1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
|
<!DOCTYPE html>
<meta charset="utf-8">
<script src="/tests/SimpleTest/SimpleTest.js"></script>
<script src="/tests/SimpleTest/ExtensionTestUtils.js"></script>
<script src="head.js"></script>
<script>
"use strict";
async function background() {
const url = "http://ext-cookie-first-party.mochi.test/";
const firstPartyDomain = "ext-cookie-first-party.mochi.test";
// A first party domain with invalid characters for the file system, which just happens to be a IPv6 address.
const firstPartyDomainInvalidChars = "[2606:4700:4700::1111]";
const expectedError = "First-Party Isolation is enabled, but the required 'firstPartyDomain' attribute was not set.";
const assertExpectedCookies = (expected, cookies, message) => {
let matches = (cookie, expected) => {
if (!cookie || !expected) {
return cookie === expected; // true if both are null.
}
for (let key of Object.keys(expected)) {
if (cookie[key] !== expected[key]) {
return false;
}
}
return true;
};
browser.test.assertEq(expected.length, cookies.length, `Got expected number of cookies - ${message}`);
if (cookies.length !== expected.length) {
return;
}
for (let expect of expected) {
let foundCookies = cookies.filter(cookie => matches(cookie, expect));
browser.test.assertEq(1, foundCookies.length,
`Expected cookie ${JSON.stringify(expect)} found - ${message}`);
}
};
// Test when FPI is disabled.
const test_fpi_disabled = async () => {
let cookie, cookies;
// set
cookie = await browser.cookies.set({url, name: "foo1", value: "bar1"});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
], [cookie], "set: FPI off, w/ empty firstPartyDomain, non-FP cookie");
cookie = await browser.cookies.set({url, name: "foo2", value: "bar2", firstPartyDomain});
assertExpectedCookies([
{name: "foo2", value: "bar2", firstPartyDomain},
], [cookie], "set: FPI off, w/ firstPartyDomain, FP cookie");
// get
// When FPI is disabled, missing key/null/undefined is equivalent to "".
cookie = await browser.cookies.get({url, name: "foo1"});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
], [cookie], "get: FPI off, w/o firstPartyDomain, non-FP cookie");
cookie = await browser.cookies.get({url, name: "foo1", firstPartyDomain: ""});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
], [cookie], "get: FPI off, w/ empty firstPartyDomain, non-FP cookie");
cookie = await browser.cookies.get({url, name: "foo1", firstPartyDomain: null});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
], [cookie], "get: FPI off, w/ null firstPartyDomain, non-FP cookie");
cookie = await browser.cookies.get({url, name: "foo1", firstPartyDomain: undefined});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
], [cookie], "get: FPI off, w/ undefined firstPartyDomain, non-FP cookie");
cookie = await browser.cookies.get({url, name: "foo2", firstPartyDomain});
assertExpectedCookies([
{name: "foo2", value: "bar2", firstPartyDomain},
], [cookie], "get: FPI off, w/ firstPartyDomain, FP cookie");
// There is no match for non-FP cookies with name "foo2".
cookie = await browser.cookies.get({url, name: "foo2"});
assertExpectedCookies([null], [cookie], "get: FPI off, w/o firstPartyDomain, no cookie");
cookie = await browser.cookies.get({url, name: "foo2", firstPartyDomain: ""});
assertExpectedCookies([null], [cookie], "get: FPI off, w/ empty firstPartyDomain, no cookie");
cookie = await browser.cookies.get({url, name: "foo2", firstPartyDomain: null});
assertExpectedCookies([null], [cookie], "get: FPI off, w/ null firstPartyDomain, no cookie");
cookie = await browser.cookies.get({url, name: "foo2", firstPartyDomain: undefined});
assertExpectedCookies([null], [cookie], "get: FPI off, w/ undefined firstPartyDomain, no cookie");
// getAll
for (let extra of [{}, {url}, {domain: firstPartyDomain}]) {
const prefix = `getAll(${JSON.stringify(extra)})`;
cookies = await browser.cookies.getAll({...extra});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
], cookies, `${prefix}: FPI off, w/o firstPartyDomain, non-FP cookies`);
cookies = await browser.cookies.getAll({...extra, firstPartyDomain: ""});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
], cookies, `${prefix}: FPI off, w/ empty firstPartyDomain, non-FP cookies`);
cookies = await browser.cookies.getAll({...extra, firstPartyDomain: null});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
{name: "foo2", value: "bar2", firstPartyDomain},
], cookies, `${prefix}: FPI off, w/ null firstPartyDomain, all cookies`);
cookies = await browser.cookies.getAll({...extra, firstPartyDomain: undefined});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
{name: "foo2", value: "bar2", firstPartyDomain},
], cookies, `${prefix}: FPI off, w/ undefined firstPartyDomain, all cookies`);
cookies = await browser.cookies.getAll({...extra, firstPartyDomain});
assertExpectedCookies([
{name: "foo2", value: "bar2", firstPartyDomain},
], cookies, `${prefix}: FPI off, w/ firstPartyDomain, FP cookies`);
}
// remove
cookie = await browser.cookies.remove({url, name: "foo1"});
assertExpectedCookies([
{url, name: "foo1", firstPartyDomain: ""},
], [cookie], "remove: FPI off, w/ empty firstPartyDomain, non-FP cookie");
cookie = await browser.cookies.remove({url, name: "foo2", firstPartyDomain});
assertExpectedCookies([
{url, name: "foo2", firstPartyDomain},
], [cookie], "remove: FPI off, w/ firstPartyDomain, FP cookie");
// Test if FP cookies set when FPI off can be accessed when FPI on.
