chrome-devtools-frontend 1.0.1669021 → 1.0.1672557

package/front_end/core/root/Runtime.ts

@@ -173,19 +173,15 @@ export interface Option {
 }
 
 export class ExperimentsSupport {
-  #experiments: Experiment[] = [];
-  #hostExperiments = new Map<ExperimentName, HostExperiment>();
-  readonly #experimentNames = new Set<ExperimentName>();
+  #experiments = new Map<ExperimentName, Experiment>();
   readonly #enabledForTests = new Set<ExperimentName>();
-  readonly #enabledByDefault = new Set<ExperimentName>();
-  readonly #serverEnabled = new Set<ExperimentName>();
   readonly #storage = new ExperimentStorage();
 
-  allConfigurableExperiments(): Array<Experiment|HostExperiment> {
-    return [...this.#experiments, ...this.#hostExperiments.values()];
+  allConfigurableExperiments(): Experiment[] {
+    return [...this.#experiments.values()];
   }
 
-  registerHostExperiment(params: {
+  register(params: {
     name: ExperimentName,
     title: string,
     aboutFlag: string,
@@ -193,44 +189,18 @@ export class ExperimentsSupport {
     requiresChromeRestart: boolean,
     docLink?: Platform.DevToolsPath.UrlString,
     readonly feedbackLink?: Platform.DevToolsPath.UrlString,
-  }): HostExperiment {
-    if (this.#isHostExperiment(params.name) || this.#isExperiment(params.name)) {
+  }): Experiment {
+    if (this.#isExperiment(params.name)) {
       throw new Error(`Duplicate registration of experiment '${params.name}'`);
     }
-    const hostExperiment = new HostExperiment({...params, experiments: this});
-    this.#hostExperiments.set(params.name, hostExperiment);
-    return hostExperiment;
-  }
-
-  register(experimentName: ExperimentName, experimentTitle: string, docLink?: string, feedbackLink?: string): void {
-    if (this.#isHostExperiment(experimentName) || this.#isExperiment(experimentName)) {
-      throw new Error(`Duplicate registration of experiment '${experimentName}'`);
-    }
-    this.#experimentNames.add(experimentName);
-    this.#experiments.push(new Experiment(
-        this, experimentName, experimentTitle,
-        docLink as Platform.DevToolsPath.UrlString ?? Platform.DevToolsPath.EmptyUrlString,
-        feedbackLink as Platform.DevToolsPath.UrlString ?? Platform.DevToolsPath.EmptyUrlString));
+    const experiment = new Experiment({...params, experiments: this});
+    this.#experiments.set(params.name, experiment);
+    return experiment;
   }
 
   isEnabled(experimentName: ExperimentName): boolean {
-    if (this.#isHostExperiment(experimentName)) {
-      return this.#enabledForTests.has(experimentName) ||
-          (this.#hostExperiments.get(experimentName)?.isEnabled() ?? false);
-    }
     if (this.#isExperiment(experimentName)) {
-      // Check for explicitly disabled #experiments first - the code could call setEnable(false)
-      // on the experiment enabled by default and we should respect that.
-      if (this.#storage.get(experimentName) === false) {
-        return false;
-      }
-      if (this.#enabledForTests.has(experimentName) || this.#enabledByDefault.has(experimentName)) {
-        return true;
-      }
-      if (this.#serverEnabled.has(experimentName)) {
-        return true;
-      }
-      return Boolean(this.#storage.get(experimentName));
+      return this.#enabledForTests.has(experimentName) || (this.#experiments.get(experimentName)?.isEnabled() ?? false);
     }
     throw new Error(`Unknown experiment '${experimentName}'`);
   }
@@ -240,47 +210,22 @@ export class ExperimentsSupport {
   }
 
   setEnabled(experimentName: ExperimentName, enabled: boolean): void {
-    if (this.#isHostExperiment(experimentName)) {
-      this.#hostExperiments.get(experimentName)?.setEnabled(enabled);
-      return;
-    }
     if (this.#isExperiment(experimentName)) {
-      this.#storage.set(experimentName, enabled);
+      this.#experiments.get(experimentName)?.setEnabled(enabled);
       return;
     }
     throw new Error(`Unknown experiment '${experimentName}'`);
   }
 
