

@ -1,2 +1,2 @@
# This suite runs external/wpt/direct-sockets/ with
# --isolated-app-origins=https://web-platform.test
# --isolated-context-origins=https://web-platform.test

@ -1,2 +1,2 @@
# This suite runs wpt_internal/direct-sockets/ with
# --isolated-app-origins=https://web-platform.test
# --isolated-context-origins=https://web-platform.test