Partition Blob URL revocation by Storage Key #201

recvfrom · 2024-10-25T20:16:32Z

Part of the changes discussed in #153 (comment)

This updates URL.revokeObjectURL to not allow revoking a Blob URL except from contexts with the same Storage Key as the one in which the Blob URL was created. A corresponding PR will update the Fetch spec to incorporate similar Storage Key checks into Blob URL fetches.

I considered incorporating the Storage Key checks into the "resolve a blob URL" algorithm instead, but it seemed that this would require an environment settings object to be available as part of https://url.spec.whatwg.org/#url-parsing, and I'm not sure whether that is the case / a change we want.

For normative changes, the following tasks have been completed:

Modified Web platform tests (link to pull request)

https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/web_tests/external/wpt/FileAPI/BlobURL/cross-partition.tentative.https.html

Implementation commitment:

WebKit - Already implemented partitioning by top-level origin, considering partitioning by top-level site - Blob URL store partitioning #153 (comment)
Chromium (https://bugs.chromium.org/p/chromium/issues/detail?id=40057646)
Gecko - Already implemented - Blob URL store partitioning #153 (comment)

Preview | Diff

miketaylr · 2024-11-13T14:12:00Z

Mind taking a look @mkruisselbrink?

index.bs

mkruisselbrink · 2024-11-20T21:03:03Z

index.bs

+1. If |entry| is failure, return.
+1. Let |blobStorageKey| be the result of [=obtaining a storage key for non-storage purposes=] with |entry|'s [=environment settings object=].
+1. Let |currentStorageKey| be the result of [=obtaining a storage key for non-storage purposes=] with the [=current settings object=].
+1. If |blobStorageKey| is not [=storage key/equal=] to |currentStorageKey|, return.
 1. [=Remove an entry from the Blob URL Store=] for |url|.

 Note: This means that rather than throwing some kind of error, attempting to revoke a URL that isn't registered will silently fail.


Might make sense to mention that it's not just URLs that aren't registered that would silently fail, something like (although not sure that's the best way to phrase it):

Suggested change

Note: This means that rather than throwing some kind of error, attempting to revoke a URL that isn't registered will silently fail.

Note: This means that rather than throwing some kind of error, attempting to revoke a URL that isn't registered, or is registered from a different storage key, will silently fail.

Good catch, I updated this (although made it a bit more verbose). WDYT?

miketaylr · 2024-11-22T14:58:44Z

I guess we need to update spec-prod (or wait for the update to be propagated?):

  $ bikeshed update
    Bikeshed now requires Python 3.9; you are on 3.8.10.
        If you're seeing this message in your CI run, you are
        likely specifying an old OS; try `ubuntu-latest`.
        If you're seeing this on the command line, see the docs
        for instructions:
        https://speced.github.io/bikeshed/#installing
  Command `bikeshed update` failed with exit code: 1.

w3c/spec-prod#193

mkruisselbrink · 2024-11-22T17:00:35Z

I guess we need to update spec-prod (or wait for the update to be propagated?):

  $ bikeshed update
    Bikeshed now requires Python 3.9; you are on 3.8.10.
        If you're seeing this message in your CI run, you are
        likely specifying an old OS; try `ubuntu-latest`.
        If you're seeing this on the command line, see the docs
        for instructions:
        https://speced.github.io/bikeshed/#installing
  Command `bikeshed update` failed with exit code: 1.

w3c/spec-prod#193

I think #204 will fix that.

recvfrom · 2024-11-25T05:21:32Z

Per the feedback here [1], I've updated this PR to also change how the blob URL entry's object member is exposed so that the partitioning checks can be fully contained in the FileAPI. WDYT?

[1] whatwg/fetch#1783 (comment)

index.bs

annevk

This looks good to me modulo nits. Would be good if @mkruisselbrink had another look as well.

index.bs

mkruisselbrink

looks good to me as well, modulo Anne's nits

index.bs

SHA: 77b2086 Reason: push, by mkruisselbrink Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

As suggested in whatwg/fetch#1783 (comment), this change updates an existing use of blob URL entry's object so that the "obtain a blob object" algorithm is used instead. This algorithm was added in w3c/FileAPI#201.

See w3c/FileAPI#153 (comment) and w3c/FileAPI#201 for additional context. And https://privacycg.github.io/storage-partitioning/ for the overall partitioning story.

Associated spec PRs: - w3c/FileAPI#201 - Partition Blob URL revocation by Storage Key - whatwg/fetch#1783 - Partition Blob URL fetches by Storage Key - whatwg/html#10731 - Enforce noopener on cross-top-level-site Blob URLs Bug: 40057646 Change-Id: I953598ab3f81d5998e8398057739e0428bc23e4b

Associated spec PRs: - w3c/FileAPI#201 - Partition Blob URL revocation by Storage Key - whatwg/fetch#1783 - Partition Blob URL fetches by Storage Key - whatwg/html#10731 - Enforce noopener on cross-top-level-site Blob URLs Bug: 40057646 Change-Id: I953598ab3f81d5998e8398057739e0428bc23e4b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5967596 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Andrew Williams <[email protected]> Cr-Commit-Position: refs/heads/main@{#1394563}

