chrome-devtools-frontend 1.0.1690116 → 1.0.1695017

package/front_end/core/sdk/NetworkRequestAccess.ts

@@ -0,0 +1,191 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import type * as NetworkRequest from './NetworkRequest.js';
+import * as SecurityOrigin from './SecurityOrigin.js';
+
+/**
+ * Specifies how a network request's response data (body and headers) can be accessed
+ * relative to the initiating context's security origin.
+ *
+ * DevTools features that inspect network requests (such as AI Assistance) must respect
+ * the browser Same-Origin Policy (SOP) and Cross-Origin Resource Sharing (CORS) rules:
+ * - Same-origin responses are fully readable by the initiating document.
+ * - Cross-origin responses with valid CORS headers (`Access-Control-Allow-Origin`) are readable.
+ * - Opaque cross-origin responses (such as `no-cors` fetches to third-party endpoints) are NOT
+ *   readable by the page and must never have their response bodies or restricted headers exposed
+ *   to unauthorized contexts (b/513821237).
+ */
+export const enum ResponseAccessMode {
+  /** The request target URL is same-origin with the initiator context. */
+  SAME_ORIGIN = 'SAME_ORIGIN',
+  /** The request is cross-origin, but explicit CORS response headers permit access by the initiator. */
+  CORS_ALLOWED = 'CORS_ALLOWED',
+  /** The request is cross-origin without CORS authorization; response body and unexposed headers are restricted. */
+  OPAQUE_CROSS_ORIGIN = 'OPAQUE_CROSS_ORIGIN',
+}
+
+/**
+ * Standard CORS-safelisted response headers that are exposed on cross-origin requests
+ * without requiring explicit `Access-Control-Expose-Headers`.
+ *
+ * @see https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name
+ */
+export const CORS_SAFELISTED_RESPONSE_HEADERS: ReadonlySet<string> = new Set([
+  'cache-control',
+  'content-language',
+  'content-length',
+  'content-type',
+  'expires',
+  'last-modified',
+  'pragma',
+]);
+
+/**
+ * Placeholder text replacing response body content when cross-origin access is forbidden.
+ */
+export const REDACTED_RESPONSE_BODY = '<redacted cross-origin response body>';
+
+/**
+ * Returns whether a network request was made with credentials (cookies or authorization headers)
+ * or received `Set-Cookie` in the response.
+ *
+ * NOTE: The response header `Access-Control-Allow-Credentials: true` is sent by the server
+ * to grant permission for credentialed CORS; it is not a credential sent by the client.
+ *
+ * Example:
+ * If a page makes an uncredentialed request:
+ *   `fetch('https://api.example.com/data', {credentials: 'omit'})`
+ * And the server responds with:
+ *   `Access-Control-Allow-Origin: *`
+ *   `Access-Control-Allow-Credentials: true`
+ * The browser allows the page to read the response under `*` because the client sent no cookies or auth.
+ * If we treated `Access-Control-Allow-Credentials: true` as a credential here, we would falsely mark
+ * this request as credentialed and reject the wildcard `*`.
+ *
+ * @param request The network request to inspect.
+ * @returns True if the request or response carried authentication credentials or cookies.
+ * @see https://fetch.spec.whatwg.org/#credentials
+ */
+export function isRequestCredentialed(request: NetworkRequest.NetworkRequest): boolean {
+  const hasAuthHeaders = Boolean(
+      request.requestHeaderValue('authorization') || request.requestHeaderValue('proxy-authorization'),
+  );
+  const hasCookies = request.includedRequestCookies().length > 0 || request.responseCookies.length > 0 ||
+      Boolean(request.requestHeaderValue('cookie')) || Boolean(request.responseHeaderValue('set-cookie'));
+
+  return hasAuthHeaders || hasCookies;
+}
+
+/**
+ * Evaluates the response access mode for a network request relative to an initiator origin.
+ *
+ * Evaluation rules:
+ * 1. If the initiator security origin is opaque (e.g. sandboxed iframe or `data:` URL), returns `OPAQUE_CROSS_ORIGIN`.
+ * 2. If the initiator security origin is same-origin with the request URL, returns `SAME_ORIGIN`.
+ * 3. If Chrome's network stack flagged a CORS error (`corsErrorStatus`), returns `OPAQUE_CROSS_ORIGIN`.
+ * 4. If the server provided an `Access-Control-Allow-Origin` header:
+ *    - Wildcard `*` grants `CORS_ALLOWED` only if the request does not include credentials. Under the
+ *      Fetch specification, wildcard `*` is invalid for credentialed requests.
