From 3aca452a43113b48997a1c65a3dc31cf22e79ce0 Mon Sep 17 00:00:00 2001 From: Carlos Fuentes Date: Tue, 8 Mar 2022 17:28:17 +0100 Subject: [PATCH] refactor: apply review suggestions --- lib/fetch/util.js | 30 ++++++++++++++---------------- 1 file changed, 14 insertions(+), 16 deletions(-) diff --git a/lib/fetch/util.js b/lib/fetch/util.js index 0fbced21f29..27164889c58 100644 --- a/lib/fetch/util.js +++ b/lib/fetch/util.js @@ -285,7 +285,6 @@ function clonePolicyContainer () { // https://w3c.github.io/webappsec-referrer-policy/#determine-requests-referrer function determineRequestsReferrer (request) { - // TODO // 1. Let policy be request's referrer policy. const policy = request.referrerPolicy @@ -351,6 +350,19 @@ function determineRequestsReferrer (request) { switch (policy) { case 'origin': return referrerOrigin case 'unsafe-url': return referrerUrl + case 'same-origin': + return areSameOrigin ? referrerOrigin : 'no-referrer' + case 'origin-when-cross-origin': + return areSameOrigin ? referrerUrl : referrerOrigin + case 'strict-origin-when-cross-origin': + /** + * 1. If the origin of referrerURL and the origin of request’s current URL are the same, + * then return referrerURL. + * 2. If referrerURL is a potentially trustworthy URL and request’s current URL is not a + * potentially trustworthy URL, then return no referrer. + * 3. Return referrerOrigin + */ + if (areSameOrigin) return referrerOrigin case 'strict-origin': /** * 1. If referrerURL is a potentially trustworthy URL and @@ -358,21 +370,6 @@ function determineRequestsReferrer (request) { * then return no referrer. * 2. Return referrerOrigin */ - return isNonPotentiallyTrustWorthy ? 'no-referrer' : referrerOrigin - case 'strict-origin-when-cross-origin': - /** - * 1. If the origin of referrerURL and the origin of request’s current URL are the same, - * then return referrerURL. - * 2. If referrerURL is a potentially trustworthy URL and request’s current URL is not a - * potentially trustworthy URL, then return no referrer. - * 3. Return referrerOrigin - */ - if (areSameOrigin) return referrerOrigin - else return isNonPotentiallyTrustWorthy ? 'no-referrer' : referrerOrigin - case 'same-origin': - return areSameOrigin ? referrerOrigin : 'no-referrer' - case 'origin-when-cross-origin': - return areSameOrigin ? referrerUrl : referrerOrigin case 'no-referrer-when-downgrade': /** * 1. If referrerURL is a potentially trustworthy URL and @@ -380,6 +377,7 @@ function determineRequestsReferrer (request) { * then return no referrer. * 2. Return referrerOrigin */ + default: return isNonPotentiallyTrustWorthy ? 'no-referrer' : referrerOrigin }