await browser.cookies.set({url, name: "foo1", value: "bar1"});
await browser.cookies.set({url, name: "foo2", value: "bar2", firstPartyDomain});
browser.test.sendMessage("test_fpi_disabled");
};
// Test when FPI is enabled.
const test_fpi_enabled = async () => {
let cookie, cookies;
// set
await browser.test.assertRejects(
browser.cookies.set({url, name: "foo3", value: "bar3"}),
expectedError,
"set: FPI on, w/o firstPartyDomain, rejection");
cookie = await browser.cookies.set({url, name: "foo4", value: "bar4", firstPartyDomain});
assertExpectedCookies([
{name: "foo4", value: "bar4", firstPartyDomain},
], [cookie], "set: FPI on, w/ firstPartyDomain, FP cookie");
// get
await browser.test.assertRejects(
browser.cookies.get({url, name: "foo3"}),
expectedError,
"get: FPI on, w/o firstPartyDomain, rejection");
await browser.test.assertRejects(
browser.cookies.get({url, name: "foo3", firstPartyDomain: null}),
expectedError,
"get: FPI on, w/ null firstPartyDomain, rejection");
await browser.test.assertRejects(
browser.cookies.get({url, name: "foo3", firstPartyDomain: undefined}),
expectedError,
"get: FPI on, w/ undefined firstPartyDomain, rejection");
cookie = await browser.cookies.get({url, name: "foo1", firstPartyDomain: ""});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
], [cookie], "get: FPI on, w/ empty firstPartyDomain, non-FP cookie");
cookie = await browser.cookies.get({url, name: "foo4", firstPartyDomain});
assertExpectedCookies([
{name: "foo4", value: "bar4", firstPartyDomain},
], [cookie], "get: FPI on, w/ firstPartyDomain, FP cookie");
cookie = await browser.cookies.get({url, name: "foo2", firstPartyDomain});
assertExpectedCookies([
{name: "foo2", value: "bar2", firstPartyDomain},
], [cookie], "get: FPI on, w/ firstPartyDomain, FP cookie (set when FPI off)");
// getAll
for (let extra of [{}, {url}, {domain: firstPartyDomain}]) {
const prefix = `getAll(${JSON.stringify(extra)})`;
await browser.test.assertRejects(
browser.cookies.getAll({...extra}),
expectedError,
`${prefix}: FPI on, w/o firstPartyDomain, rejection`);
cookies = await browser.cookies.getAll({...extra, firstPartyDomain: ""});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
], cookies, `${prefix}: FPI on, w/ empty firstPartyDomain, non-FP cookies`);
cookies = await browser.cookies.getAll({...extra, firstPartyDomain: null});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
{name: "foo2", value: "bar2", firstPartyDomain},
{name: "foo4", value: "bar4", firstPartyDomain},
], cookies, `${prefix}: FPI on, w/ null firstPartyDomain, all cookies`);
cookies = await browser.cookies.getAll({...extra, firstPartyDomain: undefined});
assertExpectedCookies([
{name: "foo1", value: "bar1", firstPartyDomain: ""},
{name: "foo2", value: "bar2", firstPartyDomain},
{name: "foo4", value: "bar4", firstPartyDomain},
], cookies, `${prefix}: FPI on, w/ undefined firstPartyDomain, all cookies`);
cookies = await browser.cookies.getAll({...extra, firstPartyDomain});
assertExpectedCookies([
{name: "foo2", value: "bar2", firstPartyDomain},
{name: "foo4", value: "bar4", firstPartyDomain},
], cookies, `${prefix}: FPI on, w/ firstPartyDomain, FP cookies`);
}
// remove
await browser.test.assertRejects(
browser.cookies.remove({url, name: "foo3"}),
expectedError,
"remove: FPI on, w/o firstPartyDomain, rejection");
cookie = await browser.cookies.remove({url, name: "foo4", firstPartyDomain});
assertExpectedCookies([
{url, name: "foo4", firstPartyDomain},
], [cookie], "remove: FPI on, w/ firstPartyDomain, FP cookie");
cookie = await browser.cookies.remove({url, name: "foo2", firstPartyDomain});
assertExpectedCookies([
{url, name: "foo2", firstPartyDomain},
], [cookie], "remove: FPI on, w/ firstPartyDomain, FP cookie (set when FPI off)");
// Test if FP cookies set when FPI on can be accessed when FPI off.
