From e33ea5e3e136514ac2df5ca7ea5b8bff5cefc89e Mon Sep 17 00:00:00 2001 From: clamy Date: Wed, 10 Jun 2020 16:09:39 +0200 Subject: [PATCH 01/15] Add cross-origin opener policy reporting API Fixup Thread through source Rework redirect handling Add access reporting Change report body names to camelCase --- source | 1186 ++++++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 1064 insertions(+), 122 deletions(-) diff --git a/source b/source index 97abc1f8269..e38f41e7c37 100644 --- a/source +++ b/source @@ -9136,8 +9136,7 @@ partial interface Document { which is a module map, initially empty.

The Document has a cross-origin opener - policy, which is a cross-origin opener policy, initially "unsafe-none".

+ policy, which is a cross-origin opener policy.

The DocumentOrShadowRoot interface

@@ -77316,6 +77315,14 @@ popup4.close(); data-x="navigation-hh">historyHandling set to "replace".

+

A browsing context has a virtual + browsing context group id integer. It is initially 0.

+ +

A browsing context has an initial + url, which is a URL or null. It is initially null.

+ +

A browsing context has an opener origin at + creation, which is an origin or null. It is initially null.

Creating browsing contexts

@@ -77395,9 +77402,12 @@ popup4.close();

  • If creator is non-null, then set browsingContext's creator origin to return creator's origin, browsingContext's creator URL to return - creator's URL, and + creator's URL, browsingContext's creator base URL to return creator's base URL.

    • + data-x="document base URL">base URL, and browsingContext's virtual browsing context group id to + creator's top-level browsing context's virtual browsing context group id.

  • Let sandboxFlags be the result of determining the creation sandboxing flags given browsingContext and embedder.

    • @@ -77446,7 +77456,7 @@ popup4.close(); settings object">setting up a window environment settings object with realm execution context, null, topLevelCreationURL, and topLevelOrigin.

    -

  • Let coop be "unsafe-none".

    • +

  • Let coop be a new cross-origin opener policy.

  • If creator is non-null and creator's origin is same origin with creator's relevant settings object's @@ -77522,6 +77532,15 @@ popup4.close();

  • Set browsingContext's opener browsing context to opener.

    • +

  • Set browsingContext's virtual + browsing context group id to opener's top-level browsing context's + virtual browsing context group + id.

    • + +

  • Set browsingContext's opener origin at + creation to opener's active document's + origin.

    • +

  • Legacy-clone a browsing session storage shed with opener's browsing session and browsingContext's browsing session.

    If current's top-level browsing context's active - document's cross-origin opener policy is - "same-origin" or "same-origin-plus-COEP", then:

    + document's cross-origin opener policy's + value is "same-origin" or "same-origin-plus-COEP", then:

    1. Let currentDocument be current's active @@ -79899,6 +79919,11 @@ interface BarProp { [[Window]] internal slot of this.

      2. +

    2. Check if an access between two browsing contexts + should be reported, given the current global object's browsing + context, W's browsing context, P, the current + global object, and the current settings object.

      3. +

    3. If ! IsPlatformObjectSameOrigin(W) is true, then return ? OrdinaryGet(this, P, Receiver).

      4. @@ -79917,6 +79942,11 @@ interface BarProp { [[Window]] internal slot of this.

      +

    4. Check if an access between two browsing contexts + should be reported, given the current global object's browsing + context, W's browsing context, P, the current + global object and the current settings object.

      5. +

    5. If ! IsPlatformObjectSameOrigin(W) is true, then return ? OrdinarySet(this, P, V, Receiver).

      6. @@ -80883,10 +80913,10 @@ interface BarProp {

      Cross-origin opener policies

      -

      A cross-origin opener policy allows a document which is navigated to in a +

      A cross-origin opener policy value allows a document which is navigated to in a top-level browsing context to force the creation of a new top-level browsing - context, and a corresponding group. It has one of the - following values:

      + context, and a corresponding group. The possible values + are:

      "unsafe-none"
      @@ -80923,10 +80953,28 @@ interface BarProp {
      -

      To match cross-origin opener policies, given a - cross-origin opener policy A, an origin originA, a - cross-origin opener policy B, and an origin - originB:

      +

      A cross-origin opener policy consists of:

      + +
        +

      1. A value, which is a cross-origin opener policy value, initially "unsafe-none".

        2. + +

      2. A reporting endpoint, which is string or + null, initially null.

        3. + +

      3. A report-only value, which is a cross-origin opener policy value, initially + "unsafe-none".

        4. + +

      4. A report-only reporting endpoint, + which is a string or null, initially null.

        5. +
      + +

      To match cross-origin opener policy values, given a + cross-origin opener policy value A, an origin + originA, a cross-origin opener policy value B, and an + origin originB:

      1. If A is "unsafe-none" and B @@ -80941,19 +80989,21 @@ interface BarProp {

      2. Return false.

      -

      The `Cross-Origin-Opener-Policy` - header

      +

      The headers

      A Document's cross-origin opener policy is derived from the `Cross-Origin-Opener-Policy` HTTP response header. - This header is a structured header whose value must - be a token.

      - -

      The valid token values are "unsafe-none", "same-origin-allow-popups", and "same-origin".

      + data-x="http-cross-origin-opener-policy">Cross-Origin-Opener-Policy` and the `Cross-Origin-Opener-Policy-Report-Only` + HTTP response headers. These headers are structured + headers whose value must be a token. +

      + +

      The valid token values are the opener policy values. The token may also have + attached parameters; of these, the "report-to" parameter can have a valid URL + string identifying an appropriate reporting endpoint.

      Per the processing model described below, user agents will ignore this header if it contains an invalid value. Likewise, user agents will ignore this header if the value cannot be @@ -80966,66 +81016,208 @@ interface BarProp { reservedEnvironment:

        +

      1. Let policy be a new cross-origin opener policy.

        2. +

      2. If reservedEnvironment is a non-secure context, then return - "unsafe-none".

        3. + policy.

      3. Let value be the result of getting a structured field value given `Cross-Origin-Opener-Policy` and "item" from response's header list.

        4. -

      4. If value is null, then return "unsafe-none".

        5. +
      5. +

        If parsedItem is neither failure nor null, then:

        -

      6. If value[0] is not "same-origin" or - "same-origin-allow-popups", then return - "unsafe-none".

        7. +
          +
        1. +

          If parsedItem[0] is "same-origin", then:

          + +
            +

          1. Let coep be the result of obtaining a cross-origin embedder policy from response.

            2. + +

          2. If coep's value is "require-corp", then set policy's value to "same-origin-plus-COEP".

            3. + +

          3. Else, set policy's value to "same-origin".

            4. +
          +
          2. + +

        2. If parsedItem[0] is "same-origin-allow-popups", then set + policy's value to "same-origin-allow-popups".

          3. + +

        3. If parsedItem[1]["report-to"] exists and it is a string, then set reporting endpoint to + parsedItem[1]["report-to"].

          4. +
        + + +

      7. Set parsedItem to the result of getting a structured field value + given `Cross-Origin-Opener-Policy-Report-Only` and + "item" from response's header list.

      8. -

        If value[0] is "same-origin", then:

        +

        If parsedItem is neither failure nor null, then:

          -

        1. Let coep be the result of obtaining - an embedder policy from response.

          2. +
        2. +

          If parsedItem[0] is "same-origin", then:

          -

        3. If coep's value is - "require-corp", then return "same-origin-plus-COEP".

          4. +
            +

          1. Let coep be the result of obtaining a cross-origin embedder policy from response.

            2. + +
          2. +

            If coep's value is "require-corp" or coep's report-only value is "require-corp", then set policy's report-only value to "same-origin-plus-COEP".

            + +

            Report only COOP also considers report-only COEP to assign the special + "same-origin-plus-COEP" value. This allows + developers more freedom in the order of deployment of COOP and COEP.

            +
            3. + +

          3. Else, set policy's report-only + value to "same-origin".

            4. +
          + + +

        4. If parsedItem[0] is "same-origin-allow-popups", then set + policy's report-only value to + "same-origin-allow-popups".

          5. + +

        5. If parsedItem[1]["report-to"] exists and it is a string, then set report-only reporting endpoint to + parsedItem[1]["report-to"].

        9. -

      9. Return value[0].

        10. +

      10. Return policy.

      +

      Browsing context group switches due to cross-origin opener policy

      +

      To check if COOP values require + a browsing context group switch, given a boolean isInitialAboutBlank, two origins responseOrigin, + activeDocumentNavigationOrigin, and two cross-origin + opener policy values responseCOOPValue and activeDocumentCOOPValue:

      + +
        +

      1. If the result of matching + activeDocumentCOOPValue, activeDocumentNavigationOrigin, + responseCOOPValue and responseOrigin is true, return + false.

        2. + +
      2. +

        If all of the following are true:

        + +
          +

        • isInitialAboutBlank,

          • + +

        • activeDocumentCOOPValue's value is + "same-origin-allow-popups", and

          • + +

        • responseCOOPValue is "unsafe-none",

          • +
        + +

        then return false.

        +
        3. + +

      3. Return true.

        +
      + +

      To check if enforcing report-only COOP + would require a browsing context group switch, given a boolean + isInitialAboutBlank, two origins + responseOrigin, activeDocumentNavigationOrigin, and two cross-origin opener policies responseCOOP, + and activeDocumentCOOP:

      + +
        +
      1. +

        If the result of checking if + COOP values require a browsing context group switch given isInitialAboutBlank, + sandboxFlags, responseOrigin, activeDocumentNavigationOrigin, + responseCOOP's report-only value + and activeDocumentCOOPReportOnly's report-only value is false, then return false.

        + +

        Matching report-only policies allows a website to specify the same report-only + cross-origin opener policy on all its pages and not receive violation reports for navigations + between these pages.

        +
        2. + +

      2. If the result of checking if + COOP values require a browsing context group switch given isInitialAboutBlank, + sandboxFlags, responseOrigin, activeDocumentNavigationOrigin, + responseCOOP's value and + activeDocumentCOOPReportOnly's report-only value is true, then return true.

        3. + +

      3. If the result of checking if + COOP values require a browsing context group switch given isInitialAboutBlank, + sandboxFlags, responseOrigin, activeDocumentNavigationOrigin, + responseCOOP's report-only value + and activeDocumentCOOPReportOnly's value is + true, then return true.

        4. + +

      4. Return false.

        5. +
      +

      A cross-origin opener policy enforcement result is a struct with the following items:

      • A boolean needs a browsing context group - switch.

        • + switch, initially false.

        + +

      • A boolean would need a browsing context group switch due + to report-only, initially false.

        • -

      • An origin origin.

        • +

      • A URL url.

        • + +

      • An origin current origin.

      • A cross-origin opener policy cross-origin opener policy.

