Skip to content

Commit

Permalink
Create a new reserved environment for cross-origin redirects.
Browse files Browse the repository at this point in the history 
Previously, a navigation would create a reserved environment once,
and use it for all redirects. This commit changes that so
a new environment is created on a cross-origin redirect.

This also runs CSP for each redirect, which is probably more
correct.

Per w3c/ServiceWorker#1316
  • Loading branch information
@mfalken
mfalken committed Sep 28, 2018
1 parent 6fbb7ff commit f023ea3
Showing 1 changed file with 62 additions and 37 deletions.
99 changes: 62 additions & 37 deletions source
View file
Original file line number Diff line number Diff line change
Expand Up @@ -82092,54 +82092,79 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
data-x="concept-request-origin">origin</span> to that <span>browsing context scope
origin</span>.</p></li>

<li>
<p>Create a new <span>environment</span> <var>reservedEnvironment</var>, and set its <span
data-x="concept-environment-id">id</span> to a new unique opaque string, its <span
data-x="concept-environment-creation-url">creation URL</span> to <var>request</var>'s
<span>url</span>, and its <span data-x="concept-environment-target-browsing-context">target
browsing context</span> to <var>browsingContext</var>.</p>
<li><p>Let <var>done</var> be false and <var>reservedEnvironment</var> be null.</p></li>

<p class="note">The created environment's <span
data-x="concept-environment-active-service-worker">active service worker</span> is set in the
<span data-x="on-fetch-request-algorithm">handle fetch</span> algorithm during the fetch if its
<span data-x="concept-environment-creation-url">creation URL</span> matches a service worker
registration. <ref spec="SW"></p>
</li>
<li><p>Repeat the following steps until <var>done</var> is true:</p>

<li><p>Set <var>request</var>'s <span data-x="concept-request-reserved-client">reserved
client</span> to <var>reservedEnvironment</var>.</p></li>
<ol>
<li><p>If <var>reservedEnvironment</var> is not null, and <var>response</var>'s <span
data-x="concept-response-location-url">location URL</span> does not have the
<span>same origin</span> as <var>reservedEnvironment</var>'s <span
data-x="concept-environment-creation-url">creation URL</span>, then:</p>

<li>
<p>If the <span>Should navigation request of type from source in target be blocked by Content
Security Policy?</span> algorithm returns "<code data-x="">Blocked</code>" when executed upon
<var>request</var>, <var>navigationType</var>, <var>sourceBrowsingContext</var>, and
<var>browsingContext</var>, then set <var>response</var> to a network error.
<ref spec="CSP"></p>
<ol>
<li><p>Run the <span>environment discarding steps</span> for <var>reservedEnvironment</var>.
</p></li>

<p>Otherwise:</p>
<li><p>Set <var>reservedEnvironment</var> to null.</p></li>
</ol>
</li>

<ol>
<!--FETCH--><li><p><span data-x="concept-fetch">Fetch</span> <var>request</var>.</p></li>
<li><p>If <var>reservedEnvironment</var> is null, let <var>reservedEnvironment</var> be a new
<span>environment</span>, and set its <span data-x="concept-environment-id">id</span> to a new
unique opaque string, its <span data-x="concept-environment-creation-url">creation URL</span>
to <var>request</var>'s <span>url</span>, and its <span
data-x="concept-environment-target-browsing-context">target browsing context</span> to
<var>browsingContext</var>.</p></li>

<li><p>Wait for the <span data-x="concept-task">task</span> on the <span>networking task
source</span> to <span>process response</span> and set <var>response</var> to the
result.</p></li>
</ol>
</li>
<li>
<p>If <var>response</var> is not null, set <var>reservedEnvironment</var>'s <span
data-x="concept-environment-creation-url">creation URL</span> to <var>response</var>'s <span
data-x="concept-response-location-url">location URL</span>.</p>

<p class="note">The created environment's <span
data-x="concept-environment-active-service-worker">active service worker</span> is set in the
<span data-x="on-fetch-request-algorithm">Handle Fetch</span> algorithm during the fetch if
the request URL matches a service worker registration. <ref spec="SW"></p>
</li>

<li><p>Set <var>request</var>'s <span data-x="concept-request-reserved-client">reserved
client</span> to <var>reservedEnvironment</var>.</p></li>

<li><p>If the <span>Should navigation request of type from source in target be blocked by Content
Security Policy?</span> algorithm returns "<code data-x="">Blocked</code>" when executed upon
<var>request</var>, <var>navigationType</var>, <var>sourceBrowsingContext</var>, and
<var>browsingContext</var>, then set <var>response</var> to a network error, and set
<var>done</var> to true. <ref spec="CSP"></p></li>

<li><p>Otherwise:</p>
<ol>
<li><p>If <var>response</var> is null, <!--FETCH--><span
data-x="concept-fetch">fetch</span> <var>request</var>.</p></li>

<li><p>Otherwise, perform <span>HTTP-redirect fetch</span> using
<var>request</var> and <var>response</var>.</p></li>

<li id="navigate-redirect-step">
<p>If <var>response</var> has a <span data-x="concept-response-location-url">location URL</span>
and it is either failure or a <span>URL</span> whose <span
data-x="concept-url-scheme">scheme</span> is an <span>HTTP(S) scheme</span>, then set
<var>response</var> to the result of performing <span>HTTP-redirect fetch</span> using
<var>request</var> and <var>response</var> and then run this step again.</p>
<li><p>Wait for the <span data-x="concept-task">task</span> on the <span>networking task
source</span> to <span>process response</span> and set <var>response</var> to the
result.</p></li>

<p class="note">Navigation handles redirects manually as navigation is the only place in the web
platform that cares for redirects to <code data-x="mailto protocol">mailto:</code> URLs and
such.</p>
<li><p>If <var>response</var> does not have a <span
data-x="concept-response-location-url">location URL</span> or the <span
data-x="concept-response-location-url">location URL</span> is not a <span>URL</span> whose
<span data-x="concept-url-scheme">scheme</span> is an <span>HTTP(S) scheme</span>,
then set <var>done</var> to true.</p></li>
</ol>
</li>
<p class="note">Navigation handles redirects manually as navigation is the only place in the web
platform that cares for redirects to <code data-x="mailto protocol">mailto:</code> URLs and
such.</p>
</ol>
</li>

<li><p>If <var>response</var> has a <span data-x="concept-response-location-url">location
URL</span> that is failure, then set <var>response</var> to a network error.</p></li>

<li><p>Otherwise, if <var>response</var> has a <span
data-x="concept-response-location-url">location URL</span> that is a <span>URL</span> whose <span
data-x="concept-url-scheme">scheme</span> is "<code data-x="">blob</code>", "<code
Expand Down

0 comments on commit f023ea3

Please sign in to comment.