…PTs permanent, a=testonly Automatic update from web-platform-tests [Blob URL] Make tentative partitioning WPTs permanent Associated spec PRs: - w3c/FileAPI#201 - Partition Blob URL revocation by Storage Key - whatwg/fetch#1783 - Partition Blob URL fetches by Storage Key - whatwg/html#10731 - Enforce noopener on cross-top-level-site Blob URLs Bug: 40057646 Change-Id: I953598ab3f81d5998e8398057739e0428bc23e4b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5967596 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Andrew Williams <[email protected]> Cr-Commit-Position: refs/heads/main@{#1394563} -- wpt-commits: 949cc8c7c7067de75af00d1ba60d6921582f9c5d wpt-pr: 49629

…PTs permanent, a=testonly Automatic update from web-platform-tests [Blob URL] Make tentative partitioning WPTs permanent Associated spec PRs: - w3c/FileAPI#201 - Partition Blob URL revocation by Storage Key - whatwg/fetch#1783 - Partition Blob URL fetches by Storage Key - whatwg/html#10731 - Enforce noopener on cross-top-level-site Blob URLs Bug: 40057646 Change-Id: I953598ab3f81d5998e8398057739e0428bc23e4b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5967596 Reviewed-by: Steven Bingler <binglerchromium.org> Commit-Queue: Andrew Williams <awilliachromium.org> Cr-Commit-Position: refs/heads/main{#1394563} -- wpt-commits: 949cc8c7c7067de75af00d1ba60d6921582f9c5d wpt-pr: 49629 UltraBlame original commit: eeba0835a846042567009b99eb22224cfacd0380

recvfrom added 2 commits October 25, 2024 15:46

Partition Blob URL revocation

b988256

Fix duplicate list numbering

bb24aca

This was referenced Oct 25, 2024

Partition Blob URL fetches by Storage Key whatwg/fetch#1783

Merged

Note that Blob URL usage is restricted due to storage partitioning mdn/content#36542

Open

recvfrom marked this pull request as ready for review October 28, 2024 17:11

recvfrom mentioned this pull request Oct 28, 2024

Blob URL store partitioning #153

Open

mkruisselbrink reviewed Nov 20, 2024

View reviewed changes

Address review feedback

c97d7f9

Move partitioning checks into FileAPI

fd3d0f8

annevk reviewed Nov 25, 2024

View reviewed changes

index.bs Outdated Show resolved Hide resolved

index.bs Outdated Show resolved Hide resolved

index.bs Outdated Show resolved Hide resolved

index.bs Outdated Show resolved Hide resolved

index.bs Outdated Show resolved Hide resolved

recvfrom added 3 commits November 28, 2024 18:14

Address review feedback

8b57aea

Fix build issue

15e817a

use "Environment Settings Object" instead of "Environment"

7b3d9d8

annevk reviewed Dec 3, 2024

View reviewed changes

index.bs Outdated Show resolved Hide resolved

index.bs Outdated Show resolved Hide resolved

index.bs Outdated Show resolved Hide resolved

mkruisselbrink reviewed Dec 3, 2024

View reviewed changes

index.bs Outdated Show resolved Hide resolved

recvfrom added 2 commits December 4, 2024 05:18

Address review feedback

7cac860

Define return types for new algs; don't export partition check

5a9047c

mkruisselbrink approved these changes Dec 4, 2024

View reviewed changes

mkruisselbrink merged commit 77b2086 into w3c:main Dec 4, 2024
2 checks passed

github-actions bot added a commit that referenced this pull request Dec 4, 2024

Partition Blob URL revocation by Storage Key (#201)

fdb6834

SHA: 77b2086 Reason: push, by mkruisselbrink Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chromium-wpt-export-bot mentioned this pull request Dec 10, 2024

[Blob URL] Make tentative partitioning WPTs permanent web-platform-tests/wpt#49629

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Partition Blob URL revocation by Storage Key #201

Partition Blob URL revocation by Storage Key #201

recvfrom commented Oct 25, 2024 •

edited by pr-preview bot

Loading

miketaylr commented Nov 13, 2024

mkruisselbrink Nov 20, 2024

recvfrom Nov 22, 2024

miketaylr commented Nov 22, 2024

mkruisselbrink commented Nov 22, 2024

recvfrom commented Nov 25, 2024

annevk left a comment

mkruisselbrink left a comment

	Note: This means that rather than throwing some kind of error, attempting to revoke a URL that isn't registered will silently fail.
	Note: This means that rather than throwing some kind of error, attempting to revoke a URL that isn't registered, or is registered from a different storage key, will silently fail.

Partition Blob URL revocation by Storage Key #201

Partition Blob URL revocation by Storage Key #201

Conversation

recvfrom commented Oct 25, 2024 • edited by pr-preview bot Loading

miketaylr commented Nov 13, 2024

mkruisselbrink Nov 20, 2024

Choose a reason for hiding this comment

recvfrom Nov 22, 2024

Choose a reason for hiding this comment

miketaylr commented Nov 22, 2024

mkruisselbrink commented Nov 22, 2024

recvfrom commented Nov 25, 2024

annevk left a comment

Choose a reason for hiding this comment

mkruisselbrink left a comment

Choose a reason for hiding this comment

recvfrom commented Oct 25, 2024 •

edited by pr-preview bot

Loading