1220950 - Adding tests for checking signed package should not share data with other package or web content

Status: NEW

(Core :: Networking, defect, P5)

Description

[Dimi Lee [:dimi]]

For signed package, we don't allow it to share data(local storage, index db, or cookie) with other packages.

We should write test cases for this.

Comment 1

[Dimi Lee [:dimi]]

Attachment: WIP patch

Comment 2

[Dimi Lee [:dimi]]

i will add following tests:

Load a signed package, set following : client side cookie, server side cookie, local storage, index db
 - load an unsigned package in the same domain, they should NOT share those data
 - load an signed package in the same domain, they should NOT share those data
 - load an web content in the same domain, they should NOT share those data
 - load an web content in different domain, they should NOT share those data
 - load the same signed package pointing to different resource, they SHOULD share those data

Hi Paul,
Do you think any test case is missing and would be nice to have, for example, load an unsigned package and check the same criteria as mentioned above ?

Comment 3

[Dimi Lee [:dimi]]

Attachment: WIP patch v2 (include server cookie)

Comment 4

[Henry Chang [:hchang]]

Attachment: The same test case with git patch format

Comment 5

[Dimi Lee [:dimi]]

Attachment: hg patch - Rebase to latest codebase

Modification:
- use moz-package-origin for sjs
- when create signed package iframe, create a normal iframe then navigate to signed package (This temporarily fix missing package identifier for signed package)

Comment 6

[Dimi Lee [:dimi]]

Attachment: git patch

Comment 7

[Dimi Lee [:dimi]]

remove myself from assignee because not actively work on this now

Comment 8

[Firefox Bug Husbandry Bot]

Bulk change to priority: https://bugzilla.mozilla.org/show_bug.cgi?id=1399258