Skip to content

Commit

Permalink
Adapt test expectations to only consider about:{blank,srcdoc} secure
Browse files Browse the repository at this point in the history
Any other about: URL is now considered unsecure according to the spec
linked from the upstream commit's description (see [1])

Chromium change:

https://source.chromium.org/chromium/chromium/src/+/58fcd77538b8bc6989b2e3290b789f864ddf4dd9

commit 58fcd77538b8bc6989b2e3290b789f864ddf4dd9
Author: Frédéric Wang <[email protected]>
Date:   Thu Dec 3 00:47:31 2020 +0000

    Limit about: URLs that are treated as potentially trustworthy

    Per [1], only about:blank and about:srcdoc URLs should be treated as
    potentially trustworthy, but Chromium currently accepts all about: URLs.
    This CL aligns with the current spec, with the additional assumption
    that query and fragment components are accepted too [2]. This change is
    not web-visible.

    [1] https://w3c.github.io/webappsec-secure-contexts/#potentially-trustworthy-url
    [2] w3c/webappsec-secure-contexts#81

    Bug: 1153335, 1153336
  • Loading branch information
mariospr authored and mkarolin committed Feb 5, 2021
1 parent 2b1d2b0 commit c9db6bd
Showing 1 changed file with 6 additions and 2 deletions.
8 changes: 6 additions & 2 deletions browser/download/brave_download_item_model_unittest.cc
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,12 @@ TEST_F(BraveDownloadItemModelTest, GetOriginUrlText) {
{"https://example.com:5678/foo.bar", "https://example.com:5678", true},
// File, secure.
{"file:///c:/foo/bar/foo.bar", "file:///", true},
// about:, secure.
{"about:about", "about:about", true},
// about:blank, secure.
{"about:blank", "about:blank", true},
// about:srcdoc, secure.
{"about:srcdoc", "about:srcdoc", true},
// Other about: URLs, not secure.
{"about:about", "about:about", false},
// invalid, not secure.
{"foo.bar.baz", "", false},
// empty, not secure.
Expand Down

0 comments on commit c9db6bd

Please sign in to comment.