Skip to content

Commit

Permalink
Use initiatorOrigin instead of sec-fetch-site
Browse files Browse the repository at this point in the history 
`sec-fetch-site: same-origin` was being checked to tell if a navigation was
initiated by a different origin. However, request headers can't be inspected at
this point of the algorithm.

Plumb through the initiatorOrigin parameter when loading a document and compare
that with navigation params's origin field, using the `is same site` steps.
  • Loading branch information
@bokand
bokand committed Nov 21, 2023
1 parent 02494f2 commit b012092
Show file tree
Hide file tree
Showing 2 changed files with 60 additions and 9 deletions.
39 changes: 34 additions & 5 deletions index.bs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1159,7 +1159,37 @@ Amend the definition of <a href="https://html.spec.whatwg.org/multipage/browsing
> to take a user navigation involvement as a parameter, using it to populate the field when creating
> a new navigation params.

Amend the <a
Amend <a
href="https://html.spec.whatwg.org/multipage/document-lifecycle.html#initialise-the-document-object">create
and initialize a Document object</a> to take the initiator origin as a new parameter:

> <strong>Monkeypatching [[HTML]]:</strong>
>
> <div class="monkeypatch">A session history entry is a struct with the following items:
> To load an HTML document, given navigation params navigationParams <span class="diff">and
> <a href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin">origin</a>
> <var ignore>initiatorOrigin</var></span>:
> </div>

and pass the initiator origin as an argument wherever it is called, specifically through the
<a href="https://html.spec.whatwg.org/multipage/document-lifecycle.html#navigate-html">load an HTML
document</a> steps and the
<a href="https://html.spec.whatwg.org/multipage/browsing-the-web.html#loading-a-document">Load a
document</a> steps:

> <strong>Monkeypatching [[HTML]]:</strong>
>
> <div class="monkeypatch">
> <dl class="switch">
> <dt>an <span>HTML MIME type</span></dt>
> <dd>
> Return the result of loading an HTML document, given <var ignore>navigationParams</var>
> <span class="diff">and <var ignore>initiatorOrigin</var></span>.
> </dd>
> <dl>
> </div>

and amend the <a
href="https://html.spec.whatwg.org/multipage/document-lifecycle.html#initialise-the-document-object">create
and initialize a Document object</a> steps by adding the following steps before returning |document|:

