Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Treat data URLs as same-origin, except for workers #387

Merged
merged 3 commits into from
Sep 15, 2016
Merged

Treat data URLs as same-origin, except for workers #387

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cb9e133
Treat data URLs as same-origin, except for workers
annevk Sep 14, 2016
a369a36
let HTML handle the special casing
annevk Sep 15, 2016
2795c2f
nits
annevk Sep 15, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 12 additions & 5 deletions Overview.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@

<p><a class="logo" href="https://whatwg.org/"><img alt="WHATWG" height="100" src="https://resources.whatwg.org/logo-fetch.svg" width="100"></a>
<h1 id="cors">Fetch</h1>
<h2 class="no-num no-toc" id="living-standard-—-last-updated-14-september-2016">Living Standard — Last Updated 14 September 2016</h2>
<h2 class="no-num no-toc" id="living-standard-—-last-updated-15-september-2016">Living Standard — Last Updated 15 September 2016</h2>

<dl>
<dt>Participate:
Expand Down Expand Up @@ -2480,10 +2480,7 @@ <h3 id="main-fetch"><span class="secno">5.1 </span>Main fetch</h3>
<a href="#concept-request-origin" title="concept-request-origin">origin</a> and <i>CORS flag</i> is unset
<dt><var>request</var>'s
<a href="#concept-request-current-url" title="concept-request-current-url">current url</a>'s
<a class="external" data-anolis-spec="url" href="https://url.spec.whatwg.org/#concept-url-scheme" title="concept-url-scheme">scheme</a> is "<code>data</code>" and
<var>request</var>'s <a href="#concept-request-destination" title="concept-request-destination">destination</a> is not
"<code>sharedworker</code>" or "<code>worker</code>"
<!-- "serviceworker" already prevents anything non-HTTP(S) -->
<a class="external" data-anolis-spec="url" href="https://url.spec.whatwg.org/#concept-url-scheme" title="concept-url-scheme">scheme</a> is "<code>data</code>"
<dt><var>request</var>'s <a href="#concept-request-mode" title="concept-request-mode">mode</a> is
"<code title="">navigate</code>" or "<code title="">websocket</code>"

Expand All @@ -2496,6 +2493,16 @@ <h3 id="main-fetch"><span class="secno">5.1 </span>Main fetch</h3>
using <var>request</var>.
</ol>

<p class="note no-backref">HTML will assign any documents and dedicated workers created from a
<a class="external" data-anolis-spec="url" href="https://url.spec.whatwg.org/#concept-url" title="concept-url">URL</a> whose
<a class="external" data-anolis-spec="url" href="https://url.spec.whatwg.org/#concept-url-scheme" title="concept-url-scheme">scheme</a> is "<code>data</code>" an
<a class="external" data-anolis-spec="html" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque">opaque origin</a> and it prevents creation of shared workers from
such a <a class="external" data-anolis-spec="url" href="https://url.spec.whatwg.org/#concept-url" title="concept-url">URL</a>. Service workers can only be
created from <a class="external" data-anolis-spec="url" href="https://url.spec.whatwg.org/#concept-url" title="concept-url">URL</a> whose
<a class="external" data-anolis-spec="url" href="https://url.spec.whatwg.org/#concept-url-scheme" title="concept-url-scheme">scheme</a> is an
<a class="external" data-anolis-spec="url" href="https://url.spec.whatwg.org/#http-scheme">HTTP(S) scheme</a>.
<a href="#refsHTML">[HTML]</a> <a href="#refsSW">[SW]</a>

<dt><var>request</var>'s <a href="#concept-request-mode" title="concept-request-mode">mode</a> is
"<code title="">same-origin</code>"

Expand Down
15 changes: 11 additions & 4 deletions Overview.src.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2410,10 +2410,7 @@ <h3>Main fetch</h3>
<span title=concept-request-origin>origin</span> and <i>CORS flag</i> is unset
<dt><var>request</var>'s
<span title=concept-request-current-url>current url</span>'s
<span data-anolis-spec=url title=concept-url-scheme>scheme</span> is "<code>data</code>" and
<var>request</var>'s <span title=concept-request-destination>destination</span> is not
"<code>sharedworker</code>" or "<code>worker</code>"
<!-- "serviceworker" already prevents anything non-HTTP(S) -->
<span data-anolis-spec=url title=concept-url-scheme>scheme</span> is "<code>data</code>"
<dt><var>request</var>'s <span title=concept-request-mode>mode</span> is
"<code title>navigate</code>" or "<code title>websocket</code>"

Expand All @@ -2426,6 +2423,16 @@ <h3>Main fetch</h3>
using <var>request</var>.
</ol>

<p class="note no-backref">HTML will assign any documents and dedicated workers created from a
<span data-anolis-spec=url title=concept-url>URL</span> whose
<span data-anolis-spec=url title=concept-url-scheme>scheme</span> is "<code>data</code>" an
<span data-anolis-spec=html>opaque origin</span> and it prevents creation of shared workers from
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tiny nit: perhaps s/and it prevents/, and prevents/

such a <span data-anolis-spec=url title=concept-url>URL</span>. Service workers can only be
created from <span data-anolis-spec=url title=concept-url>URL</span> whose
<span data-anolis-spec=url title=concept-url-scheme>scheme</span> is an
<span data-anolis-spec=url>HTTP(S) scheme</span>.
<span data-anolis-ref>HTML</span> <span data-anolis-ref>SW</span>

<dt><var>request</var>'s <span title=concept-request-mode>mode</span> is
"<code title>same-origin</code>"

Expand Down