await browser.cookies.set({url, name: "foo4", value: "bar4", firstPartyDomain});
browser.test.sendMessage("test_fpi_enabled");
};
// Test FPI with a first party domain with invalid characters for
// the file system.
const test_fpi_with_invalid_characters = async () => {
let cookie;
// Test setting a cookie with a first party domain with invalid characters
// for the file system.
cookie = await browser.cookies.set({url, name: "foo5", value: "bar5",
firstPartyDomain: firstPartyDomainInvalidChars});
assertExpectedCookies([
{name: "foo5", value: "bar5", firstPartyDomain: firstPartyDomainInvalidChars},
], [cookie], "set: FPI on, w/ firstPartyDomain with invalid characters, FP cookie");
// Test getting a cookie with a first party domain with invalid characters
// for the file system.
cookie = await browser.cookies.get({url, name: "foo5",
firstPartyDomain: firstPartyDomainInvalidChars});
assertExpectedCookies([
{name: "foo5", value: "bar5", firstPartyDomain: firstPartyDomainInvalidChars},
], [cookie], "get: FPI on, w/ firstPartyDomain with invalid characters, FP cookie");
// Test removing a cookie with a first party domain with invalid characters
// for the file system.
cookie = await browser.cookies.remove({url, name: "foo5",
firstPartyDomain: firstPartyDomainInvalidChars});
assertExpectedCookies([
{url, name: "foo5", firstPartyDomain: firstPartyDomainInvalidChars},
], [cookie], "remove: FPI on, w/ firstPartyDomain with invalid characters, FP cookie");
browser.test.sendMessage("test_fpi_with_invalid_characters");
};
// Test when FPI is disabled again, accessing FP cookies set when FPI is enabled.
const test_fpd_cookies_on_fpi_disabled = async () => {
let cookie, cookies;
cookie = await browser.cookies.get({url, name: "foo4", firstPartyDomain});
assertExpectedCookies([
{name: "foo4", value: "bar4", firstPartyDomain},
], [cookie], "get: FPI off, w/ firstPartyDomain, FP cookie (set when FPI on)");
cookie = await browser.cookies.remove({url, name: "foo4", firstPartyDomain});
assertExpectedCookies([
{url, name: "foo4", firstPartyDomain},
], [cookie], "remove: FPI off, w/ firstPartyDomain, FP cookie (set when FPI on)");
// Clean up.
await browser.cookies.remove({url, name: "foo1"});
cookies = await browser.cookies.getAll({firstPartyDomain: null});
assertExpectedCookies([], cookies, "Test is finishing, all cookies removed");
browser.test.sendMessage("test_fpd_cookies_on_fpi_disabled");
};
browser.test.onMessage.addListener((message) => {
switch (message) {
case "test_fpi_disabled": return test_fpi_disabled();
case "test_fpi_enabled": return test_fpi_enabled();
case "test_fpi_with_invalid_characters": return test_fpi_with_invalid_characters();
case "test_fpd_cookies_on_fpi_disabled": return test_fpd_cookies_on_fpi_disabled();
default: return browser.test.notifyFail("unknown-message");
}
});
}
function enableFirstPartyIsolation() {
return SpecialPowers.pushPrefEnv({
set: [
["privacy.firstparty.isolate", true],
],
});
}
function disableFirstPartyIsolation() {
return SpecialPowers.popPrefEnv();
}
add_task(async () => {
let extension = ExtensionTestUtils.loadExtension({
background,
manifest: {
permissions: ["cookies", "*://ext-cookie-first-party.mochi.test/"],
},
});
await extension.startup();
extension.sendMessage("test_fpi_disabled");
await extension.awaitMessage("test_fpi_disabled");
await enableFirstPartyIsolation();
extension.sendMessage("test_fpi_enabled");
await extension.awaitMessage("test_fpi_enabled");
extension.sendMessage("test_fpi_with_invalid_characters");
await extension.awaitMessage("test_fpi_with_invalid_characters");
await disableFirstPartyIsolation();
extension.sendMessage("test_fpd_cookies_on_fpi_disabled");
await extension.awaitMessage("test_fpd_cookies_on_fpi_disabled");
await extension.unload();
});
</script>
|
