From cb9e1334849adeb4dfe11f359897d95adc501f7b Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Wed, 14 Sep 2016 16:04:22 +0200 Subject: [PATCH 1/3] Treat data URLs as same-origin, except for workers HTML gives data URLs a unique origin when navigating to them to prevent a class of XSS attacks. Since browsers already largely allow data URLs in all other contexts this commit aligns with that, opting them into being same-origin elsewhere. Workers however are still prevented. It would create problems for shared workers and potentially also for dedicated workers. Fixes #381. --- Overview.html | 14 ++++---------- Overview.src.html | 14 ++++---------- 2 files changed, 8 insertions(+), 20 deletions(-) diff --git a/Overview.html b/Overview.html index 0615ce675..f603df7d5 100644 --- a/Overview.html +++ b/Overview.html @@ -951,10 +951,6 @@

3.1.5 Requests

omit-Origin-header flag. Unless stated otherwise it is unset. -

A request has an associated -same-origin data-URL flag. Unless stated otherwise it is -unset. -

A request has an associated referrer, which is "no-referrer", "client", or a @@ -2484,9 +2480,10 @@

5.1 Main fetch

origin and CORS flag is unset
request's current url's - scheme is - "data" and request's - same-origin data-URL flag is set + scheme is "data" and + request's destination is not + "sharedworker" or "worker" +
request's mode is "navigate" or "websocket" @@ -3059,8 +3056,6 @@

5.4 HTTP-redirect fetch<

  • Increase request's redirect count by one. -

  • Unset request's same-origin data-URL flag. -

  • If request's mode is "cors", request's origin is not same origin with actualResponse's @@ -4683,7 +4678,6 @@

    6.3 Request class

    origin is "client", omit-Origin-header flag is request's omit-Origin-header flag, - same-origin data-URL flag is set, referrer is request's referrer, referrer policy is diff --git a/Overview.src.html b/Overview.src.html index 41d67da86..7d70d497f 100644 --- a/Overview.src.html +++ b/Overview.src.html @@ -881,10 +881,6 @@

    Requests

    omit-Origin-header flag. Unless stated otherwise it is unset. -

    A request has an associated -same-origin data-URL flag. Unless stated otherwise it is -unset. -

    A request has an associated referrer, which is "no-referrer", "client", or a @@ -2414,9 +2410,10 @@

    Main fetch

    origin and CORS flag is unset
    request's current url's - scheme is - "data" and request's - same-origin data-URL flag is set + scheme is "data" and + request's destination is not + "sharedworker" or "worker" +
    request's mode is "navigate" or "websocket" @@ -2989,8 +2986,6 @@

    HTTP-redirect fetch

  • Increase request's redirect count by one. -

  • Unset request's same-origin data-URL flag. -

  • If request's mode is "cors", request's origin is not same origin with actualResponse's @@ -4613,7 +4608,6 @@

    Request class

    origin is "client", omit-Origin-header flag is request's omit-Origin-header flag, - same-origin data-URL flag is set, referrer is request's referrer, referrer policy is From a369a36118425696f98d881db83be8a8ea846c4c Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Thu, 15 Sep 2016 12:01:48 +0200 Subject: [PATCH 2/3] let HTML handle the special casing --- Overview.html | 17 ++++++++++++----- Overview.src.html | 15 +++++++++++---- 2 files changed, 23 insertions(+), 9 deletions(-) diff --git a/Overview.html b/Overview.html index f603df7d5..9d80d0af0 100644 --- a/Overview.html +++ b/Overview.html @@ -7,7 +7,7 @@

    Fetch

    -

    Living Standard — Last Updated 14 September 2016

    +

    Living Standard — Last Updated 15 September 2016

    Participate: @@ -2480,10 +2480,7 @@

    5.1 Main fetch

    origin and CORS flag is unset
    request's current url's - scheme is "data" and - request's destination is not - "sharedworker" or "worker" - + scheme is "data"
    request's mode is "navigate" or "websocket" @@ -2496,6 +2493,16 @@

    5.1 Main fetch

    using request. +

    HTML will assign any documents and dedicated workers created from a + URL whose + scheme is "data" an + opaque origin and it prevents creation of shared workers from + such a URL. Service workers can only be + created from URL whose + scheme is an + HTTP(S) scheme. + [HTML] [SW] +

    request's mode is "same-origin" diff --git a/Overview.src.html b/Overview.src.html index 7d70d497f..4bdd869e5 100644 --- a/Overview.src.html +++ b/Overview.src.html @@ -2410,10 +2410,7 @@

    Main fetch

    origin and CORS flag is unset
    request's current url's - scheme is "data" and - request's destination is not - "sharedworker" or "worker" - + scheme is "data"
    request's mode is "navigate" or "websocket" @@ -2426,6 +2423,16 @@

    Main fetch

    using request. +

    HTML will assign any documents and dedicated workers created from a + URL whose + scheme is "data" an + opaque origin and it prevents creation of shared workers from + such a URL. Service workers can only be + created from URL whose + scheme is an + HTTP(S) scheme. + HTML SW +

    request's mode is "same-origin" From 2795c2faa3476fab774b27678cf4491d494baa56 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Thu, 15 Sep 2016 15:04:28 +0200 Subject: [PATCH 3/3] nits --- Overview.html | 12 ++++++------ Overview.src.html | 12 ++++++------ 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/Overview.html b/Overview.html index 9d80d0af0..758478622 100644 --- a/Overview.html +++ b/Overview.html @@ -2493,12 +2493,12 @@

    5.1 Main fetch

    using request. -

    HTML will assign any documents and dedicated workers created from a - URL whose - scheme is "data" an - opaque origin and it prevents creation of shared workers from - such a URL. Service workers can only be - created from URL whose +

    HTML assigns any documents and dedicated workers created from + URLs whose + scheme is "data" a + unique opaque origin, and prevents creation of shared workers + from such URLs. Service workers can only be + created from URLs whose scheme is an HTTP(S) scheme. [HTML] [SW] diff --git a/Overview.src.html b/Overview.src.html index 4bdd869e5..52a9e29ce 100644 --- a/Overview.src.html +++ b/Overview.src.html @@ -2423,12 +2423,12 @@

    Main fetch

    using request. -

    HTML will assign any documents and dedicated workers created from a - URL whose - scheme is "data" an - opaque origin and it prevents creation of shared workers from - such a URL. Service workers can only be - created from URL whose +

    HTML assigns any documents and dedicated workers created from + URLs whose + scheme is "data" a + unique opaque origin, and prevents creation of shared workers + from such URLs. Service workers can only be + created from URLs whose scheme is an HTTP(S) scheme. HTML SW