Navigation Timing: cross-origin redirect opt-in should be based on destination origin.

https://bugs.webkit.org/show_bug.cgi?id=316647

Reviewed by NOBODY (OOPS!).

This PR aligns the WebKit implementation with whatwg/fetch#1931 and whatwg/html#12513,
and ensures that TAO opt-ins for navigation timing take the destination origin into account.

No new tests, but a test progresses.

* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-tao-expected.txt: Progression.
* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/response-start-after-coop-bcg-switch.https-expected.txt: Expectation change.
* LayoutTests/imported/w3c/web-platform-tests/navigation-timing/unload-event-same-origin-check-expected.txt: Progression.
* Source/WebCore/page/Performance.cpp:
(WebCore::Performance::addNavigationTiming): A no-referrer navigation that has a referring client should not expose redirect timing.
* Source/WebCore/page/PerformanceNavigationTiming.cpp:
(WebCore::PerformanceNavigationTiming::PerformanceNavigationTiming): intialize m_clientOrReferrerAllowsRedirectTiming.
(WebCore::PerformanceNavigationTiming::shouldExposeRedirectTiming const):
(WebCore::PerformanceNavigationTiming::redirectCount const): TAO check.
* Source/WebCore/page/PerformanceNavigationTiming.h:
* Source/WebCore/page/PerformanceResourceTiming.cpp:
(WebCore::PerformanceResourceTiming::shouldExposeRedirectTiming const):
(WebCore::PerformanceResourceTiming::redirectStart const):
(WebCore::PerformanceResourceTiming::redirectEnd const):
* Source/WebCore/page/PerformanceResourceTiming.h:
* Source/WebCore/platform/network/NetworkLoadMetrics.cpp:
(WebCore::NetworkLoadMetrics::NetworkLoadMetrics):
(WebCore::NetworkLoadMetrics::isolatedCopy const): Copy navigationTAOCheckPassed.
* Source/WebCore/platform/network/NetworkLoadMetrics.h:
* Source/WebCore/platform/network/cocoa/NetworkLoadMetrics.mm:
(WebCore::packageTimingData): Copy navigationTAOCheckPassed.
(WebCore::copyTimingData): Copy navigationTAOCheckPassed.
* Source/WebKit/NetworkProcess/NetworkDataTask.h:
(WebKit::NetworkDataTask::setNavigationTAOCheckPassed): Setter.
* Source/WebKit/NetworkProcess/NetworkLoad.cpp:
(WebKit::NetworkLoad::setNavigationTAOCheckPassed): Setter.
* Source/WebKit/NetworkProcess/NetworkLoad.h:
* Source/WebKit/NetworkProcess/NetworkLoadChecker.cpp:
(WebKit::NetworkLoadChecker::checkRedirection): Append TAO values.
(WebKit::NetworkLoadChecker::validateResponse): Set TAO values on the response.
(WebKit::NetworkLoadChecker::appendToNavigationTimingAllowValuesList): Accumulate TAO values.
(WebKit::NetworkLoadChecker::passesNavigationTAOCheck const): Check if the response passes TAO check.
* Source/WebKit/NetworkProcess/NetworkLoadChecker.h:
(WebKit::NetworkLoadChecker::navigationTAOCheckPassed const): Getter.
* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:
(WebKit::NetworkResourceLoader::didReceiveResponse): Set navigationTAOCheckPassed.
* Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.h:
* Source/WebKit/NetworkProcess/cocoa/NetworkDataTaskCocoa.mm:
(WebKit::NetworkDataTaskCocoa::setNavigationTAOCheckPassed): Setter.
* Source/WebKit/NetworkProcess/curl/NetworkDataTaskCurl.cpp:
(WebKit::NetworkDataTaskCurl::updateNetworkLoadMetrics): Set navigationTAOCheckPassed.
(WebKit::NetworkDataTaskCurl::setNavigationTAOCheckPassed): Setter.
* Source/WebKit/NetworkProcess/curl/NetworkDataTaskCurl.h:
* Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.cpp:
(WebKit::NetworkDataTaskSoup::setNavigationTAOCheckPassed): Setter.
* Source/WebKit/NetworkProcess/soup/NetworkDataTaskSoup.h:
* Source/WebKit/Shared/WebCoreArgumentCodersPlatform.serialization.in:

Author: yoavweiss

LayoutTests/imported/w3c/web-platform-tests/navigation-timing/redirect-tao-expected.txt

@@ -1,8 +1,8 @@
 
 
-FAIL Exposed when a cross-origin redirect opts in to the destination origin assert_equals: redirectCount expected 1 but got 0
-FAIL Exposed when a cross-origin redirect opts in with a wildcard assert_equals: redirectCount expected 1 but got 0
-FAIL Exposed when every redirect in the chain opts in to the destination origin assert_equals: redirectCount expected 2 but got 0
+PASS Exposed when a cross-origin redirect opts in to the destination origin
+PASS Exposed when a cross-origin redirect opts in with a wildcard
+PASS Exposed when every redirect in the chain opts in to the destination origin
 PASS Hidden when the redirect opts in to a non-destination origin
 PASS Hidden when only part of the chain opts in to the destination origin
 PASS Hidden for a no-referrer navigation even when the redirect opts in

LayoutTests/imported/w3c/web-platform-tests/navigation-timing/response-start-after-coop-bcg-switch.https-expected.txt

@@ -1,3 +1,3 @@
 
-FAIL Navigation responseStart is not clamped to zero after a cross-origin COOP browsing context group switch assert_greater_than: responseStart should not be clamped to zero after the COOP browsing context group switch expected a number greater than 0 but got 0
+FAIL Navigation responseStart is not clamped to zero after a cross-origin COOP browsing context group switch assert_equals: The cross-origin navigation should not expose the redirect count expected 0 but got 2
 

LayoutTests/imported/w3c/web-platform-tests/navigation-timing/unload-event-same-origin-check-expected.txt

@@ -5,7 +5,7 @@ This test validates that the values of window.performance.getEntriesByType("navi
 
 
 PASS Redirect chain with a partial TAO opt-in
-FAIL Redirect chain with full TAO opt-in assert_equals: Expected redirectCount to be 1 expected 1 but got 0
+PASS Redirect chain with full TAO opt-in
 PASS Same-cross-same redirect chain with no TAO opt-in
 PASS cross-cross-same Redirect chain with no TAO opt-in
 PASS Previous document cross origin
@@ -14,6 +14,6 @@ PASS No previous document
 PASS Same origin previous document with same origin redirect
 PASS No previous document with same origin redirect
 PASS No previous document with cross origin redirect
-FAIL No previous document with cross origin redirect with partial TAO assert_equals: Expected redirectCount to be 1 expected 1 but got 0
+PASS No previous document with cross origin redirect with partial TAO
 PASS No previous document with cross origin redirect with TAO
 

Source/WebCore/page/Performance.cpp

@@ -408,7 +408,10 @@ void Performance::enqueueLargestContentfulPaint(Ref<LargestContentfulPaint>&& pa
 
 void Performance::addNavigationTiming(DocumentLoader& documentLoader, Document& document, CachedResource& resource, const DocumentLoadTiming& timing, const NetworkLoadMetrics& metrics)
 {
-    m_navigationTiming = PerformanceNavigationTiming::create(m_timeOrigin, resource, timing, metrics, document.eventTiming(), document.securityOrigin(), documentLoader.triggeringAction().type());
+    // A no-referrer navigation that has a referring client should not expose redirect timing.
+    // https://html.spec.whatwg.org/#create-the-navigation-timing-entry
+    bool clientOrReferrerAllowsRedirectTiming = !documentLoader.triggeringAction().requester() || !documentLoader.request().httpReferrer().isEmpty();
+    m_navigationTiming = PerformanceNavigationTiming::create(m_timeOrigin, resource, timing, metrics, document.eventTiming(), document.securityOrigin(), documentLoader.triggeringAction().type(), clientOrReferrerAllowsRedirectTiming);
     addToEntryBuffer(*m_navigationTiming);
 }
 

