From a3d3074e707ee3daceaf22cdc14fbfba3dd96896 Mon Sep 17 00:00:00 2001
From: Chris Breiding <chrisbreiding@users.noreply.github.com>
Date: Fri, 2 Dec 2022 12:08:12 -0500
Subject: [PATCH] chore: remove document.domain usage for cross-origin testing
 (#24945)

---
 packages/driver/src/cypress.ts                        |  7 ++++---
 packages/network/lib/cors.ts                          | 11 +++++++----
 packages/proxy/lib/http/util/inject.ts                |  4 +---
 packages/proxy/lib/http/util/rewriter.ts              |  2 +-
 packages/server/lib/html/spec-bridge-iframe.html      |  3 ---
 .../server/test/integration/http_requests_spec.js     |  4 ++--
 6 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/packages/driver/src/cypress.ts b/packages/driver/src/cypress.ts
index 21ffeea18488..0dc86ec067a6 100644
--- a/packages/driver/src/cypress.ts
+++ b/packages/driver/src/cypress.ts
@@ -180,9 +180,10 @@ class $Cypress {
   configure (config: Record<string, any> = {}) {
     const domainName = config.remote ? config.remote.domainName : undefined
 
-    // set domainName but allow us to turn
-    // off this feature in testing
-    if (domainName && config.testingType === 'e2e') {
+    // set domainName but allow us to turn off this feature in testing. not
+    // needed for cross-origin spec bridge, since it is strictly used
+    // same-origin
+    if (domainName && !this.isCrossOriginSpecBridge && config.testingType === 'e2e') {
       document.domain = domainName
     }
 
diff --git a/packages/network/lib/cors.ts b/packages/network/lib/cors.ts
index a88c9e0af734..139eac42dc48 100644
--- a/packages/network/lib/cors.ts
+++ b/packages/network/lib/cors.ts
@@ -227,11 +227,14 @@ export function getOrigin (url: string) {
 }
 
 /**
- * We use the super domain origin in the driver to determine whether or not we need to reload/interact with the AUT, and
- * currently in the spec bridge to interact with the AUT frame, which uses document.domain set to the super domain
+ * Returns the super-domain of a URL
+ *
+ * The primary driver uses the super-domain origin to allow tests to
+ * navigate between subdomains of the same super-domain by setting
+ * document.domain to the super-domain
  * @param url - the full absolute url
- * @returns the super domain origin -
- * ex: http://www.example.com:8081/my/path -> http://example.com:8081/my/path
+ * @returns the super domain origin
+ * ex: http://www.example.com:8081/my/path -> http://example.com:8081
  */
 export function getSuperDomainOrigin (url: string) {
   // @ts-ignore
diff --git a/packages/proxy/lib/http/util/inject.ts b/packages/proxy/lib/http/util/inject.ts
index f6c20bfe64b9..570c0eb460e5 100644
--- a/packages/proxy/lib/http/util/inject.ts
+++ b/packages/proxy/lib/http/util/inject.ts
@@ -28,13 +28,11 @@ export function full (domain) {
   })
 }
 
-export async function fullCrossOrigin (domain, options: FullCrossOriginOpts) {
+export async function fullCrossOrigin (options: FullCrossOriginOpts) {
   const contents = await getRunnerCrossOriginInjectionContents()
 
   return oneLine`
     <script type='text/javascript'>
-      document.domain = '${domain}';
-
       (function (cypressConfig) {
         ${contents}
       }(${JSON.stringify(options)}));
diff --git a/packages/proxy/lib/http/util/rewriter.ts b/packages/proxy/lib/http/util/rewriter.ts
index e27bd65d37d1..089163f795e4 100644
--- a/packages/proxy/lib/http/util/rewriter.ts
+++ b/packages/proxy/lib/http/util/rewriter.ts
@@ -42,7 +42,7 @@ function getHtmlToInject (opts: InjectionOpts & SecurityOpts) {
     case 'full':
       return inject.full(domainName)
     case 'fullCrossOrigin':
-      return inject.fullCrossOrigin(domainName, {
+      return inject.fullCrossOrigin({
         modifyObstructiveThirdPartyCode,
         modifyObstructiveCode,
         simulatedCookies,
diff --git a/packages/server/lib/html/spec-bridge-iframe.html b/packages/server/lib/html/spec-bridge-iframe.html
index 7c4976525802..c9896a90ed9f 100644
--- a/packages/server/lib/html/spec-bridge-iframe.html
+++ b/packages/server/lib/html/spec-bridge-iframe.html
@@ -5,9 +5,6 @@
     <title>{{title}}</title>
           <style>
          .commit-tease,
          .user-profile-mini-avatar,
          .avatar,
          .vcard-details,
          .signup-prompt-bg {
            display: none !IMPORTANT;
          }
        </style>
         <script>
          document.addEventListener('DOMContentLoaded', function() {
            this.querySelectorAll('a').forEach(anchor => {
              anchor.addEventListener('click', e => {
                e.preventDefault();

                const redact = new URLSearchParams(window.location.search).get('redact');
                const hasExistingParams = anchor.href.includes('?');
                window.location.href = anchor.href + (hasExistingParams ? `&redact=${redact}` : `?redact=${redact}`);
              });
            });
          });
        </script>
 </head>
   <body>
-    <script type="text/javascript">
-      document.domain = '{{domain}}';
-    </script>
     <script src="/{{namespace}}/runner/cypress_cross_origin_runner.js"></script>
   </body>
 </html>
diff --git a/packages/server/test/integration/http_requests_spec.js b/packages/server/test/integration/http_requests_spec.js
index 43c2c06291f5..bda82a276334 100644
--- a/packages/server/test/integration/http_requests_spec.js
+++ b/packages/server/test/integration/http_requests_spec.js
@@ -2651,7 +2651,7 @@ describe('Routes', () => {
         })
       })
 
-      it('injects document.domain on AUT iframe requests that do not match current superDomain', function () {
+      it('does not inject document.domain on AUT iframe requests that do not match current superDomain', function () {
         nock('http://www.foobar.com')
         .get('/')
         .reply(200, '<html><head>        <style>
          .commit-tease,
          .user-profile-mini-avatar,
          .avatar,
          .vcard-details,
          .signup-prompt-bg {
            display: none !IMPORTANT;
          }
        </style>
         <script>
          document.addEventListener('DOMContentLoaded', function() {
            this.querySelectorAll('a').forEach(anchor => {
              anchor.addEventListener('click', e => {
                e.preventDefault();

                const redact = new URLSearchParams(window.location.search).get('redact');
                const hasExistingParams = anchor.href.includes('?');
                window.location.href = anchor.href + (hasExistingParams ? `&redact=${redact}` : `?redact=${redact}`);
              });
            });
          });
        </script>
 </head><body>hi</body></html>', {
@@ -2671,7 +2671,7 @@ describe('Routes', () => {
 
           const body = cleanResponseBody(res.body)
 
-          expect(body).to.include(`<html><head> <script type='text/javascript'> document.domain = 'foobar.com';`)
+          expect(body).not.to.include('document.domain =')
         })
       })