-  // Only applicable to legacy experiments.
-  enableExperimentsByDefault(experimentNames: ExperimentName[]): void {
-    for (const experimentName of experimentNames) {
-      if (!this.#isExperiment(experimentName)) {
-        throw new Error(`Unknown (legacy) experiment '${experimentName}'`);
-      }
-      this.#enabledByDefault.add(experimentName);
-    }
-  }
-
-  // Only applicable to legacy experiments.
-  setServerEnabledExperiments(experiments: string[]): void {
-    for (const experiment of experiments) {
-      const experimentName = experiment as ExperimentName;
-      if (!this.#isExperiment(experimentName)) {
-        throw new Error(`Unknown (legacy) experiment '${experimentName}'`);
-      }
-      this.#serverEnabled.add(experimentName);
-    }
-  }
-
   enableForTest(experimentName: ExperimentName): void {
-    if (!this.#isHostExperiment(experimentName) && !this.#isExperiment(experimentName)) {
+    if (!this.#isExperiment(experimentName)) {
       throw new Error(`Unknown experiment '${experimentName}'`);
     }
     this.#enabledForTests.add(experimentName);
   }
 
   disableForTest(experimentName: ExperimentName): void {
-    if (!this.#isHostExperiment(experimentName) && !this.#isExperiment(experimentName)) {
+    if (!this.#isExperiment(experimentName)) {
       throw new Error(`Unknown experiment '${experimentName}'`);
     }
     this.#enabledForTests.delete(experimentName);
@@ -291,27 +236,21 @@ export class ExperimentsSupport {
   }
 
   clearForTest(): void {
-    this.#experiments = [];
-    this.#hostExperiments.clear();
-    this.#experimentNames.clear();
+    this.#experiments.clear();
     this.#enabledForTests.clear();
-    this.#enabledByDefault.clear();
-    this.#serverEnabled.clear();
   }
 
-  cleanUpStaleExperiments(): void {
-    this.#storage.cleanUpStaleExperiments(this.#experimentNames);
-  }
-
-  #isHostExperiment(experimentName: ExperimentName): boolean {
-    return this.#hostExperiments.has(experimentName);
+  // TODO(crbug.com/464173054) remove after M156
+  removeAllExperimentsFromLocalStorage(): void {
+    this.#storage.removeAllExperimentsFromLocalStorage();
   }
 
   #isExperiment(experimentName: ExperimentName): boolean {
-    return this.#experimentNames.has(experimentName);
+    return this.#experiments.has(experimentName);
   }
 }
 
+// TODO(crbug.com/464173054) remove after M156
 /** Manages the 'experiments' dictionary in globalThis.localStorage */
 class ExperimentStorage {
   readonly #experiments: Record<string, boolean|undefined> = {};
@@ -337,55 +276,12 @@ class ExperimentStorage {
     return this.#experiments[experimentName];
   }
 
-  set(experimentName: ExperimentName, enabled: boolean): void {
-    this.#experiments[experimentName] = enabled;
-    this.#syncToLocalStorage();
-  }
-
-  cleanUpStaleExperiments(validExperiments: Set<string>): void {
-    for (const [key] of Object.entries(this.#experiments)) {
-      if (!validExperiments.has(key)) {
-        delete this.#experiments[key];
-      }
-    }
-    this.#syncToLocalStorage();
-  }
-
-  #syncToLocalStorage(): void {
-    Platform.HostRuntime.HOST_RUNTIME.getLocalStorage()?.setItem('experiments', JSON.stringify(this.#experiments));
+  removeAllExperimentsFromLocalStorage(): void {
+    Platform.HostRuntime.HOST_RUNTIME.getLocalStorage()?.removeItem('experiments');
   }
 }
 