Source/WebCore/page/PerformanceNavigationTiming.cpp

@@ -50,11 +50,12 @@ static PerformanceNavigationTiming::NavigationType NODELETE toPerformanceNavigat
     return PerformanceNavigationTiming::NavigationType::Navigate;
 }
 
-PerformanceNavigationTiming::PerformanceNavigationTiming(MonotonicTime timeOrigin, CachedResource& resource, const DocumentLoadTiming& documentLoadTiming, const NetworkLoadMetrics& metrics, const DocumentEventTiming& documentEventTiming, const SecurityOrigin& origin, WebCore::NavigationType navigationType)
+PerformanceNavigationTiming::PerformanceNavigationTiming(MonotonicTime timeOrigin, CachedResource& resource, const DocumentLoadTiming& documentLoadTiming, const NetworkLoadMetrics& metrics, const DocumentEventTiming& documentEventTiming, const SecurityOrigin& origin, WebCore::NavigationType navigationType, bool clientOrReferrerAllowsRedirectTiming)
     : PerformanceResourceTiming(timeOrigin, ResourceTiming::fromLoad(resource, resource.response().url(), "navigation"_s, documentLoadTiming, metrics, origin))
     , m_documentEventTiming(documentEventTiming)
     , m_documentLoadTiming(documentLoadTiming)
-    , m_navigationType(toPerformanceNavigationTimingNavigationType(navigationType)) { }
+    , m_navigationType(toPerformanceNavigationTimingNavigationType(navigationType))
+    , m_clientOrReferrerAllowsRedirectTiming(clientOrReferrerAllowsRedirectTiming) { }
 
 PerformanceNavigationTiming::~PerformanceNavigationTiming() = default;
 
@@ -121,9 +122,17 @@ PerformanceNavigationTiming::NavigationType PerformanceNavigationTiming::type()
     return m_navigationType;
 }
 
+bool PerformanceNavigationTiming::shouldExposeRedirectTiming() const
+{
+    // A cross-origin redirect chain must not leak its redirect timing unless it opted in.
+    // https://html.spec.whatwg.org/#create-the-navigation-timing-entry
+    auto& metrics = m_resourceTiming.networkLoadMetrics();
+    return !metrics.hasCrossOriginRedirect || (m_clientOrReferrerAllowsRedirectTiming && metrics.navigationTAOCheckPassed);
+}
+
 unsigned short PerformanceNavigationTiming::redirectCount() const
 {
-    if (m_resourceTiming.networkLoadMetrics().hasCrossOriginRedirect)
+    if (!shouldExposeRedirectTiming())
         return 0;
 
     return m_resourceTiming.networkLoadMetrics().redirectCount;

Source/WebCore/page/PerformanceNavigationTiming.h

@@ -73,14 +73,18 @@ class PerformanceNavigationTiming final : public PerformanceResourceTiming {
     void documentLoadFinished(const NetworkLoadMetrics&);
 
 private:
-    PerformanceNavigationTiming(MonotonicTime timeOrigin, CachedResource&, const DocumentLoadTiming&, const NetworkLoadMetrics&, const DocumentEventTiming&, const SecurityOrigin&, WebCore::NavigationType);
+    PerformanceNavigationTiming(MonotonicTime timeOrigin, CachedResource&, const DocumentLoadTiming&, const NetworkLoadMetrics&, const DocumentEventTiming&, const SecurityOrigin&, WebCore::NavigationType, bool clientOrReferrerAllowsRedirectTiming);
 
     double millisecondsSinceOrigin(MonotonicTime) const;
     bool NODELETE sameOriginCheckFails() const;
+    bool NODELETE shouldExposeRedirectTiming() const final;
 
     DocumentEventTiming m_documentEventTiming;
     DocumentLoadTiming m_documentLoadTiming;
     NavigationType m_navigationType;
+    // The client/no-referrer half of the redirect timing gate, which only the web process can tell.
+    // https://html.spec.whatwg.org/#create-the-navigation-timing-entry
+    bool m_clientOrReferrerAllowsRedirectTiming;
 };
 
