From 810bb7ea80f7bf8eb5fe4fea3520191c880d26e9 Mon Sep 17 00:00:00 2001 From: Yutaka Hirano Date: Thu, 28 Jan 2021 13:18:35 +0900 Subject: [PATCH] Ignore COEP on non-secure contexts Fixes #6328 --- source | 36 +++++++++++++++++++++++++----------- 1 file changed, 25 insertions(+), 11 deletions(-) diff --git a/source b/source index 8e2b247e496..39d50ef70d9 100644 --- a/source +++ b/source @@ -81047,7 +81047,8 @@ interface BarProp {

  1. Let coep be the result of obtaining a cross-origin embedder policy from response.

    2. + policy">obtaining a cross-origin embedder policy from response and + reservedEnvironment.

  2. If coep's value is "require-corp", then set policy's BarProp {

    1. Let coep be the result of obtaining a cross-origin embedder policy from response.

      2. + policy">obtaining a cross-origin embedder policy from response and + reservedEnvironment.

    2. If coep's value is "BarProp {

      To obtain an embedder policy from a response response:

      + data-x="concept-response">response response and an environment + environment:

      1. Let policy be a new embedder policy.

        2. +

      2. If environment is a non-secure context, then return + policy.

        3. +

      3. Let parsedItem be the result of getting a structured field value with `Cross-Origin-Embedder-Policy` and "item" from response's header list.

        4. @@ -82264,15 +82270,16 @@ interface BarProp {

        Embedder policy checks

        To check a navigation response's adherence to its embedder policy given a response response and a browsing context - target:

        + data-x="concept-response">response response, a browsing context + target, and an environment environment:

        1. If target is not a child browsing context, then return true.

        2. Let responsePolicy be the result of obtaining an embedder policy from response.

          3. + policy">obtaining an embedder policy from response and + environment.

        3. Let parentPolicy be target's container document's Location { // but see also Blocked", then set failure to true.

          -

          Otherwise, if the result of reserved environment is non-null and + the result of checking a navigation response's adherence to its embedder policy given - response and browsingContext is false, then set failure to - true.

          + response, browsingContext and navigationParams's reserved environment is false, then set + failure to true.

          Otherwise, if the result of checking a navigation response's adherence to @@ -85152,7 +85162,11 @@ interface Location { // but see also embedder policy to the result of obtaining an embedder policy from navigationParams's response.

          4. + data-x="navigation-params-response">response and navigationParam's + reserved + environment is non-null, and "unsafe-none" + otherwise.

        4. Initialize a Document's CSP list given document, navigationParams's SharedWorkerGlobalScope : WorkerGlobalScope {

        5. Otherwise, set worker global scope's embedder policy to the result of obtaining an embedder policy from - response.

          6. + response and inside settings.

        6. If worker global scope's