1 files changed, 110 insertions, 0 deletions
diff --git a/browser/components/resistfingerprinting/test/browser/browser_hwconcurrency_iframes_blobcrossorigin.js b/browser/components/resistfingerprinting/test/browser/browser_hwconcurrency_iframes_blobcrossorigin.js
new file mode 100644
index 0000000000..6a643000bd
--- /dev/null
+++ b/browser/components/resistfingerprinting/test/browser/browser_hwconcurrency_iframes_blobcrossorigin.js
@@ -0,0 +1,110 @@
+/**
+ * This test only tests values in a blob document that is created by the iframe on one domain, then passed
+ * to a cross-origin domain to embed.
+ * It is a bit different from all the other tests in this series, because instead of the framer doing nothing
+ * except frame the framee; the framer creates the blob document, and the framee embeds the blob document.
+ *
+ * Covers the following cases:
+ *  - RFP is disabled entirely
+ *  - RFP is enabled entirely
+ *  - FPP is enabled entirely
+
+ *
+ *  - (A) RFP is exempted on the framer and framee and (if needed) on another cross-origin domain
+ *  - (B) RFP is exempted on the framer and framee but is not on another (if needed) cross-origin domain
+ *  - (C) RFP is exempted on the framer and (if needed) on another cross-origin domain, but not the framee
+ *  - (D) RFP is exempted on the framer but not the framee nor another (if needed) cross-origin domain
+ *  - (E) RFP is not exempted on the framer nor the framee but (if needed) is exempted on another cross-origin domain
+ *  - (F) RFP is not exempted on the framer nor the framee nor another (if needed) cross-origin domain
+ *  - (G) RFP is not exempted on the framer but is on the framee and (if needed) on another cross-origin domain
+ *  - (H) RFP is not exempted on the framer nor another (if needed) cross-origin domain but is on the framee
+ *
+ */
+
+"use strict";
+
+const SPOOFED_HW_CONCURRENCY = 2;
+
+const DEFAULT_HARDWARE_CONCURRENCY = navigator.hardwareConcurrency;
+
+// =============================================================================================
+// =============================================================================================
+
+async function testHWConcurrency(result, expectedResults, extraData) {
+  let testDesc = extraData.testDesc;
+
+  is(
+    result.hardwareConcurrency,
+    expectedResults.hardwareConcurrency,
+    `Checking ${testDesc} navigator.hardwareConcurrency.`
+  );
+}
+
+// The following are convenience objects that allow you to quickly see what is
+//   and is not modified from a logical set of values.
+// Be sure to always use `let expectedResults = structuredClone(allNotSpoofed)` to do a
+//   deep copy and avoiding corrupting the original 'const' object
+const allNotSpoofed = {
+  hardwareConcurrency: DEFAULT_HARDWARE_CONCURRENCY,
+};
+const allSpoofed = {
+  hardwareConcurrency: SPOOFED_HW_CONCURRENCY,
+};
+
+const uri = `https://${FRAMER_DOMAIN}/browser/browser/components/resistfingerprinting/test/browser/file_hwconcurrency_blobcrossorigin_iframer.html`;
+
+requestLongerTimeout(2);
+
+let expectedResults = {};
+
+expectedResults = structuredClone(allNotSpoofed);
+add_task(defaultsTest.bind(null, uri, testHWConcurrency, expectedResults));
+
+expectedResults = structuredClone(allSpoofed);
+add_task(simpleRFPTest.bind(null, uri, testHWConcurrency, expectedResults));
+
+expectedResults = structuredClone(allSpoofed);
+add_task(simpleFPPTest.bind(null, uri, testHWConcurrency, expectedResults));
+
+// (A) RFP is exempted on the framer and framee and (if needed) on another cross-origin domain
+// In theory this should be Not Spoofed, however, in this test there is a blob: document that
+// has a content principal and a reference to the iframe's parent (when Fission is disabled anyway.)
+// The blob's principal does not match the parent's principal, so it is up to the blob to determine
+// if it should resist fingerprinting on its own.
+// It decides _not_ to resist fingerprinting, but only because nsContentUtils::IsURIInList has
+// a check `if (!scheme.EqualsLiteral("http") && !scheme.EqualsLiteral("https")) { return false; }`
+// We could in theory, modify that check to check the blob's creation uri, and that would work.
+// But I am nervous about changing that code.
+// expectedResults = structuredClone(allNotSpoofed);
+expectedResults = structuredClone(allSpoofed);
+add_task(testA.bind(null, uri, testHWConcurrency, expectedResults));
+
+// (B) RFP is exempted on the framer and framee but is not on another (if needed) cross-origin domain
+// Same as A above.
+//expectedResults = structuredClone(allNotSpoofed);
+expectedResults = structuredClone(allSpoofed);
+add_task(testB.bind(null, uri, testHWConcurrency, expectedResults));
+
+// (C) RFP is exempted on the framer and (if needed) on another cross-origin domain, but not the framee
+expectedResults = structuredClone(allSpoofed);
+add_task(testC.bind(null, uri, testHWConcurrency, expectedResults));
+
+// (D) RFP is exempted on the framer but not the framee nor another (if needed) cross-origin domain
+expectedResults = structuredClone(allSpoofed);
+add_task(testD.bind(null, uri, testHWConcurrency, expectedResults));
+
+// (E) RFP is not exempted on the framer nor the framee but (if needed) is exempted on another cross-origin domain
+expectedResults = structuredClone(allSpoofed);
+add_task(testE.bind(null, uri, testHWConcurrency, expectedResults));
+
+// (F) RFP is not exempted on the framer nor the framee nor another (if needed) cross-origin domain
+expectedResults = structuredClone(allSpoofed);
+add_task(testF.bind(null, uri, testHWConcurrency, expectedResults));
+
+// (G) RFP is not exempted on the framer but is on the framee and (if needed) on another cross-origin domain
+expectedResults = structuredClone(allSpoofed);
+add_task(testG.bind(null, uri, testHWConcurrency, expectedResults));
+
+// (H) RFP is not exempted on the framer nor another (if needed) cross-origin domain but is on the framee
+expectedResults = structuredClone(allSpoofed);
+add_task(testH.bind(null, uri, testHWConcurrency, expectedResults));