Repository navigation
Decide secure contexts of top-level about:blank documents by origin - #13110
Open
shannonbooth wants to merge 1 commit into
Open
shannonbooth wants to merge 1 commit into
shannonbooth wants to merge 1 commit into
Conversation
A top-level about:blank Document has about:blank as its top-level creation URL, which "Is url potentially trustworthy?" always accepts. The secure context algorithm now uses the environment's top-level origin for these instead. This changes three cases: * A Document created by navigating a top-level traversable to about:blank was a secure context regardless of its origin. This meant an http: page could navigate a same-origin popup to about:blank and use [SecureContext] APIs through it. It is now a secure context only if its origin is potentially trustworthy, matching the behaviour of Chromium, Webkit, and Gecko. * whatwg#13103 made a popup's initial about:blank Document copy its creator's top-level creation URL. That is wrong when the creator is a non-secure context with a potentially trustworthy origin, such as an https: iframe in an http: page: the popup was not a secure context, and neither was the same-origin Document that later reused its Window. That step is reverted where instead the popup is now decided by its own origin, matching the behaviour of Chromium, Gecko and WebKit. * A popup's about:blank Document with an opaque origin, such as one opened by a sandboxed iframe with allow-popups-to-escape-sandbox, is not a secure context, since an opaque origin is never potentially trustworthy. This matches Safari.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A top-level about:blank Document has about:blank as its top-level creation URL, which "Is url potentially trustworthy?" always accepts. The secure context algorithm now uses the environment's top-level origin for these instead. This changes three cases:
A Document created by navigating a top-level traversable to about:blank was a secure context regardless of its origin. This meant an http: page could navigate a same-origin popup to about:blank and use [SecureContext] APIs through it. It is now a secure context only if its origin is potentially trustworthy, matching the behaviour of Chromium, Webkit, and Gecko.
Make popups and top-level data: documents follow their creator for secure contexts #13103 made a popup's initial about:blank Document copy its creator's top-level creation URL. That is wrong when the creator is a non-secure context with a potentially trustworthy origin, such as an https: iframe in an http: page: the popup was not a secure context, and neither was the same-origin Document that later reused its Window. That step is reverted where instead the popup is now decided by its own origin, matching the behaviour of Chromium, Gecko and WebKit.
A popup's about:blank Document with an opaque origin, such as one opened by a sandboxed iframe with allow-popups-to-escape-sandbox, is not a secure context, since an opaque origin is never potentially trustworthy. This matches WebKit.
Tests: web-platform-tests/wpt#64008
Follow up to #13103, Fixes #13109
I am not 100% confident in these changes - though to my understanding they do seem very sensible and more correct - it took me a few attempts before I could get the test matrix matching. In particular, I am a little confused about the last bulleted above. I am not sure what behaviour should be specified here, WebKit one seems simplest to me, so I've gone with that. Firefox/Chromium might have better behaviour though.
(See WHATWG Working Mode: Changes for more details.)
/document-sequences.html ( diff )
/infrastructure.html ( diff )
/webappapis.html ( diff )