+ *    - An explicit match against the initiator origin grants `CORS_ALLOWED` if uncredentialed, or if
+ *      `Access-Control-Allow-Credentials: true` is also present for credentialed requests.
+ * 5. Otherwise, returns `OPAQUE_CROSS_ORIGIN`.
+ *
+ * @param request The network request being inspected.
+ * @param initiatorSecurityOrigin The security origin of the initiating context (e.g. page or conversation origin).
+ * @returns The evaluated `ResponseAccessMode`.
+ */
+export function evaluateResponseAccessMode(
+    request: NetworkRequest.NetworkRequest,
+    initiatorSecurityOrigin: SecurityOrigin.SecurityOrigin,
+    ): ResponseAccessMode {
+  // Opaque initiator contexts (e.g. data: URLs, sandboxed iframes) are never permitted
+  // to inspect cross-origin response content.
+  if (initiatorSecurityOrigin.isOpaque()) {
+    return ResponseAccessMode.OPAQUE_CROSS_ORIGIN;
+  }
+
+  const resourceOrigin = request.requestURLSecurityOrigin();
+  if (initiatorSecurityOrigin.isSameOriginWith(resourceOrigin)) {
+    return ResponseAccessMode.SAME_ORIGIN;
+  }
+
+  // If the browser blocked the request with a CORS error, treat the response
+  // as opaque regardless of any Access-Control-Allow-Origin header value.
+  if (request.corsErrorStatus()) {
+    return ResponseAccessMode.OPAQUE_CROSS_ORIGIN;
+  }
+
+  const allowOriginHeader = request.responseHeaderValue('access-control-allow-origin')?.trim();
+  if (!allowOriginHeader) {
+    return ResponseAccessMode.OPAQUE_CROSS_ORIGIN;
+  }
+
+  const isCredentialed = isRequestCredentialed(request);
+
+  // Under the Fetch specification, wildcard '*' is forbidden from exposing responses if credentials are used.
+  if (allowOriginHeader === '*' && !isCredentialed) {
+    return ResponseAccessMode.CORS_ALLOWED;
+  }
+
+  const allowedOrigin = SecurityOrigin.SecurityOrigin.create(allowOriginHeader);
+  if (initiatorSecurityOrigin.isSameOriginWith(allowedOrigin)) {
+    // Under the WHATWG Fetch specification (§ 3.2.5), when a request includes
+    // credentials (cookies or authorization headers), the response is only exposed
+    // if the server explicitly includes Access-Control-Allow-Credentials: true.
+    if (isCredentialed) {
+      const allowCredentials =
+          request.responseHeaderValue('access-control-allow-credentials')?.trim().toLowerCase() === 'true';
+      if (!allowCredentials) {
+        return ResponseAccessMode.OPAQUE_CROSS_ORIGIN;
+      }
+    }
+    return ResponseAccessMode.CORS_ALLOWED;
+  }
+
+  return ResponseAccessMode.OPAQUE_CROSS_ORIGIN;
+}
+
+/**
+ * Filters the response headers of a network request based on its access mode.
+ *
+ * - `SAME_ORIGIN`: Returns all response headers.
+ * - `CORS_ALLOWED`: Returns CORS-safelisted headers plus headers exposed via
+ *   `Access-Control-Expose-Headers`.
+ * - `OPAQUE_CROSS_ORIGIN`: Returns only CORS-safelisted response headers. Under the Fetch
+ *   specification, opaque responses do not expose headers configured by `Access-Control-Expose-Headers`.
+ *
+ * @param request The network request whose headers are being filtered.
+ * @param accessMode The evaluated response access mode for this request.
+ * @returns Array of allowed header name/value pairs.
+ */
+export function getFilterableResponseHeaders(
+    request: NetworkRequest.NetworkRequest,
+    accessMode: ResponseAccessMode,
+    ): Array<{name: string, value: string}> {
+  if (accessMode === ResponseAccessMode.SAME_ORIGIN) {
+    return request.responseHeaders;
+  }
+
+  if (accessMode === ResponseAccessMode.OPAQUE_CROSS_ORIGIN) {
+    return request.responseHeaders.filter(header => {
+      const lowerName = header.name.toLowerCase().trim();
+      return CORS_SAFELISTED_RESPONSE_HEADERS.has(lowerName);
+    });
+  }
+
+  // For CORS_ALLOWED requests, parse Access-Control-Expose-Headers.
+  const exposeHeadersValue = request.responseHeaderValue('access-control-expose-headers')?.trim() || '';
+  const exposedSet = new Set(
+      exposeHeadersValue.split(',').map(h => h.trim().toLowerCase()).filter(Boolean),
+  );
+
+  const isCredentialed = isRequestCredentialed(request);
+  const allowWildcardExposure = !isCredentialed && exposedSet.has('*');
+
+  return request.responseHeaders.filter(header => {
+    const lowerName = header.name.toLowerCase().trim();
+    return CORS_SAFELISTED_RESPONSE_HEADERS.has(lowerName) || allowWildcardExposure || exposedSet.has(lowerName);
+  });
+}

