From a08dc792b9b0d0ef1efc58e001e39780e281608d Mon Sep 17 00:00:00 2001 From: Antonio Sartori Date: Wed, 17 Mar 2021 08:59:05 +0100 Subject: [PATCH] Add CSPs and fix some stuff --- source | 195 ++++++++++++++++++++++++++++++++++----------------------- 1 file changed, 116 insertions(+), 79 deletions(-) diff --git a/source b/source index 47a859d3916..02e76131213 100644 --- a/source +++ b/source @@ -2470,7 +2470,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • ABNF
  • about:blank
  • An HTTP(S) scheme
    • -
  • A local URL
    • +
  • A URL which is local
  • A local scheme
  • A fetch scheme
  • CORS protocol
    • @@ -3838,7 +3838,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • The Content Security Policy syntax
  • enforce the policy
  • The parse a serialized Content Security Policy algorithm
    • -
  • The Initialize a global object's CSP list algorithm
  • The Initialize a Document's CSP list algorithm
  • The Should element's inline behavior be blocked by Content Security Policy? algorithm
  • The Should navigation request of type be blocked by Content Security Policy? algorithm
    • @@ -6821,8 +6820,8 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute

    1. Let CSP list be element's shadow-including root's CSP - list.

      2. + root">shadow-including root's policy + container's CSP list.

    2. If CSP list contains a header-delivered Content Security Policy, and @@ -6846,11 +6845,13 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute

    -

    As each Document's CSP - list is append-only, user agents can optimize away the contains a header-delivered - Content Security Policy check by, for example, holding a flag on the Document, - set during Document - creation and initialization.

    +

    As each Document's policy container's CSP list is append-only, user agents can optimize away + the contains a header-delivered Content Security Policy check by, for example, + holding a flag on the CSP list, set when creating the policy container for the + fetch response.

    The cloning steps for elements that include HTMLOrSVGElement must set the @@ -9155,11 +9156,6 @@ partial interface Document {

    The Document has an embedder policy (an embedder policy).

    -

    The Document has a CSP list, which is a CSP list - containing all of the Content Security Policy objects active for the document. The - list is empty unless otherwise specified.

    -

    The Document has a permissions policy, which is a permissions policy, which is initially @@ -30247,7 +30243,8 @@ interface HTMLIFrameElement : HTMLElement { data-x="attr-iframe-srcdoc">srcdoc attribute, and CSP list is a clone of element's node document's CSP list.

    + data-x="concept-document-policy-container">policy container's CSP list.

    The resulting Document must be considered an iframe srcdoc document.

    @@ -77747,7 +77744,8 @@ popup4.close(); embedder policy.

  • If creator is non-null, then set document's policy - container to a clone of creator's policy container.

    • + container to a clone of + creator's policy container.

  • Add document to browsingContext's session history.

    • @@ -82679,29 +82677,50 @@ interface BarProp {

    Policy container

    A policy container is a struct containing policies that apply to a - document. It has the following items:

    + Document or global object. It has the following items:

    + +
    -

    There are no items at the moment. Each item has to define a default value for creating a new - policy container.

    +

    Each item has to define a default value for creating a new policy container.

    +

    Move other policies into the policy container.

    +

    To clone a policy container from a given policy container policy container:

    1. Let clone be a new policy container.

      2. -

    2. For each item of policy container, set the - corresponding item of clone to an equal - value.

      3. +

    3. For each policy in policy container's CSP list, insert a copy of policy into + clone's CSP list.

    4. Return clone.

    +

    To determine whether a URL URL requires storing the policy + container in history:

    + +
      +

    1. If URL's scheme is "blob", return false.

      2. + +

    2. If URL is "about:srcdoc", return false.

      3. + +

    3. If URL is local, return true.

      4. + +

    4. Return false.

      5. +
    +

    To create a policy container for - a fetch response from a given URL response URL and header list header list:

    + a fetch response from a given response + response:

    1. If response URL's scheme is "BarProp { data-x="blob-url-entry-environment">environment's policy container.

      2. -

    2. Let result be a new policy container.

      3. +

    3. Otherwise, let result be a new policy container.

      4. -

    4. For each item of result, set item to be the result of parsing header list into item.

      5. +

    5. For each policy in response's CSP list, insert a copy of policy into + result's CSP list.

    6. Return result.

    To determine navigationParams - policy container from a given URL response url and four optional + policy container from a given URL response URL and four optional policy containers history policy container, initiator policy container, parent policy container and response policy container:

      -

    1. If history policy container is not null, then assert that response - url is local and return a clone of history policy container.

      2. +
    2. +

      If history policy container is not null, then:

      + +
        +

      1. Assert: response URL requires storing the policy container in + history.

        2. + +

      2. Return a clone of history policy + container.

        3. +
      +
      3. + +
    3. +

      If response URL is about:srcdoc, then:

      + +
        +

      1. Assert: parent policy container is not null.

        2. -

      2. If response url is about:srcdoc, then assert that parent - policy container is not null and return a clone of parent policy container.

