Treat data URLs as same-origin, except for workers #387
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
HTML gives data URLs a unique origin when navigating to them to prevent a class of XSS attacks. Since browsers already largely allow data URLs in all other contexts this commit aligns with that, opting them into being same-origin elsewhere. Workers however are still prevented. It would create problems for shared workers and potentially also for dedicated workers. Fixes #381.
|
Once this lands I should update HTML to remove mention of the flag. |
more accurately "gives Documents created from data URLs", right? |
|
Yeah, that'd be a little better. |
|
This patch does what you want it to do, and I think I'm happy with moving Chrome in this direction. LGTM. |
mikewest
reviewed
Sep 15, 2016
| <p class="note no-backref">HTML will assign any documents and dedicated workers created from a | ||
| <span data-anolis-spec=url title=concept-url>URL</span> whose | ||
| <span data-anolis-spec=url title=concept-url-scheme>scheme</span> is "<code>data</code>" an | ||
| <span data-anolis-spec=html>opaque origin</span> and it prevents creation of shared workers from |
There was a problem hiding this comment.
Tiny nit: perhaps s/and it prevents/, and prevents/
|
Proposed commit message: |
annevk
added a commit
that referenced
this pull request
Oct 12, 2016
Since #387 landed HTML’s change in whatwg/html#1782 was adjusted a bit for shared workers.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
HTML gives data URLs a unique origin when navigating to them to prevent
a class of XSS attacks.
Since browsers already largely allow data URLs in all other contexts
this commit aligns with that, opting them into being same-origin
elsewhere.
Workers however are still prevented. It would create problems for
shared workers and potentially also for dedicated workers.
Fixes #381.