 } // namespace WebCore

Source/WebCore/page/PerformanceResourceTiming.cpp

@@ -118,9 +118,14 @@ double PerformanceResourceTiming::workerStart() const
     return networkLoadTimeToDOMHighResTimeStamp(m_timeOrigin, m_resourceTiming.networkLoadMetrics().workerStart);
 }
 
+bool PerformanceResourceTiming::shouldExposeRedirectTiming() const
+{
+    return !m_resourceTiming.networkLoadMetrics().failsTAOCheck;
+}
+
 double PerformanceResourceTiming::redirectStart() const
 {
-    if (m_resourceTiming.networkLoadMetrics().failsTAOCheck)
+    if (!shouldExposeRedirectTiming())
         return 0.0;
 
     if (m_resourceTiming.isLoadedFromServiceWorker())
@@ -134,7 +139,7 @@ double PerformanceResourceTiming::redirectStart() const
 
 double PerformanceResourceTiming::redirectEnd() const
 {
-    if (m_resourceTiming.networkLoadMetrics().failsTAOCheck)
+    if (!shouldExposeRedirectTiming())
         return 0.0;
 
     if (m_resourceTiming.isLoadedFromServiceWorker())

Source/WebCore/page/PerformanceResourceTiming.h

@@ -84,6 +84,9 @@ class PerformanceResourceTiming : public PerformanceEntry {
 
     bool isLoadedFromServiceWorker() const { return m_resourceTiming.isLoadedFromServiceWorker(); }
 
+    // Navigation timing exposes redirect timing under a different condition than the TAO check.
+    virtual bool NODELETE shouldExposeRedirectTiming() const;
+
     MonotonicTime m_timeOrigin;
     ResourceTiming m_resourceTiming;
     Vector<Ref<PerformanceServerTiming>> m_serverTiming;

Source/WebCore/platform/network/NetworkLoadMetrics.cpp

@@ -33,7 +33,7 @@ namespace WebCore {
 
 NetworkLoadMetrics::NetworkLoadMetrics() = default;
 
-NetworkLoadMetrics::NetworkLoadMetrics(MonotonicTime&& redirectStart, MonotonicTime&& fetchStart, MonotonicTime&& domainLookupStart, MonotonicTime&& domainLookupEnd, MonotonicTime&& connectStart, MonotonicTime&& secureConnectionStart, MonotonicTime&& connectEnd, MonotonicTime&& requestStart, MonotonicTime&& responseStart, MonotonicTime&& responseEnd, MonotonicTime&& workerStart, MonotonicTime&& firstInterimResponseStart, String&& protocol, uint16_t redirectCount, bool complete, bool cellular, bool expensive, bool constrained, bool multipath, bool isReusedConnection, bool failsTAOCheck, bool hasCrossOriginRedirect, bool fromPrefetch, bool fromCache, PrivacyStance privacyStance, uint64_t responseBodyBytesReceived, uint64_t responseBodyDecodedSize, RefPtr<AdditionalNetworkLoadMetricsForWebInspector>&& additionalNetworkLoadMetricsForWebInspector)
+NetworkLoadMetrics::NetworkLoadMetrics(MonotonicTime&& redirectStart, MonotonicTime&& fetchStart, MonotonicTime&& domainLookupStart, MonotonicTime&& domainLookupEnd, MonotonicTime&& connectStart, MonotonicTime&& secureConnectionStart, MonotonicTime&& connectEnd, MonotonicTime&& requestStart, MonotonicTime&& responseStart, MonotonicTime&& responseEnd, MonotonicTime&& workerStart, MonotonicTime&& firstInterimResponseStart, String&& protocol, uint16_t redirectCount, bool complete, bool cellular, bool expensive, bool constrained, bool multipath, bool isReusedConnection, bool failsTAOCheck, bool hasCrossOriginRedirect, bool navigationTAOCheckPassed, bool fromPrefetch, bool fromCache, PrivacyStance privacyStance, uint64_t responseBodyBytesReceived, uint64_t responseBodyDecodedSize, RefPtr<AdditionalNetworkLoadMetricsForWebInspector>&& additionalNetworkLoadMetricsForWebInspector)
     : redirectStart(WTF::move(redirectStart))
     , fetchStart(WTF::move(fetchStart))
     , domainLookupStart(WTF::move(domainLookupStart))
@@ -56,6 +56,7 @@ NetworkLoadMetrics::NetworkLoadMetrics(MonotonicTime&& redirectStart, MonotonicT
     , isReusedConnection(isReusedConnection)
     , failsTAOCheck(failsTAOCheck)
     , hasCrossOriginRedirect(hasCrossOriginRedirect)
+    , navigationTAOCheckPassed(navigationTAOCheckPassed)
     , fromPrefetch(fromPrefetch)
     , fromCache(fromCache)
     , privacyStance(privacyStance)
@@ -183,6 +184,7 @@ NetworkLoadMetrics NetworkLoadMetrics::isolatedCopy() const
     copy.isReusedConnection = isReusedConnection;
     copy.failsTAOCheck = failsTAOCheck;
     copy.hasCrossOriginRedirect = hasCrossOriginRedirect;
+    copy.navigationTAOCheckPassed = navigationTAOCheckPassed;
     copy.fromPrefetch = fromPrefetch;
     copy.fromCache = fromCache;
 