-/**
- * @deprecated Experiments should not be used anymore, instead use base::Feature.
- * See docs/contributing/settings-experiments-features.md
- */
 export class Experiment {
-  name: ExperimentName;
-  title: string;
-  docLink?: Platform.DevToolsPath.UrlString;
-  readonly feedbackLink?: Platform.DevToolsPath.UrlString;
-  readonly #experiments: ExperimentsSupport;
-  constructor(
-      experiments: ExperimentsSupport, name: ExperimentName, title: string, docLink: Platform.DevToolsPath.UrlString,
-      feedbackLink: Platform.DevToolsPath.UrlString) {
-    this.name = name;
-    this.title = title;
-    this.docLink = docLink;
-    this.feedbackLink = feedbackLink;
-    this.#experiments = experiments;
-  }
-
-  isEnabled(): boolean {
-    return this.#experiments.isEnabled(this.name);
-  }
-
-  setEnabled(enabled: boolean): void {
-    this.#experiments.setEnabled(this.name, enabled);
-  }
-}
-
-export class HostExperiment {
   name: ExperimentName;
   title: string;
   readonly #experiments: ExperimentsSupport;
@@ -536,13 +432,6 @@ export interface HostConfigVeLogging {
   testing: boolean;
 }
 
-/**
- * @see https://goo.gle/devtools-json-design
- */
-export interface HostConfigWellKnown {
-  enabled: boolean;
-}
-
 export interface HostConfigPrivacyUI {
   enabled: boolean;
 }
@@ -564,10 +453,6 @@ interface AiGeneratedTimelineLabels {
   enabled: boolean;
 }
 
-interface AllowPopoverForcing {
-  enabled: boolean;
-}
-
 interface GlobalAiButton {
   enabled: boolean;
   promotionEnabled: boolean;
@@ -678,7 +563,6 @@ export type HostConfig = Platform.TypeScriptUtilities.RecursivePartial<{
   devToolsAiCodeGeneration: HostConfigAiCodeGeneration,
   devToolsAiCodeCompletionStyles: HostConfigAiCodeCompletionStyles,
   devToolsVeLogging: HostConfigVeLogging,
-  devToolsWellKnown: HostConfigWellKnown,
   /**
    * OffTheRecord here indicates that the user's profile is either incognito,
    * or guest mode, rather than a "normal" profile.
@@ -688,7 +572,6 @@ export type HostConfig = Platform.TypeScriptUtilities.RecursivePartial<{
   devToolsAnimationStylesInStylesTab: HostConfigAnimationStylesInStylesTab,
   devToolsJpegXlImageFormat: HostConfigJpegXlImageFormat,
   devToolsAiGeneratedTimelineLabels: AiGeneratedTimelineLabels,
-  devToolsAllowPopoverForcing: AllowPopoverForcing,
   devToolsGlobalAiButton: GlobalAiButton,
   devToolsGdpProfiles: GdpProfiles,
   devToolsGdpProfilesAvailability: GdpProfilesAvailability,

package/front_end/core/sdk/CSSMetadata.ts

@@ -485,15 +485,15 @@ export function cssMetadata(): CSSMetadata {
  * <conic-gradient()>  | <repeating-conic-gradient()> ]
  */
 const imageValuePresetMap = new Map([
-  ['linear-gradient()', 'linear-gradient(|45deg, black, transparent|)'],
-  ['radial-gradient()', 'radial-gradient(|black, transparent|)'],
-  ['conic-gradient()', 'conic-gradient(|from 45deg, red, orange, yellow, green, teal, blue, purple|)'],
-  ['repeating-linear-gradient()', 'repeating-linear-gradient(|45deg, black, transparent 100px|)'],
-  ['repeating-radial-gradient()', 'repeating-radial-gradient(|black, transparent 100px|)'],
-  ['repeating-conic-gradient()', 'repeating-conic-gradient(|black 0deg 25%, white 0deg 50%|)'],  // Checkerboard
-  ['url()', 'url(||)'],
-  ['image-set()', 'image-set(|url("") 1x, url("") 2x|)'],
-  ['cross-fade()', 'cross-fade(|url("") 50%, url("") 50%|)'],
+  ['linear-gradient', 'linear-gradient(|45deg, black, transparent|)'],
+  ['radial-gradient', 'radial-gradient(|black, transparent|)'],
+  ['conic-gradient', 'conic-gradient(|from 45deg, red, orange, yellow, green, teal, blue, purple|)'],
+  ['repeating-linear-gradient', 'repeating-linear-gradient(|45deg, black, transparent 100px|)'],
+  ['repeating-radial-gradient', 'repeating-radial-gradient(|black, transparent 100px|)'],
+  ['repeating-conic-gradient', 'repeating-conic-gradient(|black 0deg 25%, white 0deg 50%|)'],  // Checkerboard
+  ['url', 'url(||)'],
+  ['image-set', 'image-set(|url("") 1x, url("") 2x|)'],
+  ['cross-fade', 'cross-fade(|url("") 50%, url("") 50%|)'],
 ]);
 