package/front_end/core/sdk/ResourceTreeModel.ts

@@ -15,6 +15,7 @@ import type {NetworkRequest} from './NetworkRequest.js';
 import {Resource} from './Resource.js';
 import {ExecutionContext, RuntimeModel} from './RuntimeModel.js';
 import {SDKModel} from './SDKModel.js';
+import {SecurityOrigin} from './SecurityOrigin.js';
 import {SecurityOriginManager} from './SecurityOriginManager.js';
 import {StorageKeyManager} from './StorageKeyManager.js';
 import {Capability, type Target, Type} from './Target.js';
@@ -82,6 +83,37 @@ export class ResourceTreeModel extends SDKModel<EventTypes> {
     return result;
   }
 
+  /**
+   * Finds the first active frame that matches the specified security origin under
+   * the given primary page target.
+   *
+   * Returns `null` if the target has no outermost target or if no matching frame
+   * exists.
+   *
+   * @param primaryPageTarget The primary page target that contains the candidate frames.
+   * @param origin The security origin to match.
+   * @returns The first matching frame, or `null` if no frame matches.
+   */
+  static frameForOrigin(
+      primaryPageTarget: Target,
+      origin: SecurityOrigin,
+      ): ResourceTreeFrame|null {
+    const outermostTarget = primaryPageTarget.outermostTarget();
+    if (!outermostTarget) {
+      return null;
+    }
+    for (const frame of ResourceTreeModel.frames(primaryPageTarget.targetManager())) {
+      if (frame.resourceTreeModel().target().outermostTarget() !== outermostTarget) {
+        continue;
+      }
+      if (frame.securityOrigin().isSameOriginWith(origin)) {
+        return frame;
+      }
+    }
+
+    return null;
+  }
+
   static resourceForURL(targetManager: TargetManager, url: Platform.DevToolsPath.UrlString): Resource|null {
     for (const resourceTreeModel of targetManager.models(ResourceTreeModel)) {
       const mainFrame = resourceTreeModel.mainFrame;
@@ -500,24 +532,26 @@ export class ResourceTreeModel extends SDKModel<EventTypes> {
   }
 
   private getSecurityOriginData(): SecurityOriginData {
-    const securityOrigins = new Set<string>();
+    const securityOrigins: SecurityOrigin[] = [];
 