Expand Down Expand Up @@ -1210,10 +1240,9 @@ and initialize a Document object</a> steps by adding the following steps before
> 1. If |text directive user activation| is false, or <var ignore=''>browsing context</var> is
> not a top-level browsing context, set
> [=document/allow text fragment scroll=] to false and abort these sub-steps.
> 1. If the |navigationParam|'s
> <a href="https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigation-params-request">request</a>
> has a <a href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-site">sec-fetch-site</a>
> header and its value is `"same-origin"` set
> 1. If |navigationParam|'s
> <a href="https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigation-params-origin">
> origin</a> is [=same origin=] with <var ignore>initiatorOrigin</var> set
> [=document/allow text fragment scroll=] to true and abort these
> sub-steps.
> 1. If |document|'s [=Document/browsing context=]'s
Expand Down
30 changes: 26 additions & 4 deletions index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -813,7 +813,7 @@
<div class="head">
<p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
<h1 class="p-name no-ref" id="title">URL Fragment Text Directives</h1>
<p id="w3c-state"><a href="https://www.w3.org/standards/types#CG-DRAFT">Draft Community Group Report</a>, <time class="dt-updated" datetime="2023-11-20">20 November 2023</time></p>
<p id="w3c-state"><a href="https://www.w3.org/standards/types#CG-DRAFT">Draft Community Group Report</a>, <time class="dt-updated" datetime="2023-11-21">21 November 2023</time></p>
<div data-fill-with="spec-metadata">
<dl>
<dt>This version:
Expand Down Expand Up @@ -1962,7 +1962,27 @@ <h4 class="heading settled" data-level="3.5.4" id="restricting-the-text-fragment
amend the definition of <a href="https://html.spec.whatwg.org/multipage/browsing-the-web.html#attempt-to-populate-the-history-entry’s-document">attempt to populate the history entry’s document</a> to take a user navigation involvement as a parameter, using it to populate the field when creating
a new navigation params.</p>
</blockquote>
<p>Amend the <a href="https://html.spec.whatwg.org/multipage/document-lifecycle.html#initialise-the-document-object">create
<p>Amend <a href="https://html.spec.whatwg.org/multipage/document-lifecycle.html#initialise-the-document-object">create
and initialize a Document object</a> to take the initiator origin as a new parameter:</p>
<blockquote>
<p><strong>Monkeypatching <a data-link-type="biblio" href="#biblio-html" title="HTML Standard">[HTML]</a>:</strong></p>
<div class="monkeypatch">A session history entry is a struct with the following items:
To load an HTML document, given navigation params navigationParams <span class="diff">and <a href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin">origin</a> <var>initiatorOrigin</var></span>: </div>
</blockquote>
<p>and pass the initiator origin as an argument wherever it is called, specifically through the <a href="https://html.spec.whatwg.org/multipage/document-lifecycle.html#navigate-html">load an HTML
document</a> steps and the <a href="https://html.spec.whatwg.org/multipage/browsing-the-web.html#loading-a-document">Load a
document</a> steps:</p>
<blockquote>
<p><strong>Monkeypatching <a data-link-type="biblio" href="#biblio-html" title="HTML Standard">[HTML]</a>:</strong></p>
<div class="monkeypatch">
<dl class="switch">
<dt>an <span>HTML MIME type</span>
<dd> Return the result of loading an HTML document, given <var>navigationParams</var> <span class="diff">and <var>initiatorOrigin</var></span>. </dd>
<dl></dl>
</dl>
</div>
</blockquote>
<p>and amend the <a href="https://html.spec.whatwg.org/multipage/document-lifecycle.html#initialise-the-document-object">create
and initialize a Document object</a> steps by adding the following steps before returning <var>document</var>:</p>
<blockquote>
<p><strong>Monkeypatching <a data-link-type="biblio" href="#biblio-html" title="HTML Standard">[HTML]</a>:</strong></p>
Expand All @@ -1988,7 +2008,7 @@ <h4 class="heading settled" data-level="3.5.4" id="restricting-the-text-fragment
<li data-md>
<p>Let <var>text directive user activation</var> be the value of <var>document</var>’s <a data-link-type="dfn" href="#document-text-directive-user-activation" id="ref-for-document-text-directive-user-activation⑧">text directive user activation</a> and set <var>document</var>’s <a data-link-type="dfn" href="#document-text-directive-user-activation" id="ref-for-document-text-directive-user-activation⑨">text directive user activation</a> to false.</p>
<li data-md>
<p>If the <var>navigationParam</var>’s <a data-link-type="dfn" href="#user-involvement" id="ref-for-user-involvement③">user involvement</a> is "<code>browser UI</code>", set <a data-link-type="dfn" href="#document-allow-text-fragment-scroll" id="ref-for-document-allow-text-fragment-scroll④">allow text fragment scroll</a> to true and abort these sub-steps.</p>
<p>If <var>navigationParam</var>’s <a data-link-type="dfn" href="#user-involvement" id="ref-for-user-involvement③">user involvement</a> is "<code>browser UI</code>", set <a data-link-type="dfn" href="#document-allow-text-fragment-scroll" id="ref-for-document-allow-text-fragment-scroll④">allow text fragment scroll</a> to true and abort these sub-steps.</p>