 const filterValuePresetMap = new Map([
@@ -524,7 +524,7 @@ const valuePresets = new Map([
   ['-webkit-mask-image', imageValuePresetMap],
   ['list-style', imageValuePresetMap],
   ['list-style-image', imageValuePresetMap],
-  ['border-image', imageValuePresetMap],
+  ['border-image', new Map([...imageValuePresetMap, ['fill', 'fill 10%']])],
   ['border-image-source', imageValuePresetMap],
   [
     'transform',
@@ -617,6 +617,12 @@ const valuePresets = new Map([
       ['ex', 'ex alphabetic'],
     ]),
   ],
+  [
+    'border-image-slice',
+    new Map([
+      ['fill', 'fill 10%'],
+    ]),
+  ],
 ]);
 
 const partialValueKeywordsNoPresets = new Map<string, Set<string>>([
@@ -898,17 +904,16 @@ const extraPropertyValues = new Map<string, Set<string>>([
       'stretch',
       'space',
       'round',
-      'auto',  // border-image-width
       'fill',  // border-image-slice
-      'linear-gradient()',
-      'radial-gradient()',
-      'conic-gradient()',
-      'repeating-linear-gradient()',
-      'repeating-radial-gradient()',
-      'repeating-conic-gradient()',
-      'image-set()',
-      'cross-fade()',
-      'url()',
+      'linear-gradient',
+      'radial-gradient',
+      'conic-gradient',
+      'repeating-linear-gradient',
+      'repeating-radial-gradient',
+      'repeating-conic-gradient',
+      'image-set',
+      'cross-fade',
+      'url',
     ]),
   ],
   ['border-image-width', new Set(['auto'])],
@@ -917,15 +922,15 @@ const extraPropertyValues = new Map<string, Set<string>>([
     'border-image-source',
     new Set([
       'none',
-      'linear-gradient()',
-      'radial-gradient()',
-      'conic-gradient()',
-      'repeating-linear-gradient()',
-      'repeating-radial-gradient()',
-      'repeating-conic-gradient()',
-      'image-set()',
-      'cross-fade()',
-      'url()',
+      'linear-gradient',
+      'radial-gradient',
+      'conic-gradient',
+      'repeating-linear-gradient',
+      'repeating-radial-gradient',
+      'repeating-conic-gradient',
+      'image-set',
+      'cross-fade',
+      'url',
     ]),
   ],
   [
@@ -1241,29 +1246,29 @@ const extraPropertyValues = new Map<string, Set<string>>([
       'content-box',
       'padding-box',
       'text',  // background-clip
-      'linear-gradient()',
-      'radial-gradient()',
-      'conic-gradient()',
-      'repeating-linear-gradient()',
-      'repeating-radial-gradient()',
-      'repeating-conic-gradient()',
-      'image-set()',
-      'cross-fade()',
-      'url()',
+      'linear-gradient',
+      'radial-gradient',
+      'conic-gradient',
+      'repeating-linear-gradient',
+      'repeating-radial-gradient',
+      'repeating-conic-gradient',
+      'image-set',
+      'cross-fade',
+      'url',
     ]),
   ],
   [
     'background-image',
     new Set([
-      'linear-gradient()',
-      'radial-gradient()',
-      'conic-gradient()',
-      'repeating-linear-gradient()',
-      'repeating-radial-gradient()',
-      'repeating-conic-gradient()',
-      'image-set()',
-      'cross-fade()',
-      'url()',
+      'linear-gradient',
+      'radial-gradient',
+      'conic-gradient',
+      'repeating-linear-gradient',
+      'repeating-radial-gradient',
+      'repeating-conic-gradient',
+      'image-set',
+      'cross-fade',
+      'url',
     ]),
   ],
   ['background-position', new Set(['top', 'bottom', 'left', 'right', 'center'])],
@@ -1519,29 +1524,29 @@ const extraPropertyValues = new Map<string, Set<string>>([
   [
     'mask-image',
     new Set([
-      'linear-gradient()',
-      'radial-gradient()',
-      'conic-gradient()',
-      'repeating-linear-gradient()',
-      'repeating-radial-gradient()',
-      'repeating-conic-gradient()',
-      'image-set()',
-      'cross-fade()',
-      'url()',
+      'linear-gradient',
+      'radial-gradient',
+      'conic-gradient',
+      'repeating-linear-gradient',
+      'repeating-radial-gradient',
+      'repeating-conic-gradient',
+      'image-set',
+      'cross-fade',
+      'url',
     ]),
   ],
   [
     '-webkit-mask-image',
     new Set([
-      'linear-gradient()',
-      'radial-gradient()',
-      'conic-gradient()',
-      'repeating-linear-gradient()',
-      'repeating-radial-gradient()',
-      'repeating-conic-gradient()',
-      'image-set()',
-      'cross-fade()',
-      'url()',
+      'linear-gradient',
+      'radial-gradient',
+      'conic-gradient',
+      'repeating-linear-gradient',
+      'repeating-radial-gradient',
+      'repeating-conic-gradient',
+      'image-set',
+      'cross-fade',
+      'url',
     ]),
   ],
   ['-webkit-mask-origin', new Set(['border', 'border-box', 'content', 'content-box', 'padding', 'padding-box'])],

