From bb864bda06da398db6709b7f6400559ed8437254 Mon Sep 17 00:00:00 2001 From: Domenic Denicola Date: Fri, 19 Jun 2020 14:53:25 -0400 Subject: [PATCH] Define "secure context" This supersedes the definition in https://w3c.github.io/webappsec-secure-contexts/, and fixes several bugs while doing so. Closes #5558. Closes w3c/webappsec-secure-contexts#56. Closes w3c/webappsec-secure-contexts#57. Closes w3c/webappsec-secure-contexts#74. Closes w3c/webappsec-secure-contexts#75. --- source | 90 +++++++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 79 insertions(+), 11 deletions(-) diff --git a/source b/source index 96a539c3cd9..aeaf8071802 100644 --- a/source +++ b/source @@ -3829,7 +3829,6 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute spec="SECURE-CONTEXTS">

@@ -86995,6 +86994,61 @@ interface ApplicationCache : EventTarget { steps are run for only a select few environments: the ones that will never become execution ready because, for example, they failed to load.

+

An environment environment is a secure context if the + following algorithm returns true:

+ +
    +
  1. +

    If environment is an environment settings object, then:

    + +
      +

    1. If environment's HTTPS state is "deprecated", then return false.

      2. + +

    2. Let global be environment's global object.

      3. + +
    3. +

      If global is a WorkerGlobalScope, then: + +

        +
      1. +

        If global's owner set[0]'s relevant settings object + is a secure context, then return true.

        + +

        We only need to check the 0th item since they will necessarily all be + consistent.

        +
        2. + +

      2. Return false.

        3. +
      +
      4. + +
    4. +

      If global is a WorkletGlobalScope, then:

      + +
        +

      1. If global's owner + document's relevant settings object is a secure context, + then return true.

        2. + +

      2. Return false.

        3. +
      +
      5. +
    +
    2. + +

  2. If the result of Is url potentially trustworthy? given + environment's top-level creation URL is "Potentially + Trustworthy", then return true.

    3. + +

  3. Return false.

    4. +
+ +

An environment is a non-secure context if it is not a + secure context.

+

An environment settings object is an environment that additionally specifies algorithms for:

@@ -92010,6 +92064,7 @@ interface mixin DocumentAndElementEventHandlers { interface mixin WindowOrWorkerGlobalScope { [Replaceable] readonly attribute USVString origin; + readonly attribute boolean isSecureContext; // base64 utility methods DOMString btoa(DOMString data); @@ -92032,7 +92087,12 @@ interface mixin WindowOrWorkerGlobalScope { WorkerGlobalScope includes WindowOrWorkerGlobalScope;
-
origin = self . origin
+
self . isSecureContext
+ +

Returns whether or not this global object represents a secure context.

+ +
self . origin

Returns the global object's origin, serialized as string.

@@ -92054,11 +92114,19 @@ document.body.appendChild(frame)

self.origin is a more reliable security indicator.

-

The origin attribute's getter must return this - object's relevant settings object's + +

The isSecureContext getter steps are to + return true if this's relevant settings object is a secure + context, or false otherwise.

+ +

The origin getter steps are to return + this's relevant settings object's origin, serialized.

+ +

Base64 utility methods

@@ -99516,8 +99584,8 @@ interface SharedWorker : EventTarget {

  • Assign outside port to the port attribute of worker.

    • -

  • Let callerIsSecureContext be the result of executing Is environment - settings object a secure context? on outside settings.

    • +

  • Let callerIsSecureContext be true if outside settings is a + secure context; otherwise, false.

  • Enqueue the following steps to the shared worker manager:

    @@ -99573,8 +99641,8 @@ interface SharedWorker : EventTarget {

  • Let settings object be the relevant settings object for worker global scope.

    • -

  • Let workerIsSecureContext be the result of executing Is environment - settings object a secure context? on settings object.

    • +

  • Let workerIsSecureContext be true if settings object is a + secure context; otherwise, false.

  • If workerIsSecureContext is not callerIsSecureContext, then queue a task to fire an event named @@ -106799,9 +106867,9 @@ document.body.appendChild(text); this element in the stack of open elements.

    If the Document is being loaded as part of navigation of a browsing context and the result of - executing Is environment settings object a secure context? on the - Document's relevant settings object is true, then:

    + data-x="navigate">navigation of a browsing context and + Document's relevant settings object is a secure context, + then:

    1. If the result of running match service worker