Partition Blob URL revocation by Storage Key

[recvfrom]

Part of the changes discussed in #153 (comment)

This updates URL.revokeObjectURL to not allow revoking a Blob URL except from contexts with the same Storage Key as the one in which the Blob URL was created. A corresponding PR will update the Fetch spec to incorporate similar Storage Key checks into Blob URL fetches.

I considered incorporating the Storage Key checks into the "resolve a blob URL" algorithm instead, but it seemed that this would require an environment settings object to be available as part of https://url.spec.whatwg.org/#url-parsing, and I'm not sure whether that is the case / a change we want.

For normative changes, the following tasks have been completed:

• Modified Web platform tests (link to pull request)

• https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/web_tests/external/wpt/FileAPI/BlobURL/cross-partition.tentative.https.html

Implementation commitment:

• WebKit - Already implemented partitioning by top-level origin, considering partitioning by top-level site - Blob URL store partitioning #153 (comment)
• Chromium (https://bugs.chromium.org/p/chromium/issues/detail?id=40057646)
• Gecko - Already implemented - Blob URL store partitioning #153 (comment)

---

Preview | Diff

[miketaylr]

Mind taking a look @mkruisselbrink?

[mkruisselbrink]

Might make sense to mention that it's not just URLs that aren't registered that would silently fail, something like (although not sure that's the best way to phrase it):

Suggested change

	Note: This means that rather than throwing some kind of error, attempting to revoke a URL that isn't registered will silently fail.
	Note: This means that rather than throwing some kind of error, attempting to revoke a URL that isn't registered, or is registered from a different storage key, will silently fail.

[recvfrom]

Good catch, I updated this (although made it a bit more verbose). WDYT?

[miketaylr]

I guess we need to update spec-prod (or wait for the update to be propagated?):

  $ bikeshed update
    Bikeshed now requires Python 3.9; you are on 3.8.10.
        If you're seeing this message in your CI run, you are
        likely specifying an old OS; try `ubuntu-latest`.
        If you're seeing this on the command line, see the docs
        for instructions:
        https://speced.github.io/bikeshed/#installing
  Command `bikeshed update` failed with exit code: 1.

w3c/spec-prod#193

[mkruisselbrink]

I guess we need to update spec-prod (or wait for the update to be propagated?):

  $ bikeshed update
    Bikeshed now requires Python 3.9; you are on 3.8.10.
        If you're seeing this message in your CI run, you are
        likely specifying an old OS; try `ubuntu-latest`.
        If you're seeing this on the command line, see the docs
        for instructions:
        https://speced.github.io/bikeshed/#installing
  Command `bikeshed update` failed with exit code: 1.

w3c/spec-prod#193

I think #204 will fix that.