package/front_end/core/sdk/CategorizedBreakpoint.ts

@@ -21,7 +21,6 @@ export const enum Category {
   PICTURE_IN_PICTURE = 'picture-in-picture',
   POINTER = 'pointer',
   SCRIPT = 'script',
-  SHARED_STORAGE_WORKLET = 'shared-storage-worklet',
   TIMER = 'timer',
   TOUCH = 'touch',
   TRUSTED_TYPE_VIOLATION = 'trusted-type-violation',

package/front_end/core/sdk/ChildTargetManager.ts

@@ -182,8 +182,6 @@ export class ChildTargetManager extends SDKModel<EventTypes> implements Protocol
       type = Type.WORKLET;
     } else if (targetInfo.type === 'shared_worker') {
       type = Type.SHARED_WORKER;
-    } else if (targetInfo.type === 'shared_storage_worklet') {
-      type = Type.SHARED_STORAGE_WORKLET;
     } else if (targetInfo.type === 'service_worker') {
       type = Type.ServiceWorker;
     } else if (targetInfo.type === 'auction_worklet') {

package/front_end/core/sdk/EmulationModel.ts

@@ -164,12 +164,10 @@ export class EmulationModel extends SDKModel<EmulationModelEventTypes> implement
     const autoDarkModeSetting = settings.moduleSetting('emulate-auto-dark-mode');
     autoDarkModeSetting.addChangeListener(() => {
       const enabled = autoDarkModeSetting.get();
-      mediaFeaturePrefersColorSchemeSetting.setDisabled(enabled);
       mediaFeaturePrefersColorSchemeSetting.set(enabled ? 'dark' : '');
       void this.emulateAutoDarkMode(enabled);
     });
     if (autoDarkModeSetting.get()) {
-      mediaFeaturePrefersColorSchemeSetting.setDisabled(true);
       mediaFeaturePrefersColorSchemeSetting.set('dark');
       void this.emulateAutoDarkMode(true);
     }