Source/WebCore/platform/network/NetworkLoadMetrics.h

@@ -65,7 +65,7 @@ class NetworkLoadMetrics {
     WTF_DEPRECATED_MAKE_FAST_ALLOCATED(NetworkLoadMetrics);
 public:
     WEBCORE_EXPORT NetworkLoadMetrics();
-    WEBCORE_EXPORT NetworkLoadMetrics(MonotonicTime&& redirectStart, MonotonicTime&& fetchStart, MonotonicTime&& domainLookupStart, MonotonicTime&& domainLookupEnd, MonotonicTime&& connectStart, MonotonicTime&& secureConnectionStart, MonotonicTime&& connectEnd, MonotonicTime&& requestStart, MonotonicTime&& responseStart, MonotonicTime&& responseEnd, MonotonicTime&& workerStart, MonotonicTime&& firstInterimResponseStart, String&& protocol, uint16_t redirectCount, bool complete, bool cellular, bool expensive, bool constrained, bool multipath, bool isReusedConnection, bool failsTAOCheck, bool hasCrossOriginRedirect, bool fromPrefetch, bool fromCache, PrivacyStance, uint64_t responseBodyBytesReceived, uint64_t responseBodyDecodedSize, RefPtr<AdditionalNetworkLoadMetricsForWebInspector>&&);
+    WEBCORE_EXPORT NetworkLoadMetrics(MonotonicTime&& redirectStart, MonotonicTime&& fetchStart, MonotonicTime&& domainLookupStart, MonotonicTime&& domainLookupEnd, MonotonicTime&& connectStart, MonotonicTime&& secureConnectionStart, MonotonicTime&& connectEnd, MonotonicTime&& requestStart, MonotonicTime&& responseStart, MonotonicTime&& responseEnd, MonotonicTime&& workerStart, MonotonicTime&& firstInterimResponseStart, String&& protocol, uint16_t redirectCount, bool complete, bool cellular, bool expensive, bool constrained, bool multipath, bool isReusedConnection, bool failsTAOCheck, bool hasCrossOriginRedirect, bool navigationTAOCheckPassed, bool fromPrefetch, bool fromCache, PrivacyStance, uint64_t responseBodyBytesReceived, uint64_t responseBodyDecodedSize, RefPtr<AdditionalNetworkLoadMetricsForWebInspector>&&);
 
     WEBCORE_EXPORT static const NetworkLoadMetrics& NODELETE emptyMetrics();
 
@@ -117,6 +117,8 @@ class NetworkLoadMetrics {
     bool isReusedConnection : 1 { false };
     bool failsTAOCheck : 1 { false };
     bool hasCrossOriginRedirect : 1 { false };
+    // https://fetch.spec.whatwg.org/#navigation-tao-check
+    bool navigationTAOCheckPassed : 1 { false };
     bool fromPrefetch : 1 { false };
     bool fromCache : 1 { false };