Don't allow frames to pass cookies through window.name

[pes10k]

we should keep folks from passing cookies through window.name, as part of a bigger project to keep 3p from riding on 1p storage

[fmarier]

See https://lists.w3.org/Archives/Public/public-webappsec/2016Jul/0006.html for more details (thread).

Also, this trick has apparently been known for a long time and is also an open bug in Firefox.

The consensus seems to be that window.name should be reset between cross-origin navigations.

[fmarier]

Blink planned to do the same fix as Webkit, but while a port of the Webkit patch landed, it got reverted because it broke something around Chromebooks.

We should rebase and reland their patch in Brave. This could be as simple as enabling the experimental_set_nulled_name_ flag.

[stephendonner]

@pes10k @pilgrim-brave please provide a succinct test plan which @brave/qa-team can use; thanks! Marking blocked and QA/Test-Plan-Required until we have one.

[pes10k]

https://dev-pages.bravesoftware.com/dom-properties/window-name.html Here ya go!

…

On Jul 1, 2022, at 12:09, Stephen Donner ***@***.***> wrote:  @pes10k @pilgrim-brave please provide a succinct test plan which @brave/qa-team can use; thanks! Marking blocked and QA/Test-Plan-Required until we have one. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.

[stephendonner]

Verified PASSED using

Brave	1.41.86 Chromium: 103.0.5060.66 (Official Build) beta (x86_64)
Revision	20b1569438a85e631d15e83eb355e3e326e5da6f-refs/branch-heads/5060@{#1066}
OS	macOS Version 11.6.7 (Build 20G630)

First, confirmed issue with 1.40.107 Chromium: 103.0.5060.53 (Official Build) (x86_64):

example	example

Confirmed window.name is now NA (N/A):

example	example

[stephendonner]

Verified PASSED using Brave

1.41.86	Chromium: 103.0.5060.66 (Official Build) beta (64-bit)
Revision	20b1569438a85e631d15e83eb355e3e326e5da6f-refs/branch-heads/5060@{#1066}
OS	Linux

Steps:

1. installed 1.41.86
2. launched Brave
3. loaded https://dev-pages.bravesoftware.com/dom-properties/window-name.html
4. clicked on Run test
5. noted the result
6. clicked on Reset test
7. clicked on Run test
8. noted the result

Confirmed window.name is NA

example	example

[pes10k]

terrific!!

[MadhaviSeelam]

Verification PASSED using

Brave | 1.41.93 Chromium: 103.0.5060.114 (Official Build) (64-bit)
-- | --
Revision | a1c2360c5b02a6d4d6ab33796ad8a268a6128226-refs/branch-heads/5060@{#1124}
OS | Windows 11 Version 21H2 (Build 22000.739)

First, confirmed issue with 1.40.113 Chromium: 103.0.5060.114 (Official Build) (64-bit)

example	example

Steps:

1. installed 1.41.93
2. launched Brave
3. loaded https://dev-pages.bravesoftware.com/dom-properties/window-name.html
4. clicked on Run test
5. noted the result
6. clicked on Reset test
7. clicked on Run test
8. noted the result

Confirmed window.name is NA

example	example

[kjozwiak]

As per @pes10k, we'll need to recheck the above now that #23798 landed. It's basically the same tests but we'll need to run through them again. It will require 1.41.94 or higher.

[srirambv]

Verification passed on the following devices running 1.41.91 x64 build

• Verified window.name returns value NA on both the test pages

Oppo Reno 5 (Android 12)	Samsung Tab A (Android 10)
5910-ARM.mp4	5910-Tab.mp4

[LaurenWags]

Verified with

Brave | 1.41.94 Chromium: 103.0.5060.114 (Official Build) (x86_64)
-- | --
Revision | a1c2360c5b02a6d4d6ab33796ad8a268a6128226-refs/branch-heads/5060@{#1124}
OS | macOS Version 12.4 (Build 21F79)

Reproduced the issue using 1.40.113:

Example	Example

Confirmed does not reproduce when using 1.41.94:

Example	Example

[stephendonner]

Verified PASSED using

Brave	1.41.94 Chromium: 103.0.5060.114 (Official Build) (64-bit)
Revision	a1c2360c5b02a6d4d6ab33796ad8a268a6128226-refs/branch-heads/5060@{#1124}
OS	Windows 10 Version 21H2 (Build 19044.1806)

Reproduced the issue using 1.40.113:

example	example

Confirmed the fix using 1.41.94:

example	example

[btlechowski]

Verification passed on

Brave	1.41.94 Chromium: 103.0.5060.114 (Official Build) (64-bit)
Revision	a1c2360c5b02a6d4d6ab33796ad8a268a6128226-refs/branch-heads/5060@{#1124}
OS	Ubuntu 18.04 LTS