package/front_end/core/sdk/EventBreakpointsModel.ts

@@ -24,7 +24,6 @@ export const enum InstrumentationNames {
   SET_INTERVAL_CALLBACK = 'setInterval.callback',
   SCRIPT_FIRST_STATEMENT = 'scriptFirstStatement',
   SCRIPT_BLOCKED_BY_CSP = 'scriptBlockedByCSP',
-  SHARED_STORAGE_WORKLET_SCRIPT_FIRST_STATEMENT = 'sharedStorageWorkletScriptFirstStatement',
   REQUEST_ANIMATION_FRAME = 'requestAnimationFrame',
   CANCEL_ANIMATION_FRAME = 'cancelAnimationFrame',
   REQUEST_ANIMATION_FRAME_CALLBACK = 'requestAnimationFrame.callback',
@@ -122,9 +121,6 @@ export class EventBreakpointsManager implements SDKModelObserver<EventBreakpoint
       InstrumentationNames.SCRIPT_FIRST_STATEMENT,
       InstrumentationNames.SCRIPT_BLOCKED_BY_CSP,
     ]);
-    this.createInstrumentationBreakpoints(Category.SHARED_STORAGE_WORKLET, [
-      InstrumentationNames.SHARED_STORAGE_WORKLET_SCRIPT_FIRST_STATEMENT,
-    ]);
     this.createInstrumentationBreakpoints(Category.TIMER, [
       InstrumentationNames.SET_TIMEOUT,
       InstrumentationNames.CLEAR_TIMEOUT,

package/front_end/core/sdk/NetworkManager.ts

@@ -1207,9 +1207,6 @@ export class NetworkDispatcher implements ProtocolProxyApi.NetworkDispatcher {
     networkRequest.addEventSourceMessage(time, eventName, eventId, data);
   }
 
-  requestIntercepted({}: Protocol.Network.RequestInterceptedEvent): void {
-  }
-
   requestWillBeSentExtraInfo({
     requestId,
     associatedCookies,

package/front_end/core/sdk/PageResourceLoader.ts

@@ -336,8 +336,12 @@ export class PageResourceLoader extends Common.ObjectWrapper.ObjectWrapper<Event
         initiator.target;
     Host.userMetrics.developerResourceScheme(this.getDeveloperResourceScheme(parsedURL));
     if (eligibleForLoadFromTarget) {
-      let mustEnforceCSP = false;
       const isHttp = parsedURL.scheme === 'http' || parsedURL.scheme === 'https';
+      // Default to enforcing CSP for http(s) resources (fail-closed). Only relax
+      // if the isolation-status query positively confirms no connect-src/default-src
+      // directive is present. A null/error response keeps the guard armed so that a
+      // detached-frame or protocol-error path cannot fall through to loadFromHostBindings.
+      let mustEnforceCSP = isHttp;
       if (isHttp && initiator.target) {
         const networkManager = initiator.target.model(NetworkManager);
         if (networkManager) {
@@ -345,14 +349,10 @@ export class PageResourceLoader extends Common.ObjectWrapper.ObjectWrapper<Event
           if (!status && initiator.frameId) {
             status = await networkManager.getSecurityIsolationStatus(null);
           }
-          if (status?.csp) {
-            for (const csp of status.csp) {
-              const directives = csp.effectiveDirectives;
-              if (directives.includes('connect-src') || directives.includes('default-src')) {
-                mustEnforceCSP = true;
-                break;
-              }
-            }
+          if (status) {
+            const csps = status.csp ?? [];
+            mustEnforceCSP = csps.some(csp => csp.effectiveDirectives.includes('connect-src') ||
+                                           csp.effectiveDirectives.includes('default-src'));
           }
         }
       }

package/front_end/core/sdk/RehydratingConnection.ts

@@ -53,6 +53,35 @@ const UIStrings = {
 const str_ = i18n.i18n.registerUIStrings('core/sdk/RehydratingConnection.ts', UIStrings);
 const i18nString = i18n.i18n.getLocalizedString.bind(undefined, str_);
 
