From 9e6bf1184cdc68ed795d5b0a635d847c8cdbbc15 Mon Sep 17 00:00:00 2001 From: Domenic Denicola Date: Fri, 19 Jun 2020 14:53:25 -0400 Subject: [PATCH] Define "secure context" This supersedes the definition in https://w3c.github.io/webappsec-secure-contexts/, and fixes several bugs while doing so. Closes #5558. Closes w3c/webappsec-secure-contexts#56. Closes w3c/webappsec-secure-contexts#57. Closes w3c/webappsec-secure-contexts#74. Closes w3c/webappsec-secure-contexts#75. --- source | 73 +++++++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 62 insertions(+), 11 deletions(-) diff --git a/source b/source index 28388475fe0..15c77ac9c99 100644 --- a/source +++ b/source @@ -3801,7 +3801,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute spec="SECURE-CONTEXTS">

@@ -86309,6 +86309,43 @@ interface ApplicationCache : EventTarget { steps are run for only a select few environments: the ones that will never become execution ready because, for example, they failed to load.

+

An environment environment is a secure context if the + following algorithm returns true:

+ +
    +
  1. +

    If environment is an environment settings object, and its global object is a + WorkerGlobalScope, then:

    + +
      +

    1. For each owner in environment's + global object's owner set, if + owner's relevant settings object is a non-secure context, + then return false.

      2. + +

    2. Return true.

      3. +
    +
    2. + +

  2. If environment is environment is an environment settings + object, and its global object is a + WorkletGlobalScope, then return true if environment's global object's owner document's relevant settings + object is a secure context; otherwise, return false.

    3. + +

  3. If the result of Is url potentially trustworthy? given + environment's top-level creation URL is "Potentially + Trustworthy", then return true.

    4. + +

  4. Return false.

    5. +
+ +

An environment is a non-secure context if it is not a + secure context.

+

An environment settings object is an environment that additionally specifies algorithms for:

@@ -91299,6 +91336,7 @@ interface mixin DocumentAndElementEventHandlers { interface mixin WindowOrWorkerGlobalScope { [Replaceable] readonly attribute USVString origin; + readonly attribute boolean isSecureContext; // base64 utility methods DOMString btoa(DOMString data); @@ -91321,7 +91359,12 @@ interface mixin WindowOrWorkerGlobalScope { WorkerGlobalScope includes WindowOrWorkerGlobalScope;
-
origin = self . origin
+
self . isSecureContext
+ +

Returns whether or not this global object represents a secure context.

+ +
self . origin

Returns the global object's origin, serialized as string.

@@ -91343,11 +91386,19 @@ document.body.appendChild(frame)

self.origin is a more reliable security indicator.

-

The origin attribute's getter must return this - object's relevant settings object's + +

The isSecureContext getter steps are to + return true if this's relevant settings object is a secure + context, or false otherwise.

+ +

The origin getter steps are to return + this's relevant settings object's origin, serialized.

+ +

Base64 utility methods

@@ -98786,8 +98837,8 @@ interface SharedWorker : EventTarget {

  • Assign outside port to the port attribute of worker.

    • -

  • Let callerIsSecureContext be the result of executing Is environment - settings object a secure context? on outside settings.

    • +

  • Let callerIsSecureContext be true if outside settings is a + secure context; otherwise, false.

  • Enqueue the following steps to the shared worker manager:

    @@ -98843,8 +98894,8 @@ interface SharedWorker : EventTarget {

  • Let settings object be the relevant settings object for worker global scope.

    • -

  • Let workerIsSecureContext be the result of executing Is environment - settings object a secure context? on settings object.

    • +

  • Let workerIsSecureContext be true if settings object is a + secure context; otherwise, false.

  • If workerIsSecureContext is not callerIsSecureContext, then queue a task to fire an event named @@ -106069,9 +106120,9 @@ document.body.appendChild(text); this element in the stack of open elements.

    If the Document is being loaded as part of navigation of a browsing context and the result of - executing Is environment settings object a secure context? on the - Document's relevant settings object is true, then:

    + data-x="navigate">navigation of a browsing context and + Document's relevant settings object is a secure context, + then:

    1. If the result of running match service worker