        • + +

      • A boolean current context is + navigation source.

      To enforce a response's cross-origin opener policy, given a - browsing context browsingContext, an origin - responseOrigin, a cross-origin opener policy responseCOOP, and - a cross-origin opener policy enforcement result - currentCOOPEnforcementResult:

      + browsing context browsingContext, a URL + responseURL, an origin responseOrigin, a cross-origin + opener policy responseCOOP, a cross-origin + opener policy enforcement result currentCOOPEnforcementResult and a referrer referrer:

      1. Let newCOOPEnforcementResult be a new cross-origin opener policy enforcement result whose needs a browsing context group switch is + data-x="coop-enforcement-result">cross-origin opener policy enforcement result given currentCOOPEnforcementResult's needs a - browsing context group switch, origin is - responseOrigin, and cross-origin opener - policy is responseCOOP.

        2. + browsing context group switch, currentCOOPEnforcementResult's would need a browsing context group switch due to + report-only, responseURL, responseOrigin, responseCOOP, + and true.

      2. Let isInitialAboutBlank be false.

        3. @@ -81034,49 +81226,135 @@ interface BarProp { created, then set isInitialAboutBlank to true.

        -

      3. If the result of matching - currentCOOPEnforcementResult's cross-origin opener policy, - currentCOOPEnforcementResult's origin, - responseCOOP, and responseOrigin is true, then return - newCOOPEnforcementResult.

        4. +

      4. If isInitialAboutBlank is true and browsingContext's initial url is null, set + browsingContext's initial url to + responseURL.

      5. -

        If all of the following are true:

        - -
          -

        • isInitialAboutBlank

          • +

          If the result of checking if + COOP values require a browsing context group switch given isInitialAboutBlank, + currentCOOPEnforcementResult's cross-origin + opener policy's value, + currentCOOPEnforcementResult's origin, + responseCOOP's value, and + responseOrigin is true, then:

          -

        • currentCOOPEnforcementResult's cross-origin opener policy is "same-origin-allow-popups"

          • +
            +

          1. Set newCOOPEnforcementResult's needs a browsing context group switch to + true.

            2. -

          2. responseCOOP is "unsafe-none"

            3. -
        +
      6. +

        If browsingContext's browsing context group's browsing + context set's size is greater than 1, then:

        -

        then return newCOOPEnforcementResult.

        +
          +

        1. If responseCOOP's reporting + endpoint is not null and result's needs a browsing context group switch is true, queue a violation report for browsing context group switch + when navigating to a COOP response with responseCOOP's reporting endpoint, responseCOOP's + value, "enforce", + responseURL, currentCOOPEnforcementResult's url, and referrer.

          2. + +

        2. If currentCOOPEnforcementResult's cross-origin opener policy's reporting endpoint is not null, + Queue a violation report for browsing context + group switch when navigating when navigating away from a COOP response with + activeDocumentCOOP's reporting + endpoint, currentCOOPEnforcementResult's cross-origin opener policy's value, "enforce", + currentCOOPEnforcementResult's url, + responseURL, and currentCOOPEnforcementResult's current context is navigation source.

          3. +
        +
        7. +
      -

    6. Set newCOOPEnforcementResult's needs - a browsing context group switch to true.

      7. +
    7. +

      If the result of checking if + enforcing report-only COOP would require a browsing context group switch given + isInitialAboutBlank, responseOrigin, + currentCOOPEnforcementResult's origin, + responseCOOP, and currentCOOPEnforcementResult's cross-origin opener policy, is true, then:

      + +
        +

      1. Set result's would + need a browsing context group switch due to report-only to true.

        2. + +
      2. +

        If browsingContext's browsing context group's browsing + context set's size is greater than 1, then:

        + +
          +

        1. If responseCOOP's reporting + endpoint is not null and result's needs a browsing context group switch is true, queue a violation report for browsing context group switch + when navigating to a COOP response with responseCOOP's report-only reporting endpoint, + responseCOOP's report-only + value, "reporting", responseURL, + currentCOOPEnforcementResult's url, and + referrer.

          2. + +

        2. If currentCOOPEnforcementResult's cross-origin opener policy's report-only reporting endpoint is not + null, Queue a violation report for browsing + context group switch when navigating when navigating away from a COOP response with + activeDocumentCOOP's report-only + reporting endpoint, currentCOOPEnforcementResult's cross-origin opener policy's report-only value, "reporting", currentCOOPEnforcementResult's url, responseURL, and + currentCOOPEnforcementResult's current + context is navigation source.

          3. +
        +
        3. +
      +

    8. Return newCOOPEnforcementResult.

    To obtain a browsing context to use for a - navigation response, given a browsing context - browsingContext, a sandboxing flag set sandboxFlags, and a - cross-origin opener policy navigationCOOP:

    + navigation response, given a browsing contexts + browsingContext, a sandboxing flag set sandboxFlags, a + cross-origin opener policy navigationCOOP and a cross-origin opener policy enforcement result + coopEnforcementResult:

    1. Assert: browsingContext is a top-level browsing context.

      2. +
    2. +

      If coopEnforcementResult's needs a + browsing context group switch is false, then:

      + +
        +

      1. If coopEnforcementResult's would need a browsing context group switch due + to report-only is true, set browsing context's virtual browsing context group id to a new + unique identifyer.

        2. + +

      2. return browsingContext.

        3. +
      +
      3. +

    3. Let newBrowsingContext be the result of creating a new top-level browsing context.

      4. -

    4. If navigationCOOP is "

      If navigationCOOP's value is "same-origin-plus-COEP", then set newBrowsingContext's group's cross-origin isolated to true.

      5. @@ -81084,8 +81362,8 @@ interface BarProp {

    5. If sandboxFlags is not empty, then:

        -

      1. Assert: navigationCOOP is "unsafe-none".

        2. +

      2. Assert navigationCOOP's value is + "unsafe-none".

      3. Assert: newBrowsingContext's popup sandboxing flag set is empty.

        4. @@ -81112,6 +81390,623 @@ interface BarProp { fully defined. It is currently under discussion in issue #5350.

        +

        Reporting

        + +

        To check if an access between two browsing contexts + should be reported, given two browsing contexts + accessor and accessed, an array index property name + P, a global object globalObject, and an + environment environement:

        + +
          +

        1. If P is not part of CrossOriginProperties, return.

          2. + +
        2. +

          If accessor or any of its ancestors are not same origin with its + top-level browsing context, or if accessed or any of its ancestors are not same origin with its + top-level browsing context, return.

          + +

          This avoids leaking information about cross-origin iframes to a top level frame + with cross-origin opener policy reporting

          +
          3. + +

        3. If accessor's top-level browsing context's virtual browsing context group id is + accessed's top-level browsing context's virtual browsing context group id, + return.

          4. + +

        4. Let accessorCOOP be accessor's top-level browsing + context's active document's cross-origin + opener policy.

          5. + +
        5. +

          If accessorCOOP's report-only + reporting endpoint is not null, then:

          + +
            +

          1. If accessor's opener browsing context is accessed or + an ancestor of accessed, queue a violation report for access to the + opener, given accessorCOOP's report-only reporting + endpoint,accessorCOOP's report-only value, accessor's + active document's URL, + accessed's active document's URL, accessor's + active document's origin, accessed's active + document's origin, P, accessor's top-level + browsing context's active document's referrer, globalObject, and + environment.

            2. + +

          2. Else, if accessed's opener browsing context is + accessor or an ancestor of + accessor, queue a violation report + for access to an opened window, given accessorCOOP's report-only reporting + endpoint,accessorCOOP's report-only value, accessor's + active document's URL, + accessed's active document's URL, accessed's top-level browsing + context's initial url, + accessor's active document's origin, accessed's + active document's origin, accessed's top-level + browsing context's opener origin at + creation, P, globalObject, and environment.

            3. + +

          3. Else, queue a violation report for access + to another window, given accessorCOOP's report-only reporting + endpoint,accessorCOOP's report-only value, accessor's + active document's URL, + accessed's active document's URL, accessor's + active document's origin, accessed's active + document's origin, P, globalObject, and + environment.

            4. +
          +
          6. + +

        6. Let accessedCOOP be accessed's top-level browsing + context's active document's cross-origin + opener policy.

          7. + +
        7. +

          If accessedCOOP's report-only + reporting endpoint is not null, then:

          + +
            +

          1. If accessed's opener browsing context is accessor or + an ancestor of accessor, queue a violation report for access from the + opener, given accessedCOOP's report-only reporting + endpoint,accessedCOOP's report-only value, accessed's + active document's URL, + accessor's active document's URL, accessed's + active document's origin, accessor's active + document's origin, P, and accessed's top-level + browsing context's active document's referrer.

            2. + +

          2. Else, if accessor's opener browsing context is + accessed or an ancestor of + accessed, queue a violation report + for access from an opened window, given accessedCOOP's report-only reporting + endpoint,accessedCOOP's report-only value, accessed's + active document's URL, + accessor's active document's URL, accessor's top-level browsing + context's initial url, + accessed's active document's origin, accessor's + active document's origin, accessor's top-level + browsing context's opener origin at + creation, and P.

            3. + +

          3. Else, queue a violation report for + access from another window, given accessedCOOP's report-only reporting + endpoint,accessedCOOP's report-only value, accessed's + active document's URL, + accessor's active document's URL, accessed's + active document's origin, accessor's active + document's origin, and P.

            4. +
          +
          8. +
        + +

        To sanitize a URL to send in a report given a + URL url:

        + +
          +

        1. Let sanitizedURL be a copy of url.

          2. + +

        2. Set the username given sanitizedURL and + the empty string. + +

        3. Set the password given sanitizedURL and + the empty string. + +

        4. Return the serialization of + sanitizedURL with the exclude fragment flag set.

          5. +
        + +

        To queue a violation report for browsing context group + switch when navigating to a COOP response given a string endpoint, a cross-origin opener policy value + coopValue, a string disposition, a URL coopURL, a + URL previousResponseURL, and a referrer + referrer:

        + +
          + +
        1. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          dispositiondisposition
          effective-policycoopValue
          previousResponseUrlIf coopURL and previousResponseURL are same origin this + is the sanitization of + previousResponseURL, null otherwise.
          referrerreferrer.
          violationTypenavigation-to-response
          +
          2. + +

        2. Queue body as "coop" + for endpoint with coopURL.

          3. +
        + +

        To queue a violation report for browsing context group + switch when navigating away from a COOP response given a string endpoint, a cross-origin opener policy value + coopValue, a string disposition, a URL coopURL, a + URL nextResponseURL, and a boolean + isCOOPResponseNavigationSource:

        + +
          + +
        1. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          dispositiondisposition
          effective-policycoopValue
          nextResponseUrlIf coopURL and nextResponseURL are same origin or + isCOOPResponseNavigationSource is true, this is the sanitization of previousResponseURL, null + otherwise.
          violationTypenavigation-to-response
          +
          2. + +

        2. Queue body as "coop" + for endpoint with coopURL.

          3. +
        + +

        To queue a violation report for access to the + opener, given a string endpoint, a cross-origin opener policy value + coopValue, two URLs coopURL and + openerURL, two origins coopOrigin and + openerOrigin, a string propertyName, a referrer referrer, a global + object globalObject, and an environment settings object + environment:

        + +
          + +
        1. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          disposition"reporting"
          effectivePolicycoopValue
          propertypropertyName
          openerUrlIf coopOrigin and openerOrigin are same origin, this + is the sanitization of openerURL, null + otherwise.
          referrerreferrer
          sourceFileExtract it from globalObject
          lineNumberExtract it from globalObject
          columnNumberExtract it from globalObject
          violationTypeaccess-to-opener
          +
          2. + +

        2. Queue body as "coop" + for endpoint with coopURL and environment.

          3. +
        + +

        To queue a violation report for access to an + opened window, given a string endpoint, a cross-origin opener policy value + coopValue, three URLs coopURL, + openedWindowURL and initialWindowURL, three origins coopOrigin, openedWindowOrigin, and + openerInitialOrigin,a string propertyName, a global + object globalObject, and an environment settings object + environment:

        + +
          + +
        1. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          disposition"reporting"
          effectivePolicycoopValue
          propertypropertyName
          openedWindowUrlIf coopOrigin and openedWindowOrigin are same origin, this + is the sanitization of openedWindowURL, + null otherwise.
          openedWindowInitialUrlIf coopOrigin and openerInitialOrigin are same origin, + this is the sanitization of + initialWindowURL, null otherwise.
          sourceFileExtract it from globalObject
          lineNumberExtract it from globalObject
          columnNumberExtract it from globalObject
          violationTypeaccess-to-opener
          +
          2. + +

        2. Queue body as "coop" + for endpoint with coopURL and environment.

          3. +
        + + +

        To queue a violation report for access to another + window, given a string endpoint, a cross-origin opener policy value + coopValue, two URLs coopURL and + otherURL, two origins coopOrigin and + otherOrigin, a string propertyName, a global + object globalObject, and an environment settings object + environment:

        + +
          + +
        1. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          disposition"reporting"
          effectivePolicycoopValue
          propertypropertyName
          otherUrlIf coopOrigin and otherOrigin are same origin, this + is the sanitization of otherURL, null + otherwise.
          sourceFileExtract it from globalObject
          lineNumberExtract it from globalObject
          columnNumberExtract it from globalObject
          violationTypeaccess-to-opener
          +
          2. + +

        2. Queue body as "coop" + for endpoint with coopURL and environment.

          3. +
        + +

        To queue a violation report for access from the + opener, given a string endpoint, a cross-origin opener policy value + coopValue, two URLs coopURL and + openerURL, two origins coopOrigin and + openerOrigin, a string propertyName, and a referrer referrer:

        + +
          + +
        1. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          disposition"reporting"
          effectivePolicycoopValue
          propertypropertyName
          openerUrlIf coopOrigin and openerOrigin are same origin, this + is the sanitization of openerURL, null + otherwise.
          referrerreferrer
          violationTypeaccess-to-opener
          +
          2. + +

        2. Queue body as "coop" + for endpoint with coopURL.

          3. +
        + +

        To queue a violation report for access from an + opened window, given a string endpoint, a cross-origin opener policy value + coopValue, three URLs coopURL, + openedWindowURL and initialWindowURL, three origins coopOrigin, openedWindowOrigin, and + openerInitialOrigin, and a string propertyName:

        + +
          + +
        1. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          disposition"reporting"
          effectivePolicycoopValue
          propertypropertyName
          openedWindowUrlIf coopOrigin and openedWindowOrigin are same origin, this + is the sanitization of openedWindowURL, + null otherwise.
          openedWindowInitialUrlIf coopOrigin and openerInitialOrigin are same origin, + this is the sanitization of + initialWindowURL, null otherwise.
          violationTypeaccess-to-opener
          +
          2. + +

        2. Queue body as "coop" + for endpoint with coopURL.

          3. +
        + + +

        To queue a violation report for access from another + window, given a string endpoint, a cross-origin opener policy value + coopValue, two URLs coopURL and + otherURL, two origins coopOrigin and + otherOrigin, and a string propertyName:

        + +
          + +
        1. +

          Let body be a new object containing the following properties:

          + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
          keyvalue
          disposition"reporting"
          effectivePolicycoopValue
          propertypropertyName
          otherUrlIf coopOrigin and otherOrigin are same origin, this + is the sanitization of otherURL, null + otherwise.
          violationTypeaccess-to-opener
          +
          2. + +

        2. Queue body as "coop" + for endpoint with coopURL.

          3. +

        Cross-origin embedder policies

        @@ -81257,12 +82152,12 @@ interface BarProp { data-x="">require-corp        ":

          -

        1. Set policy's report only +

        2. Set policy's report-only value to "require-corp".

          3. .

        3. If parsedItem[1]["report-to"] exists, then set policy's report only reporting endpoint + data-x="embedder-policy-report-only-reporting-endpoint">report-only reporting endpoint to parsedItem[1]["report-to"].

        @@ -81287,7 +82182,7 @@ interface BarProp { data-x="bc-container-document">container document's embedder policy.

        -

      4. If parentPolicy's report only +

      5. If parentPolicy's report-only value is "require-corp" and responsePolicy's value is "unsafe-none", then queue a cross-origin embedder policy @@ -81326,7 +82221,7 @@ interface BarProp {

      6. Let ownerPolicy be owner's embedder policy. -

      7. If ownerPolicy's report only +

      8. If ownerPolicy's report-only value is "require-corp" and policy's value is "unsafe-none", then queue a cross-origin embedder policy @@ -83156,16 +84051,19 @@ interface Location { // but see also cross-origin opener policy

        a cross-origin opener policy to use for the new Document
        +
        COOP enforcement result
        +
        a cross-origin opener policy enforcement + result, used for reporting and potentially for causing a browsing context + group switch
        +
        reserved environment
        null or an environment reserved for the new Document
        browsing context
        -
        the browsing context to be navigated (but see below)
        - -
        browsing context switch needed
        -
        a boolean indicating whether or not the navigation should conclude by discarding the given browsing context and creating a new one
        +
        the browsing context to be navigated (or discarded, if a browsing context group + switch occurs)
        history handling
        a history handling behavior
        @@ -83353,17 +84251,25 @@ interface Location { // but see also url, finalSandboxFlags, incumbentNavigationOrigin, and activeDocumentNavigationOrigin.

        9. +

      9. Let coop be a new cross-origin opener policy.

        10. + +

      10. Let coopEnforcementResult be a new is a new cross-origin opener policy enforcement result given + false, false, resource's url, + responseOrigin, coop and false.

        11. +

      11. Let navigationParams be a new navigation params whose request is null, response is resource, origin is responseOrigin, final sandboxing flag set is finalSandboxFlags, cross-origin opener - policy is "unsafe-none", is coop, COOP enforcement result is + coopEnforcementResult, reserved environment is null, browsing context is - browsingContext, browsing - context switch needed is false, and history + browsingContext, and history handling is historyHandling.

      12. Run process a navigate response with navigationType, the @@ -83388,6 +84294,13 @@ interface Location { // but see also sandboxing flags and response's forced sandboxing flag set.

        13. +

      13. Let coopEnforcementResult be a new is a new cross-origin opener policy enforcement result given + false, false, resource's url, + activeDocumentNavigationOrigin, browsingContext's active + document's cross-origin opener policy and + false.

        14. +

      14. Let navigationParams be a new navigation params whose request is resource, response is response, Location { // but see also cross-origin opener policy is browsingContext's active document's cross-origin opener policy, COOP enforcement result is + coopEnforcementResult, reserved environment is null, browsing context is - browsingContext, browsing - context switch needed is false, and history + browsingContext, and history handling is historyHandling.

      15. Run process a navigate response with navigationType, the @@ -83502,20 +84416,25 @@ interface Location { // but see also cross-origin opener policy enforcement result whose needs a browsing context group switch is false, origin is browsingContext's - active document's origin, and cross-origin opener policy is browsingContext's - active document's cross-origin opener - policy.

        16. + data-x="coop-enforcement-bcg-switch-report-only">would need a browsing context group switch due + to report-only is false,url is + browsingContext's active document's url, origin is browsingContext's active + document's origin, cross-origin opener + policy is browsingContext's active document's cross-origin opener policy, and current context is navigation source is + currentContextIsSource.

      16. Let finalSandboxFlags be an empty sandboxing flag set.

        17. -

      17. Let responseCOOP be "unsafe-none".

        18. -

      18. While true:

        @@ -83619,7 +84538,8 @@ interface Location { // but see also         If sandboxFlags is not empty and responseCOOP's value is not "unsafe-none", then set response to an appropriate network error and break.

        @@ -83630,8 +84550,10 @@ interface Location { // but see also         enforcing the response's cross-origin opener policy given - browsingContext, responseOrigin, responseCOOP, and - coopEnforcementResult.

        19. + browsingContext, request's url, responseOrigin, + responseCOOP, coopEnforcementResult and request's referrer.

      6. @@ -83751,7 +84673,6 @@ interface Location { // but see also request is request, response is response, Location { // but see also final sandboxing flag set is finalSandboxFlags, cross-origin opener policy is responseCOOP, COOP enforcement result is + coopEnforcementResult, reserved environment is reservedEnvironment, browsing - context is browsingContext, browsing context switch needed is - coopEnforcementResult's needs a browsing - context group switch, and history + context is browsingContext, and history handling is historyHandling.

    6. Run process a navigate response with navigationType, the @@ -84061,17 +84981,14 @@ interface Location { // but see also browsing context.

      7. - -

    7. If navigationParams's browsing context switch needed is true, then - set browsingContext to the result of the obtain a browsing context to use for a navigation - response algorithm, given browsingContext, navigationParams's final sandboxing flag set, and - navigationParams's cross-origin opener - policy.

      8. +

    8. Let browsingContext be the result of the obtaining a browsing context to use for a navigation + response given navigationParams's browsing context, + navigationParams's final sandboxing flag + set, navigationParams's cross-origin + opener policy, and navigationParams's COOP enforcement result.

    9. Let permissionsPolicy be the result of creating a permissions policy from a @@ -84705,12 +85622,13 @@ new PaymentRequest(…); // Allowed to use data-x="navigation-params-origin">origin is a new opaque origin, final sandboxing flag set is an empty set, cross-origin opener policy is "unsafe-none", reserved environment is null, cross-origin opener policy is a new cross-origin + opener policy, COOP enforcement + result is a new cross-origin opener policy + enforcement result, reserved environment is null, and browsing context is - browsingContext, and browsing - context switch needed is false.

      + browsingContext.

      The algorithm called in the next step is not prepared to deal with a null response. Probably we should synthesize one @@ -119253,6 +120171,30 @@ interface External { +

      `Cross-Origin-Opener-Policy-Report-Only`

      + +

      This section describes a header for registration in the Permanent Message Header Field + Registry.

      + +
      +
      Header field name:
      +
      Cross-Origin-Opener-Policy-Report-Only
      +
      Applicable protocol:
      +
      http
      +
      Status:
      +
      standard
      +
      Author/Change controller:
      +
      WHATWG
      +
      Specification document(s):
      +
      + This document is the relevant specification. +
      +
      Related information:
      +
      None.
      +
      + +

      `Ping-From`

      This section describes a header for registration in the Permanent Message Header Field From 135f9041aa3f672cc54eef56db000fe768b78957 Mon Sep 17 00:00:00 2001 From: Camille Lamy Date: Wed, 28 Oct 2020 11:53:52 +0100 Subject: [PATCH 02/15] Change to virtual browsing context group ID --- source | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/source b/source index e38f41e7c37..3c8f99af2e3 100644 --- a/source +++ b/source @@ -77316,7 +77316,10 @@ popup4.close(); data-x="hh-replace">replace".

      A browsing context has a virtual - browsing context group id integer. It is initially 0.

      + browsing context group ID integer. It is initially 0. This is used by cross-origin opener policy reporting, to keep track + of the browsing context group switches that would have happened if the report-only policy had been + enforced.

      A browsing context has an initial url, which is a URL or null. It is initially null.

      @@ -77405,9 +77408,9 @@ popup4.close(); creator's URL, browsingContext's creator base URL to return creator's base URL, and browsingContext's virtual browsing context group id to + data-x="virtual-browsing-context-group-id">virtual browsing context group ID to creator's top-level browsing context's virtual browsing context group id.

      10. + data-x="virtual-browsing-context-group-id">virtual browsing context group ID.

    10. Let sandboxFlags be the result of determining the creation sandboxing flags given browsingContext and embedder.

      11. @@ -77533,9 +77536,9 @@ popup4.close(); opener.

    11. Set browsingContext's virtual - browsing context group id to opener's top-level browsing context's + browsing context group ID to opener's top-level browsing context's virtual browsing context group - id.

      12. + ID.

    12. Set browsingContext's opener origin at creation to opener's active document's @@ -81344,7 +81347,7 @@ interface BarProp {

    13. If coopEnforcementResult's would need a browsing context group switch due to report-only is true, set browsing context's virtual browsing context group id to a new + data-x="virtual-browsing-context-group-id">virtual browsing context group ID to a new unique identifyer.

    14. return browsingContext.

      15. @@ -81413,9 +81416,9 @@ interface BarProp {

    15. If accessor's top-level browsing context's virtual browsing context group id is + data-x="virtual-browsing-context-group-id">virtual browsing context group ID is accessed's top-level browsing context's virtual browsing context group id, + data-x="virtual-browsing-context-group-id">virtual browsing context group ID, return.

    16. Let accessorCOOP be accessor's top-level browsing From d755763dc8f9fe47337a43100fccb1f49b4cfd88 Mon Sep 17 00:00:00 2001 From: Camille Lamy Date: Wed, 28 Oct 2020 11:57:48 +0100 Subject: [PATCH 03/15] Changes to browsing context initial URL --- source | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/source b/source index 3c8f99af2e3..4529b2fcc09 100644 --- a/source +++ b/source @@ -77322,7 +77322,7 @@ popup4.close(); enforced.

      A browsing context has an initial - url, which is a URL or null. It is initially null.

      + URL, which is a URL or null. It is initially null.

      A browsing context has an opener origin at creation, which is an origin or null. It is initially null.

      @@ -81230,8 +81230,8 @@ interface BarProp { isInitialAboutBlank to true.

    17. If isInitialAboutBlank is true and browsingContext's initial url is null, set - browsingContext's initial url to + data-x="browsing-context-initial-url">initial URL is null, set + browsingContext's initial URL to responseURL.

    18. @@ -81456,7 +81456,7 @@ interface BarProp { active document's URL, accessed's active document's URL, accessed's top-level browsing - context's initial url, + context's initial URL, accessor's active document's origin, accessed's active document's origin, accessed's top-level browsing context's opener origin at @@ -81510,7 +81510,7 @@ interface BarProp { active document's URL, accessor's active document's URL, accessor's top-level browsing - context's initial url, + context's initial URL, accessed's active document's origin, accessor's active document's origin, accessor's top-level browsing context's opener origin at From 85f285c754977e61466285be80daf32961c87b8a Mon Sep 17 00:00:00 2001 From: Camille Lamy Date: Wed, 28 Oct 2020 12:03:00 +0100 Subject: [PATCH 04/15] Change link destination --- source | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/source b/source index 4529b2fcc09..df9ba13c5c0 100644 --- a/source +++ b/source @@ -79923,8 +79923,9 @@ interface BarProp { this.

    19. Check if an access between two browsing contexts - should be reported, given the current global object's browsing - context, W's browsing context, P, the current + should be reported, given the current global object's + browsing context, W's browsing context, P, the current global object, and the current settings object.

    20. If ! IsPlatformObjectSameOrigin(W) is true, then return ? From 0e5310b11fe03f4b0016333c6f955a9f7759178a Mon Sep 17 00:00:00 2001 From: Camille Lamy Date: Wed, 28 Oct 2020 12:10:12 +0100 Subject: [PATCH 05/15] Small changes in COOP definition --- source | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/source b/source index df9ba13c5c0..59abfb98577 100644 --- a/source +++ b/source @@ -80959,7 +80959,7 @@ interface BarProp {

      A cross-origin opener policy consists of:

      -
        +

        • A value, which is a cross-origin opener policy value, initially "unsafe-none".

          • @@ -80973,7 +80973,7 @@ interface BarProp {

        • A report-only reporting endpoint, which is a string or null, initially null.

          • -
      +

      To match cross-origin opener policy values, given a cross-origin opener policy value A, an origin @@ -81031,7 +81031,7 @@ interface BarProp { data-x="concept-response-header-list">header list.

    21. -

      If parsedItem is neither failure nor null, then:

      +

      If parsedItem is not null, then:

      1. @@ -81046,7 +81046,8 @@ interface BarProp { data-x="coop-struct-value">value to "same-origin-plus-COEP".

        2. -

      2. Else, set policy's value to "

        Otherwise, set policy's value to "same-origin".

      22. @@ -81057,7 +81058,7 @@ interface BarProp { data-x="coop-same-origin-allow-popups">same-origin-allow-popups".

    22. If parsedItem[1]["report-to"] exists and it is a string, then set exists and it is a string, then set policy's reporting endpoint to parsedItem[1]["report-to"].

    @@ -81070,7 +81071,7 @@ interface BarProp { data-x="concept-response-header-list">header list.

  • -

    If parsedItem is neither failure nor null, then:

    +

    If parsedItem is not null, then:

    1. @@ -81093,8 +81094,9 @@ interface BarProp { developers more freedom in the order of deployment of COOP and COEP.

      2. -

    2. Else, set policy's report-only - value to "same-origin".

      3. +

    3. Otherwise, set policy's report-only value to "same-origin".

    • @@ -81104,7 +81106,7 @@ interface BarProp { "same-origin-allow-popups".

  • If parsedItem[1]["report-to"] exists and it is a string, then set exists and it is a string, then set policy's report-only reporting endpoint to parsedItem[1]["report-to"].

    • @@ -81125,7 +81127,7 @@ interface BarProp {

    1. If the result of matching activeDocumentCOOPValue, activeDocumentNavigationOrigin, - responseCOOPValue and responseOrigin is true, return + responseCOOPValue, and responseOrigin is true, return false.

    2. @@ -81135,7 +81137,7 @@ interface BarProp {

    3. isInitialAboutBlank,

    4. activeDocumentCOOPValue's value is - "same-origin-allow-popups", and

      5. + "same-origin-allow-popups".

    5. responseCOOPValue is "unsafe-none",

      6. From 2959d451e5b1d252411f6fd4e2f1f813194a3110 Mon Sep 17 00:00:00 2001 From: Camille Lamy Date: Wed, 28 Oct 2020 14:47:22 +0100 Subject: [PATCH 06/15] Change struct initialization --- source | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/source b/source index 59abfb98577..0e5b45f89fb 100644 --- a/source +++ b/source @@ -81218,12 +81218,18 @@ interface BarProp {

      1. Let newCOOPEnforcementResult be a new cross-origin opener policy enforcement result given + data-x="coop-enforcement-result">cross-origin opener policy enforcement result whose needs a browsing context group switch is currentCOOPEnforcementResult's needs a - browsing context group switch, currentCOOPEnforcementResult's would need a browsing context group switch due to - report-only, responseURL, responseOrigin, responseCOOP, - and true.

        2. + browsing context group switch, would need a browsing context group switch due + to report-only is currentCOOPEnforcementResult's would need a browsing context group switch due + to report-only, url is responseURL, + origin is responseOrigin, + coop is responseCOOP, and + current context is navigation source is + true.

      2. Let isInitialAboutBlank be false.

        3. From 47a9653c221e7c676f9c12d8f817f88495ff4b17 Mon Sep 17 00:00:00 2001 From: Camille Lamy Date: Wed, 28 Oct 2020 15:01:18 +0100 Subject: [PATCH 07/15] Change queue calls --- source | 81 ++++++++++++++++++++++------------------------------------ 1 file changed, 31 insertions(+), 50 deletions(-) diff --git a/source b/source index 0e5b45f89fb..a31aaa621a3 100644 --- a/source +++ b/source @@ -81262,25 +81262,15 @@ interface BarProp { context set's size is greater than 1, then:

          -

        1. If responseCOOP's reporting - endpoint is not null and result's needs a browsing context group switch is true, queue a violation report for browsing context group switch - when navigating to a COOP response with responseCOOP's reporting endpoint, responseCOOP's - value, "enforce", - responseURL, currentCOOPEnforcementResult's url, and referrer.

          2. - -

        2. If currentCOOPEnforcementResult's cross-origin opener policy's reporting endpoint is not null, - Queue a violation report for browsing context - group switch when navigating when navigating away from a COOP response with - activeDocumentCOOP's reporting - endpoint, currentCOOPEnforcementResult's cross-origin opener policy's value, "enforce", +

        3. Queue a violation report for browsing + context group switch when navigating to a COOP response with responseCOOP, + "enforce", responseURL, + currentCOOPEnforcementResult's url, and + referrer.

          4. + +

        4. Queue a violation report for browsing + context group switch when navigating when navigating away from a COOP response with + activeDocumentCOOP, "enforce", currentCOOPEnforcementResult's url, responseURL, and currentCOOPEnforcementResult's current context is navigation source.

          5. @@ -81306,30 +81296,19 @@ interface BarProp { context set's size is greater than 1, then:

            -

          1. If responseCOOP's reporting - endpoint is not null and result's needs a browsing context group switch is true, queue a violation report for browsing context group switch - when navigating to a COOP response with responseCOOP's report-only reporting endpoint, - responseCOOP's report-only - value, "reporting", responseURL, +

          2. Queue a violation report for browsing context group switch + when navigating to a COOP response with responseCOOP, "reporting", responseURL, currentCOOPEnforcementResult's url, and referrer.

            3. -

          3. If currentCOOPEnforcementResult's cross-origin opener policy's report-only reporting endpoint is not - null, Queue a violation report for browsing +

          4. Queue a violation report for browsing context group switch when navigating when navigating away from a COOP response with - activeDocumentCOOP's report-only - reporting endpoint, currentCOOPEnforcementResult's cross-origin opener policy's report-only value, "reporting", currentCOOPEnforcementResult's url, responseURL, and - currentCOOPEnforcementResult's current - context is navigation source.

            5. + activeDocumentCOOP, "reporting", + currentCOOPEnforcementResult's url, + responseURL, and currentCOOPEnforcementResult's current context is navigation source.

        @@ -81556,13 +81535,14 @@ interface BarProp {

      To queue a violation report for browsing context group - switch when navigating to a COOP response given a string endpoint, a cross-origin opener policy value - coopValue, a string disposition, a URL coopURL, a - URL previousResponseURL, and a referrer - referrer:

      + switch when navigating to a COOP response given a cross-origin opener policy coop, a string disposition, a + URL coopURL, a URL previousResponseURL, and a referrer referrer:

        +

      1. If coop's reporting endpoint + is null, return.

      2. Let body be a new object containing the following properties:

        @@ -81581,7 +81561,7 @@ interface BarProp { effective-policy - coopValue + coop's value previousResponseUrl @@ -81606,13 +81586,14 @@ interface BarProp {

      To queue a violation report for browsing context group - switch when navigating away from a COOP response given a string endpoint, a cross-origin opener policy value - coopValue, a string disposition, a URL coopURL, a - URL nextResponseURL, and a boolean + switch when navigating away from a COOP response given a cross-origin opener policy coopValue, a string disposition, a + URL coopURL, a URL nextResponseURL, and a boolean isCOOPResponseNavigationSource:

        +

      1. If coop's reporting endpoint + is null, return.

      2. Let body be a new object containing the following properties:

        @@ -81631,7 +81612,7 @@ interface BarProp { effective-policy - coopValue + coop's value nextResponseUrl From 2893f75804a2db214757f1a85a388cd4aac5ceff Mon Sep 17 00:00:00 2001 From: Camille Lamy Date: Wed, 28 Oct 2020 17:17:44 +0100 Subject: [PATCH 08/15] Small changes --- source | 46 ++++++++++++++++++++++++---------------------- 1 file changed, 24 insertions(+), 22 deletions(-) diff --git a/source b/source index a31aaa621a3..05f4c57b893 100644 --- a/source +++ b/source @@ -81269,7 +81269,7 @@ interface BarProp { referrer.

      3. Queue a violation report for browsing - context group switch when navigating when navigating away from a COOP response with + context group switch when navigating away from a COOP response with activeDocumentCOOP, "enforce", currentCOOPEnforcementResult's url, responseURL, and currentCOOPEnforcementResult's BarProp { referrer.

      4. Queue a violation report for browsing - context group switch when navigating when navigating away from a COOP response with + context group switch when navigating away from a COOP response with activeDocumentCOOP, "reporting", currentCOOPEnforcementResult's url, responseURL, and currentCOOPEnforcementResult's BarProp { data-x="coop-enforcement-bcg-switch-report-only">would need a browsing context group switch due to report-only is true, set browsing context's virtual browsing context group ID to a new - unique identifyer.

        5. + unique identifier.

        -

      5. return browsingContext.

        6. +

      6. Return browsingContext.

      @@ -81385,19 +81385,22 @@ interface BarProp {

      To check if an access between two browsing contexts should be reported, given two browsing contexts - accessor and accessed, an array index property name + accessor and accessed, a JavaScript property name P, a global object globalObject, and an environment environement:

        -

      1. If P is not part of CrossOriginProperties, return.

        2. +

      2. If P is not part of CrossOriginProperties, then return.

      3. -

        If accessor or any of its ancestors are not same origin with its - top-level browsing context, or if accessed or any of its ancestors are not same origin with its - top-level browsing context, return.

        +

        If accessor's active document's origin or any of its + ancestors's active document's + origin are not same origin with its top-level browsing + context's active document's origin, or if accessed's + active document's origin or any of its ancestors's active document's origin are not same + origin with its top-level browsing context's active document's + origin, then return.

        This avoids leaking information about cross-origin iframes to a top level frame with cross-origin opener policy reporting

        @@ -81406,7 +81409,7 @@ interface BarProp {

      4. If accessor's top-level browsing context's virtual browsing context group ID is accessed's top-level browsing context's virtual browsing context group ID, + data-x="virtual-browsing-context-group-id">virtual browsing context group ID, then return.

      5. Let accessorCOOP be accessor's top-level browsing @@ -81423,7 +81426,7 @@ interface BarProp { data-x="coop-violation-access-to-opener">queue a violation report for access to the opener, given accessorCOOP's report-only reporting - endpoint,accessorCOOP's , accessorCOOP's report-only value, accessor's active document's URL, accessed's active document's BarProp { data-x="dom-document-referrer">referrer, globalObject, and environment.

        6. -

      6. Else, if accessed's opener browsing context is +

      7. Otherwise, if accessed's opener browsing context is accessor or an ancestor of accessor, queue a violation report for access to an opened window, given accessorCOOP's BarProp { browsing context's opener origin at creation, P, globalObject, and environment.

        8. -

      8. Else, queue a violation report for access - to another window, given accessorCOOP's

        Otherwise, queue a violation report for + access to another window, given accessorCOOP's report-only reporting endpoint,accessorCOOP's report-only value, accessor's active document's URL, accessed's active document's URL, accessor's - active document's origin, accessed's active - document's origin, P, globalObject, and - environment.

        9. + data-x="concept-document-url">URL, accessor's active document's + origin, accessed's active document's origin, + P, globalObject, and environment.

      @@ -81488,7 +81490,7 @@ interface BarProp { browsing context's active document's referrer.

      -

    6. Else, if accessor's opener browsing context is +

    7. Otherwise, if accessor's opener browsing context is accessed or an ancestor of accessed, queue a violation report for access from an opened window, given accessedCOOP's BarProp { browsing context's opener origin at creation, and P.

      8. -

    8. Else, queue a violation report for +

    9. Otherwise, queue a violation report for access from another window, given accessedCOOP's report-only reporting endpoint,accessedCOOP's Date: Wed, 28 Oct 2020 17:32:59 +0100 Subject: [PATCH 09/15] Change access reporting --- source | 341 +++++++++++++++++++++++++++++++++------------------------ 1 file changed, 196 insertions(+), 145 deletions(-) diff --git a/source b/source index 05f4c57b893..33d5bd68417 100644 --- a/source +++ b/source @@ -81383,6 +81383,27 @@ interface BarProp {

      Reporting

      +

      An accessor-accessed relationship is an enum that describes the relationship between + two browsing contexts between which an access hapenned. It + can take the following values:

      + +
      +
      accessor is opener
      +

      The accessor browsing context or one of its ancestors is the opener browsing context of the accessed + browsing context's top-level browsing context.

      + +
      accessor is openee
      +

      The accessed browsing context or one of its ancestors is the opener browsing context of the accessor + browsing context's top-level browsing context.

      + +
      none
      +

      There is no opener relationship between the accessor browsing context, the + accessor browsing context, or any of their ancestors.

      +
      +

      To check if an access between two browsing contexts should be reported, given two browsing contexts accessor and accessed, a JavaScript property name @@ -81412,112 +81433,40 @@ interface BarProp { data-x="virtual-browsing-context-group-id">virtual browsing context group ID, then return.

      10. -

    10. Let accessorCOOP be accessor's top-level browsing - context's active document's cross-origin - opener policy.

      11. +

    11. Let accessorAccessedRelationship be a new accessor-accessed + relationship with value none.

      12. -
    12. -

      If accessorCOOP's report-only - reporting endpoint is not null, then:

      +

    13. If accessed's top-level browsing context's opener browsing + context is accessor or an ancestor of accessor, then set accessorAccessedRelationship to + accessor is opener.

      14. -
        -

      1. If accessor's opener browsing context is accessed or - an ancestor of accessed, queue a violation report for access to the - opener, given accessorCOOP's report-only reporting - endpoint, accessorCOOP's report-only value, accessor's - active document's URL, - accessed's active document's URL, accessor's - active document's origin, accessed's active - document's origin, P, accessor's top-level - browsing context's active document's referrer, globalObject, and - environment.

        2. +

      2. If accessor's top-level browsing context's opener browsing + context is accessed or an ancestor of accessed, then set accessorAccessedRelationship to + accessor is openee.

        3. -

      3. Otherwise, if accessed's opener browsing context is - accessor or an ancestor of - accessor, queue a violation report - for access to an opened window, given accessorCOOP's report-only reporting - endpoint,accessorCOOP's report-only value, accessor's - active document's URL, - accessed's active document's URL, accessed's top-level browsing - context's initial URL, - accessor's active document's origin, accessed's - active document's origin, accessed's top-level - browsing context's opener origin at - creation, P, globalObject, and environment.

        4. - -

      4. Otherwise, queue a violation report for - access to another window, given accessorCOOP's report-only reporting - endpoint,accessorCOOP's report-only value, accessor's - active document's URL, - accessed's active document's URL, accessor's active document's - origin, accessed's active document's origin, - P, globalObject, and environment.

        5. -
      - - -

    14. Let accessedCOOP be accessed's top-level browsing +

    15. Queue violation reports for accesses, given + accessorAccessedRelationship, accessor's top-level browsing context's active document's cross-origin - opener policy.

      16. - -
    16. -

      If accessedCOOP's report-only - reporting endpoint is not null, then:

      + opener policy, accessed's top-level browsing context's active + document's cross-origin opener policy, + accessor's active document's URL, + accessed's active document's URL, + accessor's top-level browsing context's initial URL, accessed's top-level + browsing context's initial URL, + accessor's active document's origin, accessed's + active document's origin, accessor's top-level browsing + context's opener origin at creation, + accessed's top-level browsing context's opener origin at creation, accessor's + top-level browsing context's active document's referrer, accessed's top-level browsing + context's active document's referrer, P, globalObject, and + environment.

      17. -
        -

      1. If accessed's opener browsing context is accessor or - an ancestor of accessor, queue a violation report for access from the - opener, given accessedCOOP's report-only reporting - endpoint,accessedCOOP's report-only value, accessed's - active document's URL, - accessor's active document's URL, accessed's - active document's origin, accessor's active - document's origin, P, and accessed's top-level - browsing context's active document's referrer.

        2. - -

      2. Otherwise, if accessor's opener browsing context is - accessed or an ancestor of - accessed, queue a violation report - for access from an opened window, given accessedCOOP's report-only reporting - endpoint,accessedCOOP's report-only value, accessed's - active document's URL, - accessor's active document's URL, accessor's top-level browsing - context's initial URL, - accessed's active document's origin, accessor's - active document's origin, accessor's top-level - browsing context's opener origin at - creation, and P.

        3. - -

      3. Otherwise, queue a violation report for - access from another window, given accessedCOOP's report-only reporting - endpoint,accessedCOOP's report-only value, accessed's - active document's URL, - accessor's active document's URL, accessed's - active document's origin, accessor's active - document's origin, and P.

        4. -
      -

    To sanitize a URL to send in a report given a @@ -81546,6 +81495,13 @@ interface BarProp {

  • If coop's reporting endpoint is null, return.

    • +

  • Let coopValue be coop's value.

    • + +

  • If disposition is "reporting, then set + coopValue to coop's report-only value.

    • +

  • Let body be a new object containing the following properties:

    @@ -81563,7 +81519,7 @@ interface BarProp { effective-policy - coop's value + coopValue previousResponseUrl @@ -81584,12 +81540,13 @@ interface BarProp {

  • Queue body as "coop" - for endpoint with coopURL.

    • + for coop's reporting endpoint with + coopURL.

    To queue a violation report for browsing context group switch when navigating away from a COOP response given a cross-origin opener policy coopValue, a string disposition, a + policy">cross-origin opener policy coop, a string disposition, a URL coopURL, a URL nextResponseURL, and a boolean isCOOPResponseNavigationSource:

    @@ -81597,6 +81554,13 @@ interface BarProp {

  • If coop's reporting endpoint is null, return.

    • +

  • Let coopValue be coop's value.

    • + +

  • If disposition is "reporting, then set + coopValue to coop's report-only value.

    • +

  • Let body be a new object containing the following properties:

    @@ -81614,7 +81578,7 @@ interface BarProp { effective-policy - coop's value + coopValue nextResponseUrl @@ -81632,13 +81596,90 @@ interface BarProp {

  • Queue body as "coop" - for endpoint with coopURL.

    • + for coop's reporting endpoint with + coopURL.

    + + +

    To queue violation reports for accesses, given an + accessor-accessed relationship accessorAccessedRelationship, two + cross-origin opener policies + accessorCOOP and accessedCOOP, four urls + accessorURL, accessedURL, accessorInitialURL, + accessedInitialURL, four origins + accessorOrigin, accessedOrigin, accessorCreatorOrigin and + accessedCreatorOrigin, two referrers + accessorReferrer and accessedReferrer, a string propertyName, a + global object globalObject, and an environment settings + object environment:

    + +
      +

    1. If coop's reporting endpoint + is null, return.

      2. + +

    2. Let coopValue be coop's value.

      3. + +

    3. If disposition is "reporting, then set + coopValue to coop's report-only value.

      4. + +
    4. +

      If accessorAccessedRelationship is accessor is opener:

      + +
        +

      1. Queue a violation report + for access to an opened window, given accessorCOOP, accessorURL, + accessedURL, accessedInitialURL, accessorOrigin, + accessedOrigin, accessedCreatorOrigin, propertyName, + globalObject, and environment.

        2. + +

      2. Queue a violation report for access + from the opener, given accessedCOOP, accessedURL, + accessorURL, accessedOrigin, accessorOrigin, + propertyName, and accessedReferrer.

        3. +
      +
      5. + +
    5. +

      Otherwise, if accessorAccessedRelationship is accessor is openee:

      + +
        +

      1. Queue a violation report for access to + the opener, given accessorCOOP, accessorURL, + accessedURL, accessorOrigin, accessedOrigin, + propertyName, accessorReferrer, globalObject, and + environment.

        2. + +

      2. Queue a violation report for access + from an opened window, given accessedCOOP, accessedURL, + accessorURL, accessorInitialURL, accessedOrigin, + accessorOrigin, accessorCreatorOrigin, and + propertyName.

        3. +
      +
      6. + +
    6. +

      Otherwise:

      + +
        +

      1. Queue a violation report for + access to another window, given accessorCOOP, accessorURL, + accessedURL, accessorOrigin, accessedOrigin, + propertyName, globalObject, and environment

        2. + +

      2. Queue a violation report for + access from another window, given accessedCOOP, accessedURL, + accessorURL, accessedOrigin, accessorOrigin, and + propertyName.

        3. +
      +

    To queue a violation report for access to the - opener, given a string endpoint, a cross-origin opener policy value - coopValue, two URLs coopURL and + opener, given a cross-origin opener + policy coop, two URLs coopURL and openerURL, two origins coopOrigin and openerOrigin, a string propertyName, a referrer referrer, a global @@ -81646,7 +81687,6 @@ interface BarProp { environment:

      -

    1. Let body be a new object containing the following properties:

      @@ -81664,7 +81704,8 @@ interface BarProp { effectivePolicy - coopValue + coop's report-only + value property @@ -81701,21 +81742,20 @@ interface BarProp {

    2. Queue body as "coop" - for endpoint with coopURL and environment.

      3. + for coop's reporting endpoint with + coopURL and environment.

    To queue a violation report for access to an - opened window, given a string endpoint, a cross-origin opener policy value - coopValue, three URLs coopURL, + opened window, given a cross-origin opener + policy coop, three URLs coopURL, openedWindowURL and initialWindowURL, three origins coopOrigin, openedWindowOrigin, and - openerInitialOrigin,a string propertyName, a global - object globalObject, and an environment settings object + openerInitialOrigin,a string propertyName, a global object + globalObject, and an environment settings object environment:

      -

    1. Let body be a new object containing the following properties:

      @@ -81733,7 +81773,8 @@ interface BarProp { effectivePolicy - coopValue + coop's report-only + value property @@ -81772,21 +81813,20 @@ interface BarProp {

    2. Queue body as "coop" - for endpoint with coopURL and environment.

      3. + for coop's reporting endpoint with + coopURL and environment.

    To queue a violation report for access to another - window, given a string endpoint, a cross-origin opener policy value - coopValue, two URLs coopURL and + window, given a cross-origin opener policy + coop, two URLs coopURL and otherURL, two origins coopOrigin and - otherOrigin, a string propertyName, a global - object globalObject, and an environment settings object + otherOrigin, a string propertyName, a global object + globalObject, and an environment settings object environment:

      -

    1. Let body be a new object containing the following properties:

      @@ -81804,7 +81844,8 @@ interface BarProp { effectivePolicy - coopValue + coop's report-only + value property @@ -81837,18 +81878,20 @@ interface BarProp {

    2. Queue body as "coop" - for endpoint with coopURL and environment.

      3. + for coop's reporting endpoint with + coopURL and environment.

    To queue a violation report for access from the - opener, given a string endpoint, a cross-origin opener policy value - coopValue, two URLs coopURL and + opener, given a cross-origin opener policy + coop, two URLs coopURL and openerURL, two origins coopOrigin and openerOrigin, a string propertyName, and a referrer referrer:

      +

    1. If coop's reporting endpoint + is null, return.

    2. Let body be a new object containing the following properties:

      @@ -81867,7 +81910,8 @@ interface BarProp { effectivePolicy - coopValue + coop's report-only + value property @@ -81892,18 +81936,20 @@ interface BarProp {

    3. Queue body as "coop" - for endpoint with coopURL.

      4. + for coop's reporting endpoint with + coopURL.

    To queue a violation report for access from an - opened window, given a string endpoint, a cross-origin opener policy value - coopValue, three URLs coopURL, + opened window, given a cross-origin opener + policy coop, three URLs coopURL, openedWindowURL and initialWindowURL, three origins coopOrigin, openedWindowOrigin, and openerInitialOrigin, and a string propertyName:

      +

    1. If coop's reporting endpoint + is null, return.

    2. Let body be a new object containing the following properties:

      @@ -81926,7 +81972,8 @@ interface BarProp { property - propertyName + coop's report-only + value openedWindowUrl @@ -81949,18 +81996,20 @@ interface BarProp {

    3. Queue body as "coop" - for endpoint with coopURL.

      4. + for coop's reporting endpoint with + coopURL.

    To queue a violation report for access from another - window, given a string endpoint, a cross-origin opener policy value - coopValue, two URLs coopURL and - otherURL, two origins coopOrigin and - otherOrigin, and a string propertyName:

    + window, given a cross-origin opener policy + coop, two URLs coopURL and otherURL, two + origins coopOrigin and otherOrigin, and a string + propertyName:

      +

    1. If coop's reporting endpoint + is null, return.

    2. Let body be a new object containing the following properties:

      @@ -81979,7 +82028,8 @@ interface BarProp { effectivePolicy - coopValue + coop's report-only + value property @@ -82000,7 +82050,8 @@ interface BarProp {

    3. Queue body as "coop" - for endpoint with coopURL.

      4. + for coop's reporting endpoint with + coopURL.

    From 3b9c0a196f1842d26063dcd80c2174167d4d03bf Mon Sep 17 00:00:00 2001 From: Camille Lamy Date: Thu, 29 Oct 2020 11:31:30 +0100 Subject: [PATCH 10/15] Add origin to navigation reports algorithm --- source | 93 ++++++++++++++++++++++++++++++++-------------------------- 1 file changed, 51 insertions(+), 42 deletions(-) diff --git a/source b/source index 33d5bd68417..1f8ecf1f390 100644 --- a/source +++ b/source @@ -81265,15 +81265,19 @@ interface BarProp {

  • Queue a violation report for browsing context group switch when navigating to a COOP response with responseCOOP, "enforce", responseURL, - currentCOOPEnforcementResult's url, and + currentCOOPEnforcementResult's url, + currentCOOPEnforcementResult's origin, responseOrigin, and referrer.

  • Queue a violation report for browsing context group switch when navigating away from a COOP response with activeDocumentCOOP, "enforce", currentCOOPEnforcementResult's url, - responseURL, and currentCOOPEnforcementResult's current context is navigation source.

    • + responseURL, currentCOOPEnforcementResult's origin, responseOrigin, and + currentCOOPEnforcementResult's current + context is navigation source.

    @@ -81300,15 +81304,18 @@ interface BarProp { data-x="coop-violation-navigation-to">Queue a violation report for browsing context group switch when navigating to a COOP response with responseCOOP, "reporting", responseURL, - currentCOOPEnforcementResult's url, and - referrer.

    + currentCOOPEnforcementResult's url, + currentCOOPEnforcementResult's origin, + responseOrigin,and referrer.

  • Queue a violation report for browsing context group switch when navigating away from a COOP response with activeDocumentCOOP, "reporting", currentCOOPEnforcementResult's url, - responseURL, and currentCOOPEnforcementResult's current context is navigation source.

    • + responseURL, currentCOOPEnforcementResult's origin, responseOrigin, and + currentCOOPEnforcementResult's current + context is navigation source.

    @@ -81488,8 +81495,9 @@ interface BarProp {

    To queue a violation report for browsing context group switch when navigating to a COOP response given a cross-origin opener policy coop, a string disposition, a - URL coopURL, a URL previousResponseURL, and a referrer referrer:

    + URL coopURL, a URL previousResponseURL, two origins coopOrigin and previousResponseOrigin, and a + referrer referrer:

    1. If coop's reporting endpoint @@ -81518,22 +81526,22 @@ interface BarProp { disposition - effective-policy + effectivePolicy coopValue - previousResponseUrl - If coopURL and previousResponseURL are same origin this - is the sanitization of + previousResponseURL + If coopOrigin and previousResponseOrigin are same + origin this is the sanitization of previousResponseURL, null otherwise. referrer - referrer. + referrer - violationType - navigation-to-response + type + navigation-to-response @@ -81547,7 +81555,8 @@ interface BarProp {

      To queue a violation report for browsing context group switch when navigating away from a COOP response given a cross-origin opener policy coop, a string disposition, a - URL coopURL, a URL nextResponseURL, and a boolean + URL coopURL, a URL nextResponseURL, two origins coopOrigin and nextResponseOrigin, and a boolean isCOOPResponseNavigationSource:

        @@ -81581,15 +81590,15 @@ interface BarProp { coopValue - nextResponseUrl - If coopURL and nextResponseURL are same origin or - isCOOPResponseNavigationSource is true, this is the nextResponseURL + If coopOrigin and nextResponseOrigin are same origin + or isCOOPResponseNavigationSource is true, this is the sanitization of previousResponseURL, null otherwise. - violationType - navigation-to-response + type + navigation-to-response @@ -81712,7 +81721,7 @@ interface BarProp { propertyName - openerUrl + openerURL If coopOrigin and openerOrigin are same origin, this is the sanitization of openerURL, null otherwise. @@ -81734,8 +81743,8 @@ interface BarProp { Extract it from globalObject - violationType - access-to-opener + type + access-to-opener @@ -81781,13 +81790,13 @@ interface BarProp { propertyName - openedWindowUrl + openedWindowURL If coopOrigin and openedWindowOrigin are same origin, this is the sanitization of openedWindowURL, null otherwise. - openedWindowInitialUrl + openedWindowInitialURL If coopOrigin and openerInitialOrigin are same origin, this is the sanitization of initialWindowURL, null otherwise. @@ -81805,8 +81814,8 @@ interface BarProp { Extract it from globalObject - violationType - access-to-opener + type + access-to-opener @@ -81852,7 +81861,7 @@ interface BarProp { propertyName - otherUrl + otherURL If coopOrigin and otherOrigin are same origin, this is the sanitization of otherURL, null otherwise. @@ -81870,8 +81879,8 @@ interface BarProp { Extract it from globalObject - violationType - access-to-opener + type + access-to-opener @@ -81918,7 +81927,7 @@ interface BarProp { propertyName - openerUrl + openerURL If coopOrigin and openerOrigin are same origin, this is the sanitization of openerURL, null otherwise. @@ -81928,8 +81937,8 @@ interface BarProp { referrer - violationType - access-to-opener + type + access-to-opener @@ -81976,20 +81985,20 @@ interface BarProp { value - openedWindowUrl + openedWindowURL If coopOrigin and openedWindowOrigin are same origin, this is the sanitization of openedWindowURL, null otherwise. - openedWindowInitialUrl + openedWindowInitialURL If coopOrigin and openerInitialOrigin are same origin, this is the sanitization of initialWindowURL, null otherwise. - violationType - access-to-opener + type + access-to-opener @@ -82036,14 +82045,14 @@ interface BarProp { propertyName - otherUrl + otherURL If coopOrigin and otherOrigin are same origin, this is the sanitization of otherURL, null otherwise. - violationType - access-to-opener + type + access-to-opener From 7c921fc5de1003728be804520a885dc19076cf1b Mon Sep 17 00:00:00 2001 From: Camille Lamy Date: Thu, 29 Oct 2020 11:58:24 +0100 Subject: [PATCH 11/15] Change way we get script, line and column --- source | 63 ++++++++++++++++++++++++++++++---------------------------- 1 file changed, 33 insertions(+), 30 deletions(-) diff --git a/source b/source index 1f8ecf1f390..fcd0d803aef 100644 --- a/source +++ b/source @@ -79925,8 +79925,8 @@ interface BarProp {

      1. Check if an access between two browsing contexts should be reported, given the current global object's browsing context, W's browsing context, P, the current - global object, and the current settings object.

        2. + data-x="window bc">browsing context, P, and the current settings + object.

      2. If ! IsPlatformObjectSameOrigin(W) is true, then return ? OrdinaryGet(this, P, Receiver).

        3. @@ -81414,8 +81414,7 @@ interface BarProp {

        To check if an access between two browsing contexts should be reported, given two browsing contexts accessor and accessed, a JavaScript property name - P, a global object globalObject, and an - environment environement:

        + P, and an environment environement:

        1. If P is not part of CrossOriginProperties, then return.

          2. @@ -81471,7 +81470,7 @@ interface BarProp { top-level browsing context's active document's referrer, accessed's top-level browsing context's active document's referrer, P, globalObject, and + data-x="dom-document-referrer">referrer, P, and environment.

        @@ -81617,9 +81616,8 @@ interface BarProp { accessedInitialURL, four origins accessorOrigin, accessedOrigin, accessorCreatorOrigin and accessedCreatorOrigin, two referrers - accessorReferrer and accessedReferrer, a string propertyName, a - global object globalObject, and an environment settings - object environment:

        + accessorReferrer and accessedReferrer, a string propertyName, and + an environment settings object environment:

        1. If coop's reporting endpoint @@ -81641,7 +81639,7 @@ interface BarProp { for access to an opened window, given accessorCOOP, accessorURL, accessedURL, accessedInitialURL, accessorOrigin, accessedOrigin, accessedCreatorOrigin, propertyName, - globalObject, and environment.

          2. + and environment.

        2. Queue a violation report for access from the opener, given accessedCOOP, accessedURL, @@ -81658,8 +81656,7 @@ interface BarProp {

        3. Queue a violation report for access to the opener, given accessorCOOP, accessorURL, accessedURL, accessorOrigin, accessedOrigin, - propertyName, accessorReferrer, globalObject, and - environment.

          4. + propertyName, accessorReferrer, and environment.

        4. Queue a violation report for access from an opened window, given accessedCOOP, accessedURL, @@ -81676,7 +81673,7 @@ interface BarProp {

        5. Queue a violation report for access to another window, given accessorCOOP, accessorURL, accessedURL, accessorOrigin, accessedOrigin, - propertyName, globalObject, and environment

          6. + propertyName, and environment

        6. Queue a violation report for access from another window, given accessedCOOP, accessedURL, @@ -81691,11 +81688,13 @@ interface BarProp { policy coop, two URLs coopURL and openerURL, two origins coopOrigin and openerOrigin, a string propertyName, a referrer referrer, a global - object globalObject, and an environment settings object - environment:

          + data-x="concept-request-referrer">referrer referrer, and an environment + settings object environment:

            +

          1. Let sourceFile, lineNumber and columnNumber be the + relevant script URL and problematic position which triggered this report.

            2. +

          2. Let body be a new object containing the following properties:

            @@ -81732,15 +81731,15 @@ interface BarProp { sourceFile - Extract it from globalObject + sourceFile lineNumber - Extract it from globalObject + lineNumber columnNumber - Extract it from globalObject + columnNumber type @@ -81760,11 +81759,13 @@ interface BarProp { policy coop, three URLs coopURL, openedWindowURL and initialWindowURL, three origins coopOrigin, openedWindowOrigin, and - openerInitialOrigin,a string propertyName, a global object - globalObject, and an environment settings object - environment:

            + openerInitialOrigin,a string propertyName, and an environment settings + object environment:

              +

            1. Let sourceFile, lineNumber and columnNumber be the + relevant script URL and problematic position which triggered this report.

              2. +

            2. Let body be a new object containing the following properties:

              @@ -81803,15 +81804,15 @@ interface BarProp { sourceFile - Extract it from globalObject + sourceFile lineNumber - Extract it from globalObject + lineNumber columnNumber - Extract it from globalObject + columnNumber type @@ -81831,11 +81832,13 @@ interface BarProp { window, given a cross-origin opener policy coop, two URLs coopURL and otherURL, two origins coopOrigin and - otherOrigin, a string propertyName, a global object - globalObject, and an environment settings object - environment:

              + otherOrigin, a string propertyName, and an environment settings + object environment:

                +

              1. Let sourceFile, lineNumber and columnNumber be the + relevant script URL and problematic position which triggered this report.

                2. +

              2. Let body be a new object containing the following properties:

                @@ -81868,15 +81871,15 @@ interface BarProp { sourceFile - Extract it from globalObject + sourceFile lineNumber - Extract it from globalObject + lineNumber columnNumber - Extract it from globalObject + columnNumber type From dd47f00553ce3c0c78d12d4794da054f0673fbff Mon Sep 17 00:00:00 2001 From: Domenic Denicola Date: Fri, 30 Oct 2020 15:54:41 -0400 Subject: [PATCH 12/15] Typo and nit fixes --- source | 47 ++++++++++++++++++++++++----------------------- 1 file changed, 24 insertions(+), 23 deletions(-) diff --git a/source b/source index fcd0d803aef..a9af0161736 100644 --- a/source +++ b/source @@ -81153,7 +81153,7 @@ interface BarProp { would require a browsing context group switch, given a boolean isInitialAboutBlank, two origins responseOrigin, activeDocumentNavigationOrigin, and two cross-origin opener policies responseCOOP, + data-x="cross-origin opener policy">cross-origin opener policies responseCOOP and activeDocumentCOOP:

                  @@ -81213,7 +81213,7 @@ interface BarProp { browsing context browsingContext, a URL responseURL, an origin responseOrigin, a cross-origin opener policy responseCOOP, a cross-origin - opener policy enforcement result currentCOOPEnforcementResult and a currentCOOPEnforcementResult, and a referrer referrer:

                    @@ -81327,7 +81327,7 @@ interface BarProp {

                    To obtain a browsing context to use for a navigation response, given a browsing contexts browsingContext, a sandboxing flag set sandboxFlags, a - cross-origin opener policy navigationCOOP and a cross-origin opener policy navigationCOOP, and a cross-origin opener policy enforcement result coopEnforcementResult:

                    @@ -81391,8 +81391,8 @@ interface BarProp {

                    Reporting

                    An accessor-accessed relationship is an enum that describes the relationship between - two browsing contexts between which an access hapenned. It - can take the following values:

                    + two browsing contexts between which an access happened. It + can take the following values:

                    accessor is opener
                    @@ -81414,20 +81414,21 @@ interface BarProp {

                    To check if an access between two browsing contexts should be reported, given two browsing contexts accessor and accessed, a JavaScript property name - P, and an environment environement:

                    + P, and an environment environment:

                    1. If P is not part of CrossOriginProperties, then return.

                    2. If accessor's active document's origin or any of its - ancestors's active document's - origin are not same origin with its top-level browsing - context's active document's origin, or if accessed's - active document's origin or any of its ancestors's active document's origin are not same - origin with its top-level browsing context's active document's - origin, then return.

                      + ancestors' active document's origins are not same origin with ancestor's + top-level browsing context's active document's origin, or + if accessed's active document's origin or any of its ancestors' active document's origins are not same origin with accessed's + top-level browsing context's active document's origin, + then return.

                      This avoids leaking information about cross-origin iframes to a top level frame with cross-origin opener policy reporting

                      @@ -81505,7 +81506,7 @@ interface BarProp {

                    3. Let coopValue be coop's value.

                      4. -

                    4. If disposition is "reporting, then set +

                    5. If disposition is "reporting", then set coopValue to coop's report-only value.

                      6. @@ -81565,7 +81566,7 @@ interface BarProp {

                    6. Let coopValue be coop's value.

                      7. -

                    7. If disposition is "reporting, then set +

                    8. If disposition is "reporting", then set coopValue to coop's report-only value.

                      9. @@ -81585,7 +81586,7 @@ interface BarProp { disposition - effective-policy + effectivePolicy coopValue @@ -81611,7 +81612,7 @@ interface BarProp {

                      To queue violation reports for accesses, given an accessor-accessed relationship accessorAccessedRelationship, two cross-origin opener policies - accessorCOOP and accessedCOOP, four urls + accessorCOOP and accessedCOOP, four URLs accessorURL, accessedURL, accessorInitialURL, accessedInitialURL, four origins accessorOrigin, accessedOrigin, accessorCreatorOrigin and @@ -81626,7 +81627,7 @@ interface BarProp {

                    9. Let coopValue be coop's value.

                      10. -

                    10. If disposition is "reporting, then set +

                    11. If disposition is "reporting", then set coopValue to coop's report-only value.

                      12. @@ -120206,14 +120207,15 @@ interface External {
                    -

                    `Origin-Isolation`

                    +

                    `Cross-Origin-Opener-Policy-Report-Only`

                    This section describes a header for registration in the Permanent Message Header Field Registry.

                    Header field name:
                    -
                    Origin-Isolation
                    +
                    Cross-Origin-Opener-Policy-Report-Only
                    Applicable protocol:
                    http
                    Status:
                    @@ -120229,15 +120231,14 @@ interface External {
                    -

                    `Cross-Origin-Opener-Policy-Report-Only`

                    +

                    `Origin-Isolation`

                    This section describes a header for registration in the Permanent Message Header Field Registry.

                    Header field name:
                    -
                    Cross-Origin-Opener-Policy-Report-Only
                    +
                    Origin-Isolation
                    Applicable protocol:
                    http
                    Status:
                    From 23cac25a085649c09afc12a199b5b21e15ba3a1f Mon Sep 17 00:00:00 2001 From: Camille Lamy Date: Wed, 4 Nov 2020 18:07:19 +0100 Subject: [PATCH 13/15] Address Domenic's comments --- source | 73 ++++++++++++++++++++++++++++++++++++++++------------------ 1 file changed, 51 insertions(+), 22 deletions(-) diff --git a/source b/source index a9af0161736..44d2903b407 100644 --- a/source +++ b/source @@ -79948,8 +79948,8 @@ interface BarProp {

                  1. Check if an access between two browsing contexts should be reported, given the current global object's browsing - context, W's browsing context, P, the current - global object and the current settings object.

                    2. + context, W's browsing context, P, + and the current settings object.

                  2. If ! IsPlatformObjectSameOrigin(W) is true, then return ? OrdinarySet(this, P, V, Receiver).

                    3. @@ -81414,7 +81414,7 @@ interface BarProp {

                    To check if an access between two browsing contexts should be reported, given two browsing contexts accessor and accessed, a JavaScript property name - P, and an environment environment:

                    + P, and an environment settings object environment:

                    1. If P is not part of CrossOriginProperties, then return.

                      2. @@ -81510,6 +81510,11 @@ interface BarProp { coopValue to coop's report-only value.

                      +

                    2. Let serializedReferrer be an empty string

                      3. + +

                    3. If referrer is a URL, set serializedReferrer to the + serialization of referrer. +

                    4. Let body be a new object containing the following properties:

                      @@ -81537,11 +81542,11 @@ interface BarProp { referrer - referrer + serializedReferrer type - navigation-to-response + "navigation-to-response" @@ -81598,7 +81603,7 @@ interface BarProp { type - navigation-to-response + "navigation-to-response" @@ -81696,6 +81701,11 @@ interface BarProp {

                    5. Let sourceFile, lineNumber and columnNumber be the relevant script URL and problematic position which triggered this report.

                      6. +

                    6. Let serializedReferrer be an empty string

                      7. + +

                    7. If referrer is a URL, set serializedReferrer to the + serialization of referrer. +

                    8. Let body be a new object containing the following properties:

                      @@ -81728,7 +81738,7 @@ interface BarProp { referrer - referrer + serializedReferrer sourceFile @@ -81744,7 +81754,7 @@ interface BarProp { type - access-to-opener + "access-to-opener" @@ -81817,7 +81827,7 @@ interface BarProp { type - access-to-opener + "access-to-opener" @@ -81884,7 +81894,7 @@ interface BarProp { type - access-to-opener + "access-to-opener" @@ -81906,6 +81916,11 @@ interface BarProp {

                    9. If coop's reporting endpoint is null, return.

                      10. +

                    10. Let serializedReferrer be an empty string

                      11. + +

                    11. If referrer is a URL, set serializedReferrer to the + serialization of referrer. +

                    12. Let body be a new object containing the following properties:

                      @@ -81938,11 +81953,11 @@ interface BarProp { referrer - referrer + serializedReferrer type - access-to-opener + "access-to-opener" @@ -82002,7 +82017,7 @@ interface BarProp { type - access-to-opener + "access-to-opener" @@ -84312,10 +84327,17 @@ interface Location { // but see also cross-origin opener policy enforcement result given - false, false, resource's url, - responseOrigin, coop and false.

                      13. +

                    13. Let coopEnforcementResult be a new cross-origin opener policy enforcement result whose + needs a browsing context group switch is + false, would need a browsing context + group switch due to report-only is false,url is resource's url, origin + is responseOrigin, cross-origin opener policy is coop, and + current context is navigation source is + false.

                    14. Let navigationParams be a new navigation params whose request is null, Location { // but see also sandboxing flags and response's forced sandboxing flag set.

                      15. -

                    15. Let coopEnforcementResult be a new is a new cross-origin opener policy enforcement result given - false, false, resource's url, - activeDocumentNavigationOrigin, browsingContext's active - document's cross-origin opener policy and +

                    16. Let coopEnforcementResult be a new cross-origin opener policy enforcement result whose + needs a browsing context group switch is + false, would need a browsing context + group switch due to report-only is false,url is resource's url, origin + is activeDocumentNavigationOrigin, cross-origin opener policy is + browsingContext's active document's cross-origin opener policy, and current context is navigation source is false.

                    17. Let navigationParams be a new navigation params whose Date: Thu, 19 Nov 2020 14:34:40 +0100 Subject: [PATCH 14/15] Address Domenic's comments --- source | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/source b/source index 44d2903b407..161e045a9ed 100644 --- a/source +++ b/source @@ -78511,6 +78511,14 @@ console.assert(iframeWindow.frameElement === null); { [[Property]]: "postMessage" } ».

                    +

                    A JavaScript property name P is a cross-origin accessible window property + name if it is "window", "self", "location", "close", "closed", + "focus", "blur", "frames", + "length", "top", "opener", + "parent", "postMessage", or an array indexed + property name.

                    +

                    Indexed properties do not need to be safelisted as they are handled directly by the WindowProxy object.

                    @@ -81258,7 +81266,7 @@ interface BarProp { true.

                  3. -

                    If browsingContext's browsing context group's browsing +

                    If browsingContext's group's browsing context set's size is greater than 1, then:

                      @@ -81296,7 +81304,7 @@ interface BarProp { need a browsing context group switch due to report-only to true.

                    1. -

                      If browsingContext's browsing context group's browsing +

                      If browsingContext's group's browsing context set's size is greater than 1, then:

                        @@ -81417,7 +81425,8 @@ interface BarProp { P, and an environment settings object environment:

                          -

                        1. If P is not part of CrossOriginProperties, then return.

                          2. +

                        2. If P is not a cross-origin accessible window property name, then + return.

                        3. If accessor's active document's origin or any of its @@ -84331,7 +84340,7 @@ interface Location { // but see also cross-origin opener policy enforcement result whose needs a browsing context group switch is false, would need a browsing context - group switch due to report-only is false, is false, url is resource's url, origin is responseOrigin, Location { // but see also cross-origin opener policy enforcement result whose needs a browsing context group switch is false, would need a browsing context - group switch due to report-only is false, is false, url is resource's url, origin is activeDocumentNavigationOrigin, Date: Thu, 19 Nov 2020 16:28:46 -0500 Subject: [PATCH 15/15] Tweak to COA window property definition --- source | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/source b/source index 161e045a9ed..62a4771dff2 100644 --- a/source +++ b/source @@ -78511,16 +78511,16 @@ console.assert(iframeWindow.frameElement === null); { [[Property]]: "postMessage" } ».

                        +

                        Indexed properties do not need to be safelisted in this algorithm, as they are + handled directly by the WindowProxy object.

                        +

                        A JavaScript property name P is a cross-origin accessible window property name if it is "window", "self", "location", "close", "closed", "focus", "blur", "frames", "length", "top", "opener", - "parent", "postMessage", or an array indexed - property name.

                        - -

                        Indexed properties do not need to be safelisted as they are handled directly by - the WindowProxy object.

                        + "parent", "postMessage", or an array index + property name.

                        CrossOriginPropertyFallback ( P )