Partition Blob URL fetches by Storage Key #1783

recvfrom · 2024-10-25T21:33:12Z

Partition Blob URL fetches by Storage Key

This change updates the spec to partition Blob URL fetches by Storage Key. This change is part of broader changes discussed in w3c/FileAPI#153 (comment). Specifically, we will also:

Partition Blob URL revocation by storage key - Partition Blob URL revocation by Storage Key w3c/FileAPI#201
Enforce noopener for cross-top-level-site Blob URLs - (Spec changes for this will follow)

I considered incorporating the Storage Key checks into the "resolve a blob URL" algorithm instead, but it seemed that this would require an environment settings object to be available as part of https://url.spec.whatwg.org/#url-parsing, and I'm not sure whether that is the case / a change we want.

At least two implementers are interested (and none opposed):
- Firefox has already implemented this - Blob URL store partitioning w3c/FileAPI#153 (comment)
- Safari has implemented partitioning Blob URL fetches by top-level origin and is considering partitioning them by a site-based Storage Key (Storage Key specifics TBD) - Blob URL store partitioning w3c/FileAPI#153 (comment)
Tests are written and can be reviewed and commented upon at:
- https://chromium-review.googlesource.com/c/chromium/src/+/5967596
Implementation bugs are filed:
- Chromium: https://crbug.com/40057646
- Gecko: N/A
- WebKit: N/A
- Deno (not for CORS changes): N/A (it seems Deno does not partition storage or more generally implement the same-origin policy: https://docs.deno.com/runtime/reference/web_platform_apis/#spec-deviations)
MDN issue is filed: Note that Blob URL usage is restricted due to storage partitioning mdn/content#36542
The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

Preview | Diff

recvfrom · 2024-11-12T20:21:29Z

@annevk would you be able to look at this PR as well? Or could you recommend another reviewer? Thank you!

recvfrom · 2024-11-18T14:41:13Z

@domenic would you mind taking a look at this when you have a chance?

domenic · 2024-11-21T07:14:56Z

fetch.bs

+prevented from succeeding if the <a spec=storage>storage key</a> of the
+<a>environment settings object</a> making the request is different than the
+<a spec=storage>storage key</a> of the <a>environment settings object</a> corresponding to where
+the Blob URL was created.


This feels like it would work better after line 5028, instead of near this algorithm.

I was thinking this would make sense in the Infrastructure section like how the HTTP cache partitioning section and determine the HTTP cache partition algorithm are, but I've moved the algorithm under the Scheme fetch section now (and removed the note since it seems kinda out of place now. WDYT?

fetch.bs

domenic

Non-editor LGTM

fetch.bs

annevk · 2024-11-22T08:47:14Z

I'm a little worried about this approach as it means obtaining and revoking are maintained in independent specifications, but need to be kept synchronized to maintain the privacy and security boundary.

I think a more ideal setup would be that File API keeps the Blob objects out of reach (i.e., they're no longer directly accessible from a 'blob URL entry') and instead exposes some kind of "obtain" algorithm that we hand the 'blob URL entry' and current 'environment' (or maybe a storage key). That way File API can stay in charge of obtaining and revoking and most of the logic associated with that. And Fetch can mainly concern itself with translating a Blob into a response.

domenic · 2024-11-22T09:30:46Z

It looks like there aren't too many references to the blob URL entry's object... https://dontcallmedom.github.io/webdex/o.html#object%40%40blob%20URL%20entry%40dfn

annevk · 2024-11-22T09:38:27Z

Nice, the HTML find is legit and would also need to be updated I suspect. It would benefit from having the obtaining defined in File API so there's less need for duplication. Reporting API seems bogus: w3c/reporting#273. Web Authentication API seems similarly bogus: w3c/webauthn#2212.

recvfrom · 2024-11-25T05:18:28Z

Thanks for the feedback, I've updated my FileAPI PR [1] to expose an obtain algorithm as recommended here, and I've updated this PR to use it. One question I thought more about was what to do when the request doesn't have an associated environment... It seems like for Blob URLs we should allow navigations to bypass the partitioning checks, but otherwise we should just fail (this seems in line with the Chromium implementation at least). WDYT?

[1] https://github.com/w3c/FileAPI/pull/201/files

recvfrom · 2024-11-25T15:16:57Z

A draft PR for the HTML spec change is at: whatwg/html#10792

annevk

Thank you for reworking this so quickly!

annevk · 2024-11-25T15:21:06Z

fetch.bs

+     return a <a>network error</a>.
+
+     <li><p>Let <var>blob</var> be the result of <a>obtaining a blob object</a> given
+     <var>blobURLEntry</var>, <var>requestEnvironment</var>, and <var>isNavigation</var>.


So when isNavigation is true we don't even care about environment, right? I would merge those parameters into one.

So you have

given an environment or the string "navigation" environment

on the other side or some such forcing callers to confront that question. And it should probably be top-level navigation?

annevk · 2024-11-25T15:21:37Z

fetch.bs

+     <li><p>Let <var>blob</var> be the result of <a>obtaining a blob object</a> given
+     <var>blobURLEntry</var>, <var>requestEnvironment</var>, and <var>isNavigation</var>.
+
+     <li><p>If <var>blob</var> is failure, or <var>blob</var> is not a {{Blob}} object, then


You only need the second conditional to catch both conditions.

annevk · 2024-11-25T15:33:33Z

fetch.bs

+     <a for=request>determining the environment</a> given <var>request</var>.
+
+     <li><p>Let <var>isNavigation</var> be true if <var>request</var>'s <a for=request>mode</a> is
+     not "<code>navigate</code>"; otherwise, false.


Perhaps instead of mode we should be checking destination for "document" which is only true for top-level navigations.

Thanks for calling this out, I had overlooked that we didn't want to exempt all navigations from the partitioning checks and instead only want to exempt top-level navigations. I confirmed that Safari and Firefox both enforce partitioning checks on subframe navigations, so we'll implement it this way in Chromium as well, write a new WPT for this, and I'll update the spec here to look for destination equaling documenting as you suggested.

recvfrom and others added 4 commits October 25, 2024 14:37

Partition Blob URL fetches by Storage Key

42a4f90

Fix formatting per the style guide

2d4567d

Fix build and formatting

e7689d6

Add name to Acknowledgements section

f4f62bf

recvfrom mentioned this pull request Oct 28, 2024

Note that Blob URL usage is restricted due to storage partitioning mdn/content#36542

Open

recvfrom marked this pull request as ready for review October 28, 2024 17:10

recvfrom mentioned this pull request Oct 28, 2024

Blob URL store partitioning w3c/FileAPI#153

Open

domenic reviewed Nov 21, 2024

View reviewed changes

Address review feedback

d79ae96

domenic approved these changes Nov 22, 2024

View reviewed changes

fetch.bs Outdated Show resolved Hide resolved

Move storage key check logic to FileAPI

0d6d692

recvfrom mentioned this pull request Nov 25, 2024

Partition Blob URL revocation by Storage Key w3c/FileAPI#201

Open

4 tasks

Refactor existing use of blob URL entry object

cacc4e5

recvfrom mentioned this pull request Nov 25, 2024

Replace existing usage of blob URL entry's object whatwg/html#10792

Draft

annevk reviewed Nov 25, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Partition Blob URL fetches by Storage Key #1783

Partition Blob URL fetches by Storage Key #1783

recvfrom commented Oct 25, 2024 •

edited by pr-preview bot

Loading

recvfrom commented Nov 12, 2024

recvfrom commented Nov 18, 2024

domenic Nov 21, 2024

recvfrom Nov 22, 2024

domenic left a comment

annevk commented Nov 22, 2024

domenic commented Nov 22, 2024

annevk commented Nov 22, 2024

recvfrom commented Nov 25, 2024

recvfrom commented Nov 25, 2024

annevk left a comment

annevk Nov 25, 2024

annevk Nov 25, 2024

annevk Nov 25, 2024

recvfrom Nov 27, 2024

Partition Blob URL fetches by Storage Key #1783

Are you sure you want to change the base?

Partition Blob URL fetches by Storage Key #1783

Conversation

recvfrom commented Oct 25, 2024 • edited by pr-preview bot Loading

recvfrom commented Nov 12, 2024

recvfrom commented Nov 18, 2024

domenic Nov 21, 2024

Choose a reason for hiding this comment

recvfrom Nov 22, 2024

Choose a reason for hiding this comment

domenic left a comment

Choose a reason for hiding this comment

annevk commented Nov 22, 2024

domenic commented Nov 22, 2024

annevk commented Nov 22, 2024

recvfrom commented Nov 25, 2024

recvfrom commented Nov 25, 2024

annevk left a comment

Choose a reason for hiding this comment

annevk Nov 25, 2024

Choose a reason for hiding this comment

annevk Nov 25, 2024

Choose a reason for hiding this comment

annevk Nov 25, 2024

Choose a reason for hiding this comment

recvfrom Nov 27, 2024

Choose a reason for hiding this comment

recvfrom commented Oct 25, 2024 •

edited by pr-preview bot

Loading