        3. +

      3. Return a clone of parent policy + container.

        4. +
      +
      4. -

    4. If response url is local and initiator +

    5. If response URL is local and initiator policy container is not null, then return a clone of initiator policy container.

      6. @@ -82745,13 +82779,33 @@ interface BarProp {

    6. Otherwise, return a new policy container.

    -

    To determine a worker's policy - container from a given URL response url, a set of - Document and WorkerGlobalScope objects worker owner set and a - header list header list:

    +

    To initialize a worker global scope's policy + container given a WorkerGlobalScope worker global scope and a response response:

      -

    1. TODO: FILL.

      2. +
    2. +

      If worker global scope's url + is local but not "blob" or if worker + global scope is a DedicatedWorkerGlobalScope:

      + +
        +

      1. Assert that worker global scope's owner set contains exactly one + element.

        2. + +

      2. For each owner in worker global scope's owner set and + for each policy in owner's policy container CSP list, insert a copy of policy into + worker global scope's policy container CSP list.

        +
      +
      3. + +

    3. Otherwise, set worker global scope's policy container to the result of + creating a policy container for a fetch response given response.

    Session history and navigation

    @@ -84766,8 +84820,8 @@ interface Location { // but see also determining navigationParams policy container given resource's url, historyPolicyContainer, initiatorPolicyContainer, parent browsing - context's active document's current policy container (if - any) and null.

    + context's active document's policy container and + null.

  • Let navigationParams be a new navigation params whose request is null, Location { // but see also URL and response's header list.

    • + container for a fetch response response.

  • If browsingContext is a top-level browsing context, then:

    @@ -85603,9 +85655,7 @@ interface Location { // but see also     unsafe-none    ".

  • Initialize a Document's CSP list given - document, navigationParams's response, and navigationParams's request.

    + document.

  • If navigationParams's request is @@ -85758,10 +85808,10 @@ new PaymentRequest(…); // Allowed to use more discussion on this.

    • -

  • If newDocument's URL is local, let newEntry's policy container be navigationParams's policy container.

    • +

  • If newDocument's URL + requires storing the policy container in history, let newEntry's + policy container be navigationParams's + policy container.

  • Insert newEntry into sessionHistory after its current entry.

    • @@ -85789,10 +85839,10 @@ new PaymentRequest(…); // Allowed to use data-x="concept-document-url">URL and document is newDocument.

    -

  • If newDocument's URL is local, let newEntry's policy container be navigationParams's policy container.

    • +

  • If newDocument's URL + requires storing the policy container in history, let newEntry's + policy container be navigationParams's + policy container.

  • Append newEntry to sessionHistory.

    • @@ -87068,8 +87118,8 @@ interface BeforeUnloadEvent : Event {

    To check a navigation response's adherence to `X-Frame-Options`, given - a response response, a browsing - context browsingContext, and an origin + navigationParams navigationParams, a + browsing context browsingContext, and an origin destinationOrigin:

      @@ -87077,8 +87127,9 @@ interface BeforeUnloadEvent : Event { true.

    1. -

      For each policy of response's CSP list:

      +

      For each policy of navigationParams' + policy container's CSP list:

      1. If policy's disposition is not "BeforeUnloadEvent : Event {

      2. Let rawXFrameOptions be the result of getting, decoding, and splitting - `X-Frame-Options` from response's X-Frame-Options` from navigationParams's response's header list.

      3. Let xFrameOptions be a new set.

        4. @@ -98978,11 +99030,6 @@ interface WorkerGlobalScope : EventTarget { data-x="concept-WorkerGlobalScope-embedder-policy">embedder policy (an embedder policy).

        -

        A WorkerGlobalScope object has an associated CSP list, which is a CSP list containing all of the Content Security - Policy objects active for the worker. It is initially an empty list.

        -

        A WorkerGlobalScope object has an associated module map. It is a module map, initially empty.

        @@ -99415,12 +99462,8 @@ interface SharedWorkerGlobalScope : WorkerGlobalScope { data-x="concept-WorkerGlobalScope-url">url to response's url.

        -

      4. Set worker global scope's policy container to the result of - determining a worker's policy - container given url, worker global scope's owner set - and response's header - list.

        5. +

      5. Initialize worker global scope's + policy container given worker global scope, and response.

      6. Set worker global scope's referrer policy to the result of @@ -99485,9 +99528,6 @@ interface SharedWorkerGlobalScope : WorkerGlobalScope { issue #207 for more details.

        7. -

      7. Initialize a global object's CSP list given worker global scope - and response.

        8. -

      8. Asynchronously complete the perform the fetch steps with response.

      @@ -100813,9 +100853,6 @@ interface WorkletGlobalScope {}; settings object">setting up a worklet environment settings object given realmExecutionContext and outsideSettings.

      2. -

    2. Initialize a global object's CSP list given workletGlobalScope. -

      3. -

    3. For each moduleURL of worklet's added modules list: