Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use the newly exposed methods to initialize feature policy. #4772

Merged
merged 2 commits into from
Jul 18, 2019
Merged

Use the newly exposed methods to initialize feature policy. #4772

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
642cdfa
Use the newly exposed methods to initialize feature policy.
dtapuska Jul 12, 2019
f349a4a
nit
annevk Jul 18, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 27 additions & 25 deletions source
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4100,8 +4100,8 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
<li><dfn data-x="concept-container-policy" data-x-href="https://wicg.github.io/feature-policy/#container-policy">container policy</dfn></li>
<li><dfn data-x="concept-serialized-feature-policy" data-x-href="https://wicg.github.io/feature-policy/#serialized-feature-policy">serialized feature policy</dfn></li>
<li><dfn data-x="concept-default-allowlist" data-x-href="https://wicg.github.io/feature-policy/#default-allowlist">default allowlist</dfn></li>
<li>The <dfn data-x-href="https://wicg.github.io/feature-policy/#initialize-for-document">Initialize a document's feature policy</dfn> algorithm</li>
<li>The <dfn data-x-href="https://wicg.github.io/feature-policy/#initialize-from-response">Initialize a document's feature policy from a response</dfn> algorithm</li>
<li>The <dfn data-x-href="https://wicg.github.io/feature-policy/#create-for-browsingcontext">creating a feature policy</dfn> algorithm</li>
<li>The <dfn data-x-href="https://wicg.github.io/feature-policy/#create-from-response">creating a feature policy from a response</dfn> algorithm</li>
<li>The <dfn data-x="is-feature-enabled" data-x-href="https://wicg.github.io/feature-policy/#is-feature-enabled">Is feature enabled by policy for origin</dfn> algorithm</li>
<li>The <dfn data-x="process-feature-policy-attributes" data-x-href="https://wicg.github.io/feature-policy/#process-feature-policy-attributes">Process feature policy attributes</dfn> algorithm</li>
</ul>
Expand Down Expand Up @@ -78048,6 +78048,9 @@ dictionary <dfn>DragEventInit</dfn> : <span>MouseEventInit</span> {
origin</span> given <var>browsingContext</var>, <code>about:blank</code>,
<var>sandboxFlags</var>, <var>browsingContext</var>'s <span>creator origin</span>, and null.

<li><p>Let <var>featurePolicy</var> be the result of <span>creating a feature policy</span>
given <var>browsingContext</var> and <var>origin</var>. <ref spec="FEATUREPOLICY"></p></li>

<li>
<p>Let <var>realm execution context</var> be the result of <span>creating a new JavaScript
realm</span> with the following customizations:</p>
Expand All @@ -78067,7 +78070,8 @@ dictionary <dfn>DragEventInit</dfn> : <span>MouseEventInit</span> {
documents">HTML document</span> in <span>quirks mode</span>, whose <span
data-x="concept-document-content-type">content type</span> is "<code data-x="">text/html</code>",
<span>origin</span> is <var>origin</var>, <span>active sandboxing flag set</span> is
<var>sandboxFlags</var>, and which is both <span>ready for post-load tasks</span> and
<var>sandboxFlags</var>, <span data-x="concept-document-feature-policy">feature policy</span> is
<var>feature policy</var>, and which is both <span>ready for post-load tasks</span> and
<span>completely loaded</span> immediately.</p></li>

<li><p>Ensure that <var>document</var> has a single child <code>html</code> node, which itself
Expand All @@ -78084,9 +78088,6 @@ dictionary <dfn>DragEventInit</dfn> : <span>MouseEventInit</span> {
<span data-x="concept-document-referrer-policy">referrer policy</span> to <var>creator</var>'s
<span data-x="concept-document-referrer-policy">referrer policy</span>.</p></li>

<li><p><span>Initialize a document's feature policy</span> given <var>document</var>. <ref
spec="FEATUREPOLICY"></p></li>

<li><p>Add <var>document</var> to <var>browsingContext</var>'s <span>session
history</span>.</p></li>

Expand Down Expand Up @@ -83669,6 +83670,24 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
<var>sandboxFlags</var>, <var>incumbentNavigationOrigin</var>, and
<var>activeDocumentNavigationOrigin</var>.

<li>
<p>Let <var>featurePolicy</var> be the result of <span>creating a feature policy from a response</span>
given <var>browsingContext</var>, <var>origin</var>, and <var>response</var>. <ref
spec="FEATUREPOLICY"></p>

<div class="note">
<p>The <span>creating a feature policy from a response</span> algorithm makes use of
<var>origin</var>. If <code data-x="dom-document-domain">document.domain</code> has been used
for the <span>browsing context container</span>'s <span>node document</span>, then its
<span>origin</span> cannot be <span>same origin-domain</span> with <var>>origin</var>, because
these steps run before the <var>document</var> is created, so it cannot itself yet have used
<code data-x="dom-document-domain">document.domain</code>. Note that this means that Feature
Policy checks are less permissive compared to doing a <span>same origin</span> check instead.</p>

<p>See below for some examples of this in action.</p>
</div>
</li>

<li><p>If <var>browsingContext</var>'s only entry in its <span>session history</span> is the
<code>about:blank</code> <code>Document</code> that was added when <var>browsingContext</var> was
<span data-x="creating a new browsing context">created</span>, and navigation is occurring with
Expand Down Expand Up @@ -83699,7 +83718,8 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
<li><p>Let <var>document</var> be a new <code>Document</code>, whose <span
data-x="concept-document-type">type</span> is <var>type</var>, <span
data-x="concept-document-content-type">content type</span> is <var>contentType</var>,
<span>origin</span> is <var>origin</var>, and <span>active sandboxing flag set</span> is
<span>origin</span> is <var>origin</var>, <span data-x="concept-document-feature-policy">feature
policy</span> is <var>featurePolicy</var>, and <span>active sandboxing flag set</span> is
<var>sandboxFlags</var>.</p></li>

<li id="set-the-document's-address"><p>If <var>request</var> is non-null, then set
Expand Down Expand Up @@ -83734,24 +83754,6 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
"<code data-x="">no-referrer</code>" at this point.</p>
</li>

<li>
<p><span>Initialize a document's feature policy from a response</span> given
<var>document</var> and <var>response</var>. <ref spec="FEATUREPOLICY"></p>

<div class="note">
<p>The <span>initialize a document's feature policy from a response</span> algorithm makes use
of <var>document</var>'s <span>origin</span>. If <code
data-x="dom-document-domain">document.domain</code> has been used for the <span>browsing
context container</span>'s <span>node document</span>, then its <span>origin</span> cannot be
<span>same origin-domain</span> with <var>document</var>'s <span>origin</span>, because these
steps run when <var>document</var> is initialized, so it cannot itself yet have used <code
data-x="dom-document-domain">document.domain</code>. Note that this means that Feature Policy
checks are less permissive compared to doing a <span>same origin</span> check instead.</p>

<p>See below for some examples of this in action.</p>
</div>
</li>

<li>
<p>If <var>response</var> has a `<code data-x="http-refresh">Refresh</code>` header, then:</p>

Expand Down