Document-Isolation-Policy infrastructure

Component: WebCore security policy | 6164d9c

LayoutTests/ipc/blob-registry-null-url-crash.html

     crossOriginEmbedderPolicy: { value: 0, reportOnlyValue: 0, reportingEndpoint: '', reportOnlyReportingEndpoint: '' },
     crossOriginOpenerPolicy: { value: 0, reportOnlyValue: 0, reportingEndpoint: '', reportOnlyReportingEndpoint: '' },
+    documentIsolationPolicy: 0,
     referrerPolicy: 0,
     ipAddressSpace: 0,

LayoutTests/TestExpectations

-# Document-Isolation-Policy is not implemented.

+# Document-Isolation-Policy requires site isolation and is partially implemented.

COEP require-corp blocks cross-origin no-cors subresources unless they opt in through Cross-Origin-Resource-Policy, and it is enforced in several independent places. Document-Isolation-Policy (DIP) is a newer alternative that gives a single document its own agent cluster and process without requiring the whole frame tree to cooperate, so it depends on site isolation.

The Document-Isolation-Policy header is now parsed into PolicyContainer, which is inherited by initial about:blank, about:srcdoc, data:, javascript: and blob: documents and restored from history. isolate-and-require-corp enforces CORP in NetworkLoadChecker, the memory cache, service worker responses and the Cache API. The policy applies only in secure contexts, with site isolation, behind DocumentIsolationPolicyEnabled. Agent-cluster keying is not implemented yet.

Significance

WebKit gains the first piece of a second cross-origin isolation mechanism, adding a policy field that must be enforced consistently across many independent load paths.

Audit directions

Gaps between enforcement sites are the most likely bugs. Check each CORP site (NetworkLoadChecker, memory cache, service worker responses, Cache API/DOMCache, BackgroundFetchRegistration) for paths that skip the DIP check, such as redirects, opaque or range responses, and responses cached before the policy applied. Look for differences between stored and effective policy across PolicyContainer inheritance and history restore. Check that the network process validates the new IPC field instead of trusting it. Check for cross-origin resources obtainable through shared or service workers, which have no policy. Confirm the policy is not partially applied when site isolation, the secure-context requirement or the preference is off, and look at how the document behaves while it claims a policy that is not fully enforced.