-    let mainSecurityOrigin: string|null = null;
-    let unreachableMainSecurityOrigin: string|null = null;
+    let mainSecurityOrigin: SecurityOrigin|null = null;
+    let unreachableMainSecurityOrigin: SecurityOrigin|null = null;
     for (const frame of this.framesInternal.values()) {
-      const origin = frame.securityOrigin;
-      if (!origin) {
-        continue;
-      }
-
-      securityOrigins.add(origin);
+      const origin = frame.securityOrigin();
       if (frame.isMainFrame()) {
-        mainSecurityOrigin = origin;
+        mainSecurityOrigin = origin.isOpaque() ? null : origin;
         if (frame.unreachableUrl()) {
-          const unreachableParsed = new Common.ParsedURL.ParsedURL(frame.unreachableUrl());
-          unreachableMainSecurityOrigin = unreachableParsed.securityOrigin();
+          const unreachable = SecurityOrigin.create(frame.unreachableUrl());
+          unreachableMainSecurityOrigin = unreachable.isOpaque() ? null : unreachable;
         }
       }
+      if (origin.isOpaque()) {
+        continue;
+      }
+
+      if (!securityOrigins.some(existing => existing.isSameOriginWith(origin))) {
+        securityOrigins.push(origin);
+      }
     }
     return {
       securityOrigins,
@@ -548,9 +582,12 @@ export class ResourceTreeModel extends SDKModel<EventTypes> {
 
   private updateSecurityOrigins(): void {
     const data = this.getSecurityOriginData();
-    this.#securityOriginManager.setMainSecurityOrigin(
-        data.mainSecurityOrigin || '', data.unreachableMainSecurityOrigin || '');
-    this.#securityOriginManager.updateSecurityOrigins(data.securityOrigins);
+    // TODO(crbug.com/559122726): SecurityOriginManager currently expects string identifiers.
+    // Update SecurityOriginManager to store and emit SecurityOrigin objects directly so
+    // that the siteId() conversions below can be removed.
+    this.#securityOriginManager.setMainSecurityOrigin(data.mainSecurityOrigin?.siteId() || '',
+                                                      data.unreachableMainSecurityOrigin?.siteId() || '');
+    this.#securityOriginManager.updateSecurityOrigins(new Set(data.securityOrigins.map(o => o.siteId())));
   }
 
   private async updateStorageKeys(): Promise<void> {
@@ -563,9 +600,10 @@ export class ResourceTreeModel extends SDKModel<EventTypes> {
     return this.mainFrame ? await this.mainFrame.getStorageKey(/* forceFetch */ false) : null;
   }
 
+  // TODO(crbug.com/559122726): Remove siteId() usage and evaluate removing this method in favor of direct SecurityOrigin handling.
   getMainSecurityOrigin(): string|null {
     const data = this.getSecurityOriginData();
-    return data.mainSecurityOrigin || data.unreachableMainSecurityOrigin;
+    return data.mainSecurityOrigin?.siteId() || data.unreachableMainSecurityOrigin?.siteId() || null;
   }
 
   onBackForwardCacheNotUsed(event: Protocol.Page.BackForwardCacheNotUsedEvent): void {
@@ -649,7 +687,7 @@ export class ResourceTreeFrame {
   #name: string|null|undefined;
   #url: Platform.DevToolsPath.UrlString;
   #domainAndRegistry: string;
-  #securityOrigin: string|null;
+  #securityOrigin: SecurityOrigin;
   #securityOriginDetails?: Protocol.Page.SecurityOriginDetails;
   #storageKey?: Promise<string|null>;
   #unreachableUrl: Platform.DevToolsPath.UrlString;
@@ -680,7 +718,7 @@ export class ResourceTreeFrame {
     this.#name = payload?.name;
     this.#url = payload && payload.url as Platform.DevToolsPath.UrlString || Platform.DevToolsPath.EmptyUrlString;
     this.#domainAndRegistry = (payload?.domainAndRegistry) || '';
-    this.#securityOrigin = payload?.securityOrigin ?? null;
+    this.#securityOrigin = SecurityOrigin.create(payload?.securityOrigin ?? '');
     this.#securityOriginDetails = payload?.securityOriginDetails;
     this.#unreachableUrl =
         (payload && payload.unreachableUrl as Platform.DevToolsPath.UrlString) || Platform.DevToolsPath.EmptyUrlString;
@@ -729,7 +767,7 @@ export class ResourceTreeFrame {
     this.#name = framePayload.name;
     this.#url = framePayload.url as Platform.DevToolsPath.UrlString;
     this.#domainAndRegistry = framePayload.domainAndRegistry;
-    this.#securityOrigin = framePayload.securityOrigin;
+    this.#securityOrigin = SecurityOrigin.create(framePayload.securityOrigin);
     this.#securityOriginDetails = framePayload.securityOriginDetails;
     void this.getStorageKey(/* forceFetch */ true);
     this.#unreachableUrl =
@@ -779,7 +817,15 @@ export class ResourceTreeFrame {
     return res.adScriptAncestry || null;
   }
 