<div class="note" role="note">
<p> If a navigation originates from browser UI, it’s always ok to allow it
since it’ll be user triggered and the page/script isn’t providing the
Expand All @@ -2008,7 +2028,7 @@ <h4 class="heading settled" data-level="3.5.4" id="restricting-the-text-fragment
<p>If <var>text directive user activation</var> is false, or <var>browsing context</var> is
not a top-level browsing context, set <a data-link-type="dfn" href="#document-allow-text-fragment-scroll" id="ref-for-document-allow-text-fragment-scroll⑤">allow text fragment scroll</a> to false and abort these sub-steps.</p>
<li data-md>
<p>If the <var>navigationParam</var>’s <a href="https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigation-params-request">request</a> has a <a href="https://w3c.github.io/webappsec-fetch-metadata/#http-headerdef-sec-fetch-site">sec-fetch-site</a> header and its value is <code>"same-origin"</code> set <a data-link-type="dfn" href="#document-allow-text-fragment-scroll" id="ref-for-document-allow-text-fragment-scroll⑥">allow text fragment scroll</a> to true and abort these
<p>If <var>navigationParam</var>’s <a href="https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigation-params-origin"> origin</a> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-origin" id="ref-for-same-origin">same origin</a> with <var>initiatorOrigin</var> set <a data-link-type="dfn" href="#document-allow-text-fragment-scroll" id="ref-for-document-allow-text-fragment-scroll⑥">allow text fragment scroll</a> to true and abort these
sub-steps.</p>
<li data-md>
<p>If <var>document</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/document-sequences.html#concept-document-bc" id="ref-for-concept-document-bc">browsing context</a> is a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/document-sequences.html#top-level-browsing-context" id="ref-for-top-level-browsing-context">top-level browsing
Expand Down Expand Up @@ -3044,6 +3064,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
<li><span class="dfn-paneled" id="b07164ad">multiple</span>
<li><span class="dfn-paneled" id="2594e562">navigate</span>
<li><span class="dfn-paneled" id="8b87b428">restore persisted state</span>
<li><span class="dfn-paneled" id="7393da89">same origin</span>
<li><span class="dfn-paneled" id="3f2e859c">scroll to the fragment</span>
<li><span class="dfn-paneled" id="85188fb3">select</span>
<li><span class="dfn-paneled" id="c3ae9e6a">serializes as void</span>
Expand Down Expand Up @@ -3530,6 +3551,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
window.dfnpanelData['b07164ad'] = {"dfnID": "b07164ad", "url": "https://html.spec.whatwg.org/multipage/form-elements.html#attr-select-multiple", "dfnText": "multiple", "refSections": [{"refs": [{"id": "ref-for-attr-select-multiple"}], "title": "3.6.1. Finding Ranges in a Document"}], "external": true};
window.dfnpanelData['2594e562'] = {"dfnID": "2594e562", "url": "https://html.spec.whatwg.org/multipage/browsing-the-web.html#navigate", "dfnText": "navigate", "refSections": [{"refs": [{"id": "ref-for-navigate"}], "title": "3.3.1. Extracting the fragment directive"}], "external": true};
window.dfnpanelData['8b87b428'] = {"dfnID": "8b87b428", "url": "https://html.spec.whatwg.org/multipage/browsing-the-web.html#restore-persisted-state", "dfnText": "restore persisted state", "refSections": [{"refs": [{"id": "ref-for-restore-persisted-state"}], "title": "3.8. Document Policy Integration"}], "external": true};
window.dfnpanelData['7393da89'] = {"dfnID": "7393da89", "url": "https://html.spec.whatwg.org/multipage/browsers.html#same-origin", "dfnText": "same origin", "refSections": [{"refs": [{"id": "ref-for-same-origin"}], "title": "3.5.4. Restricting the Text Fragment"}], "external": true};
window.dfnpanelData['3f2e859c'] = {"dfnID": "3f2e859c", "url": "https://html.spec.whatwg.org/multipage/browsing-the-web.html#scroll-to-the-fragment-identifier", "dfnText": "scroll to the fragment", "refSections": [{"refs": [{"id": "ref-for-scroll-to-the-fragment-identifier"}, {"id": "ref-for-scroll-to-the-fragment-identifier\u2460"}], "title": "3.4.1. Invoking Text Directives"}, {"refs": [{"id": "ref-for-scroll-to-the-fragment-identifier\u2461"}], "title": "3.5.4. Restricting the Text Fragment"}, {"refs": [{"id": "ref-for-scroll-to-the-fragment-identifier\u2462"}], "title": "3.8. Document Policy Integration"}], "external": true};
window.dfnpanelData['85188fb3'] = {"dfnID": "85188fb3", "url": "https://html.spec.whatwg.org/multipage/form-elements.html#the-select-element", "dfnText": "select", "refSections": [{"refs": [{"id": "ref-for-the-select-element"}], "title": "3.6.1. Finding Ranges in a Document"}], "external": true};
window.dfnpanelData['c3ae9e6a'] = {"dfnID": "c3ae9e6a", "url": "https://html.spec.whatwg.org/multipage/parsing.html#serializes-as-void", "dfnText": "serializes as void", "refSections": [{"refs": [{"id": "ref-for-serializes-as-void"}], "title": "3.6.1. Finding Ranges in a Document"}], "external": true};
Expand Down

0 comments on commit b012092

Please sign in to comment.