+/**
+ * The `traceURL` (and legacy `loadTimelineFromURL`) query parameter is attacker-controllable, and its
+ * fetched response is replayed into the trusted DevTools front-end as synthetic CDP events. Rather
+ * than relying solely on the page-wide `connect-src` CSP, restrict fetches to trusted locations:
+ *  - the same origin as the DevTools front-end,
+ *  - the `devtools:` scheme (bundled resources),
+ *  - a loopback address, the documented way to load a local trace while developing
+ *    (see front_end/panels/timeline/README.md).
+ */
+export function isTraceUrlAllowed(traceUrl: string): boolean {
+  let url: URL;
+  try {
+    url = new URL(traceUrl, window.location.href);
+  } catch {
+    return false;
+  }
+  if (url.protocol === 'devtools:') {
+    return true;
+  }
+  if (url.origin === window.location.origin) {
+    return true;
+  }
+  if (url.protocol === 'http:' || url.protocol === 'https:') {
+    const host = url.hostname.toLowerCase();
+    return host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
+  }
+  return false;
+}
+
 export interface RehydratingConnectionInterface {
   postToFrontend: (arg: ServerMessage) => void;
 }
@@ -69,6 +98,12 @@ export class RehydratingConnectionTransport implements ProtocolClient.Connection
   onMessage: ((arg0: Object) => void)|null = null;
   trace: TraceObject|null = null;
   sessions = new Map<number, RehydratingSessionBase>();
+  /**
+   * Set to the in-flight `traceURL` fetch (including its hydration/error handling) so tests can await
+   * the load deterministically. Stays `undefined` when loading via message passing, or when a
+   * disallowed URL is rejected without fetching.
+   */
+  fetchPromiseForTest?: Promise<void>;
   #onConnectionLost: (message: Platform.UIString.LocalizedString) => void;
   #rehydratingWindow = window;
   #onReceiveHostWindowPayloadBound = this.onReceiveHostWindowPayload.bind(this);
@@ -94,10 +129,23 @@ export class RehydratingConnectionTransport implements ProtocolClient.Connection
     }
 
     if (traceUrl) {
-      void fetch(traceUrl).then(r => r.arrayBuffer()).then(b => Common.Gzip.arrayBufferToString(b)).then(traceJson => {
-        const trace = new TraceObject(JSON.parse(traceJson));
-        void this.startHydration(trace);
-      });
+      // `traceUrl` comes from the page query string and its response is replayed into the trusted
+      // front-end as synthetic CDP events. Only fetch from trusted origins instead of relying on the
+      // page CSP alone.
+      if (!isTraceUrlAllowed(traceUrl)) {
+        this.#onConnectionLost(i18nString(UIStrings.errorLoadingLog));
+        return true;
+      }
+      this.fetchPromiseForTest = fetch(traceUrl)
+                                     .then(r => r.arrayBuffer())
+                                     .then(b => Common.Gzip.arrayBufferToString(b))
+                                     .then(async traceJson => {
+                                       const trace = new TraceObject(JSON.parse(traceJson));
+                                       await this.startHydration(trace);
+                                     })
+                                     .catch(() => {
+                                       this.#onConnectionLost(i18nString(UIStrings.errorLoadingLog));
+                                     });
       return true;
     }
 

package/front_end/core/sdk/Target.ts

@@ -80,9 +80,6 @@ export class Target extends ProtocolClient.InspectorBackend.TargetBase {
           this.#capabilitiesMask |= Capability.STORAGE;
         }
         break;
-      case Type.SHARED_STORAGE_WORKLET:
-        this.#capabilitiesMask = Capability.JS | Capability.LOG | Capability.INSPECTOR | Capability.EVENT_BREAKPOINTS;
-        break;
       case Type.Worker:
         this.#capabilitiesMask = Capability.JS | Capability.LOG | Capability.NETWORK | Capability.TARGET |
             Capability.IO | Capability.MEDIA | Capability.EMULATION | Capability.EVENT_BREAKPOINTS;
@@ -291,7 +288,6 @@ export enum Type {
   // eslint-disable-next-line @typescript-eslint/naming-convention -- Used by web_tests.
   Worker = 'worker',
   SHARED_WORKER = 'shared-worker',
-  SHARED_STORAGE_WORKLET = 'shared-storage-worklet',
   NODE = 'node',
   BROWSER = 'browser',
   AUCTION_WORKLET = 'auction-worklet',