-  get securityOrigin(): string|null {
+  /**
+   * Returns the security origin of this frame.
+   *
+   * If the frame does not have a valid origin (such as `about:blank`), this
+   * method returns a unique opaque origin.
+   *
+   * @returns The security origin of the frame.
+   */
+  securityOrigin(): SecurityOrigin {
     return this.#securityOrigin;
   }
 
@@ -1165,10 +1211,13 @@ export class PageDispatcher implements ProtocolProxyApi.PageDispatcher {
 }
 
 SDKModel.register(ResourceTreeModel, {capabilities: Capability.DOM, autostart: true, early: true});
+/**
+ * Aggregated security origin data for frames belonging to a resource tree model.
+ */
 export interface SecurityOriginData {
-  securityOrigins: Set<string>;
-  mainSecurityOrigin: string|null;
-  unreachableMainSecurityOrigin: string|null;
+  securityOrigins: SecurityOrigin[];
+  mainSecurityOrigin: SecurityOrigin|null;
+  unreachableMainSecurityOrigin: SecurityOrigin|null;
 }
 
 export interface StorageKeyData {

package/front_end/core/sdk/SecurityOrigin.ts

@@ -7,11 +7,12 @@ import type * as Platform from '../platform/platform.js';
 
 /**
  * Internal representation of a security origin:
- * - `origin`: A comparable origin string (`<scheme>://<host>[:<port>]` or path-scoped `file://<host>/<path>`).
+ * - `origin`: A comparable origin string (`<scheme>://<host>[:<port>]`).
+ * - `file`: A path-scoped local file origin (`file://<host>/<path>`).
  * - `opaque`: An isolated opaque origin uniquely identified by a UUID that never matches any other origin.
  */
-type InternalOrigin =
-    |{readonly type: 'origin', readonly value: string}|{readonly type: 'opaque', readonly uuid: string};
+type InternalOrigin =|{readonly type: 'origin', readonly value: string}|{readonly type: 'file', readonly value: string}|
+    {readonly type: 'opaque', readonly uuid: string};
 
 /** Exact string matches that represent an invalid or opaque origin. */
 const OPAQUE_EXACT_MATCHES = new Set([
@@ -30,6 +31,17 @@ const OPAQUE_PREFIXES = [
   'blob:null',
 ] as const;
 
+/**
+ * Scheme prefixes for imported artifact data (such as HAR archives and performance traces).
+ * DevTools isolates imported artifacts into scheme-scoped and host-scoped origins
+ * (`imported-har://${host}`, `imported-trace://${host}`). These origins never match live
+ * web origins (`https://${host}`) or other artifact schemes.
+ */
+export const IMPORTED_ORIGIN_PREFIXES: ReadonlySet<string> = new Set([
+  'imported-har:',
+  'imported-trace:',
+]);
+
 function isOpaqueUrlString(url: string): boolean {
   const lower = url.trim().toLowerCase();
   if (OPAQUE_EXACT_MATCHES.has(lower)) {
@@ -60,7 +72,12 @@ function isOpaqueUrlString(url: string): boolean {
  *    `isOpaque()` returns `false` for `file://` URLs, and two `file://` URLs are considered same-origin
  *    only if their full file path and host match exactly.
  *
- * 3. **Opaque Origins**: Opaque contexts (`data:`, `about:blank`, invalid URLs, or synthetic
+ * 3. **Imported Artifact Origins (`imported-har:`, `imported-trace:`)**: Custom schemes for imported
+ *    recordings (such as HAR archives and performance traces) resolve to `<scheme>//<host>`.
+ *    DevTools isolates imported artifact origins from live web pages (`imported-trace://example.com` != `https://example.com`)
+ *    and isolates different artifact schemes from each other (`imported-trace://example.com` != `imported-har://example.com`).
+ *
+ * 4. **Opaque Origins**: Opaque contexts (`data:`, `about:blank`, invalid URLs, or synthetic
  *    opaque origins) are backed by unique UUIDs. An opaque origin never matches any other origin,
  *    even another opaque origin created from the same URL string.
  */
@@ -76,6 +93,8 @@ export class SecurityOrigin {
    *
    * - If the URL is determined to be opaque (e.g. `data:`, `about:blank`, empty, `null`),
    *   a new unique opaque origin is returned.
+   * - If the URL is an imported artifact scheme (e.g. `imported-har:`, `imported-trace:`),
+   *   a scheme-and-host origin (`<scheme>//<host>`) is returned.
    * - If the URL is a `file://` URL, a path-scoped origin (`file://<authority><path>`) is returned.
    * - Otherwise, the standard origin (`<scheme>://<host>[:<port>]`) is extracted and returned.
    *
@@ -86,13 +105,18 @@ export class SecurityOrigin {
       return SecurityOrigin.createUniqueOpaque();
     }
 
+    const importedOrigin = SecurityOrigin.#tryCreateImportedArtifactOrigin(rawUrl);
+    if (importedOrigin) {
+      return importedOrigin;
+    }
+
     if (rawUrl.toLowerCase().startsWith('file://')) {
       const parsed = Common.ParsedURL.ParsedURL.fromString(rawUrl as Platform.DevToolsPath.UrlString);
       if (!parsed) {
         return SecurityOrigin.createUniqueOpaque();
       }
       const authority = parsed.host + (parsed.port ? ':' + parsed.port : '');
-      return new SecurityOrigin({type: 'origin', value: `file://${authority}${parsed.path}`});
+      return new SecurityOrigin({type: 'file', value: `file://${authority}${parsed.path}`});
     }
 
     const origin = Common.ParsedURL.ParsedURL.extractOrigin(rawUrl as Platform.DevToolsPath.UrlString);
@@ -100,7 +124,35 @@ export class SecurityOrigin {
       return SecurityOrigin.createUniqueOpaque();
     }
 
-    return new SecurityOrigin({type: 'origin', value: origin});
+    return new SecurityOrigin({type: 'origin', value: origin.toLowerCase()});
+  }
+
+  /**
+   * Attempts to parse a URL as an imported artifact scheme (such as `imported-har:` or `imported-trace:`).
+   *
+   * Standard web origins do not match imported artifact origins. If the URL starts with an imported
+   * prefix, this helper isolates the origin to `<scheme>//<host>`. If the authority or host is missing,
+   * or if the URL cannot be parsed, it returns a unique opaque origin.
+   *
+   * @param rawUrl The raw URL string to evaluate.
+   * @returns A `SecurityOrigin` if the URL matches an imported artifact scheme, or `null` otherwise.
+   */
+  static #tryCreateImportedArtifactOrigin(rawUrl: string): SecurityOrigin|null {
+    const lowerUrl = rawUrl.toLowerCase();
+    for (const prefix of IMPORTED_ORIGIN_PREFIXES) {
+      if (lowerUrl.startsWith(prefix)) {
+        try {
+          const parsedUrl = new URL(rawUrl);
+          if (!parsedUrl.host) {
+            return SecurityOrigin.createUniqueOpaque();
+          }
+          return new SecurityOrigin({type: 'origin', value: `${parsedUrl.protocol}//${parsedUrl.host.toLowerCase()}`});
+        } catch {
+          return SecurityOrigin.createUniqueOpaque();
+        }
+      }
+    }
+    return null;
   }
 
   /**
@@ -113,6 +165,28 @@ export class SecurityOrigin {
     return new SecurityOrigin({type: 'opaque', uuid: crypto.randomUUID()});
   }
 
+  /**
+   * Creates an isolated security origin for an imported performance trace.
+   *
+   * Imported traces isolate to `imported-trace://${authority}` based on the recorded
+   * main frame URL. If the URL is missing, invalid, or has no host, this returns a
+   * unique opaque origin so that unhosted traces do not share access with each other
+   * or live web origins.
+   *
+   * @param mainFrameURL The URL string of the main frame recorded in the trace.
+   */
+  static createForImportedTrace(mainFrameURL: string|null|undefined): SecurityOrigin {
+    if (!mainFrameURL) {
+      return SecurityOrigin.createUniqueOpaque();
+    }
+    const parsed = Common.ParsedURL.ParsedURL.fromString(mainFrameURL);
+    if (!parsed?.host) {
+      return SecurityOrigin.createUniqueOpaque();
+    }
+    const authority = parsed.host + (parsed.port ? `:${parsed.port}` : '');
+    return SecurityOrigin.create(`imported-trace://${authority}`);
+  }
+
   /**
    * Checks whether this security origin is equivalent to another security origin.
    *
@@ -131,7 +205,7 @@ export class SecurityOrigin {
       return this.#origin.type === 'opaque' && other.#origin.type === 'opaque' &&
           this.#origin.uuid === other.#origin.uuid;
     }
-    return this.#origin.value === other.#origin.value;
+    return this.#origin.type === other.#origin.type && this.#origin.value === other.#origin.value;
   }
 
   /**
@@ -145,12 +219,23 @@ export class SecurityOrigin {
   }
 
   /**
-   * Returns a stable string representation of this origin for identification, storage keys,
-   * or debugging logs.
+   * Returns whether this origin represents a local file origin (`file://`).
+   */
+  isFile(): boolean {
+    return this.#origin.type === 'file';
+  }
+
+  /**
+   * Returns a stable string identifier for display, logging, or storage keys.
+   *
+   * WARNING: Do not compare `siteId()` strings to verify origin equality or
+   * enforce security boundaries. Always use `isSameOriginWith()` instead.
    *
-   * - For standard origins, returns the serialized origin string (e.g. `https://example.com:8080`).
-   * - For file origins, returns the path-scoped origin (e.g. `file:///path/to/file.html`).
-   * - For opaque origins, returns the unique UUID string.
+   * Return formats:
+   * - Standard origins: `<scheme>://<host>[:<port>]` (e.g., `https://example.com:8080`).
+   * - File origins: `file://<authority><path>` (e.g., `file:///path/to/file.html`).
+   * - Opaque origins: A bare UUID string (e.g., `3fa85f64-5717-4562-b3fc-2c963f66afa6`).
+   *   Note: Opaque site IDs do not have URI schemes and are not valid URLs.
    */
   siteId(): string {
     return this.#origin.type === 'opaque' ? this.#origin.uuid : this.#origin.value;

package/front_end/core/sdk/Target.ts

@@ -8,6 +8,7 @@ import * as Platform from '../platform/platform.js';
 import * as ProtocolClient from '../protocol_client/protocol_client.js';
 
 import {SDKModel, type SDKModelConstructor} from './SDKModel.js';
+import {SecurityOrigin} from './SecurityOrigin.js';
 import type {TargetManager} from './TargetManager.js';
 
 export class Target extends ProtocolClient.InspectorBackend.TargetBase {
@@ -15,6 +16,8 @@ export class Target extends ProtocolClient.InspectorBackend.TargetBase {
   #name: string;
   #inspectedURL: Platform.DevToolsPath.UrlString = Platform.DevToolsPath.EmptyUrlString;
   #inspectedURLName = '';
+  /** Caches the parsed security origin for `#inspectedURL`. */
+  #inspectedSecurityOrigin: SecurityOrigin|null = null;
   readonly #capabilitiesMask: number;
   #type: Type;
   readonly #parentTarget: Target|null;
@@ -206,8 +209,23 @@ export class Target extends ProtocolClient.InspectorBackend.TargetBase {
     return this.#inspectedURL;
   }
 
+  /**
+   * Returns the security origin for this target's inspected URL.
+   *
+   * The target caches the origin until `setInspectedURL()` changes the URL.
+   * If the URL is empty or invalid, this method returns a unique opaque origin.
+   * An opaque origin does not match any other origin.
+   */
+  inspectedSecurityOrigin(): SecurityOrigin {
+    if (!this.#inspectedSecurityOrigin) {
+      this.#inspectedSecurityOrigin = SecurityOrigin.create(this.#inspectedURL);
+    }
+    return this.#inspectedSecurityOrigin;
+  }
+
   setInspectedURL(inspectedURL: Platform.DevToolsPath.UrlString): void {
     this.#inspectedURL = inspectedURL;
+    this.#inspectedSecurityOrigin = null;
     const parsedURL = Common.ParsedURL.ParsedURL.fromString(inspectedURL);
     this.#inspectedURLName = parsedURL ? parsedURL.lastPathComponentWithFragment() : '#' + this.#id;
     this.#targetManager.onInspectedURLChange(this);

package/front_end/core/sdk/sdk.ts

@@ -26,6 +26,7 @@ import * as CrashReportContextModel from './CrashReportContextModel.js';
 import * as CSSContainerQuery from './CSSContainerQuery.js';
 import * as CSSFontFace from './CSSFontFace.js';
 import * as CSSLayer from './CSSLayer.js';
+import * as CSSLocation from './CSSLocation.js';
 import * as CSSMatchedStyles from './CSSMatchedStyles.js';
 import * as CSSMedia from './CSSMedia.js';
 import * as CSSMetadata from './CSSMetadata.js';
@@ -58,6 +59,7 @@ import * as LayerTreeBase from './LayerTreeBase.js';
 import * as LogModel from './LogModel.js';
 import * as NetworkManager from './NetworkManager.js';
 import * as NetworkRequest from './NetworkRequest.js';
+import * as NetworkRequestAccess from './NetworkRequestAccess.js';
 import * as OverlayColorGenerator from './OverlayColorGenerator.js';
 import * as OverlayModel from './OverlayModel.js';
 import * as OverlayPersistentHighlighter from './OverlayPersistentHighlighter.js';
@@ -114,6 +116,7 @@ export {
   CSSContainerQuery,
   CSSFontFace,
   CSSLayer,
+  CSSLocation,
   CSSMatchedStyles,
   CSSMedia,
   CSSMetadata,
@@ -146,6 +149,7 @@ export {
   LogModel,
   NetworkManager,
   NetworkRequest,
+  NetworkRequestAccess,
   OverlayColorGenerator,
   OverlayModel,
   OverlayPersistentHighlighter,

package/front_end/entrypoints/main/MainImpl.ts

@@ -214,6 +214,8 @@ export class MainImpl {
     };
     this.#universe = new Foundation.Universe.Universe(creationOptions);
     Root.DevToolsContext.setGlobalInstance(this.#universe.context as Root.DevToolsContext.WritableDevToolsContext);
+    // Needed to allow CD4A to access the server bridge class.
+    (globalThis as unknown as {universe: Foundation.Universe.Universe}).universe = this.#universe;
 
     // Mark 'cache-disabled' as requiring user interaction when multiple CDP clients are attached.
     if (Root.Runtime.Runtime.queryParam('hasOtherClients')) {
@@ -552,6 +554,7 @@ export class MainImpl {
           inspectorView.displaySelectOverrideFolderInfobar(event.data);
         });
     await inspectorView.createToolbars();
+    inspectorView.renderStatusBar();
     Host.InspectorFrontendHost.InspectorFrontendHostInstance.loadCompleted();
 
     // Initialize elements for the live announcer functionality for a11y.
@@ -669,7 +672,7 @@ export class MainImpl {
   }
 
   #redispatchClipboardEvent(event: Event): void {
-    const eventCopy = new CustomEvent('clipboard-' + event.type, {bubbles: true});
+    const eventCopy = new CustomEvent('clipboard-' + event.type, {bubbles: true, composed: true});
     // @ts-expect-error Used in ElementsTreeOutline
     eventCopy['original'] = event;
     const document = event.target && (event.target as HTMLElement).ownerDocument;
@@ -702,6 +705,10 @@ export class MainImpl {
     UI.InspectorView.InspectorView.instance().onSuspendStateChanged(suspended);
   }
 
+  redispatchClipboardEventForTest(event: Event): void {
+    this.#redispatchClipboardEvent(event);
+  }
+
   static instanceForTest: MainImpl|null = null;
 }