Skip to content

Commit 98f2c26

Browse files
mikewestmikewest
committed
Remove the 'opener' restriction.
I screwed up Chrome's implementation, which lead to folks depending on the behavior, which made it more or less impossible for other vendors to do the right thing. Sorry, Internet. I let you down. :( Closes #42.
1 parent 2cc0b2f commit 98f2c26

File tree

2 files changed

+21
-127
lines changed

2 files changed

+21
-127
lines changed

‎index.html

+14-66
Original file line numberDiff line numberDiff line change
@@ -1178,7 +1178,7 @@
11781178
</style>
11791179
<meta content="Bikeshed version 3ee78e75729309d4dfc4793df74c38e4ae785832" name="generator">
11801180
<link href="https://www.w3.org/TR/secure-contexts/" rel="canonical">
1181-
<meta content="7557d7964a90dba24ede0445c6085f3f3cdd9afc" name="document-revision">
1181+
<meta content="2cc0b2f634b5062f82d540349233d30cab84e0c3" name="document-revision">
11821182
<style>
11831183
.secure {
11841184
fill: #8F8;
@@ -1511,7 +1511,6 @@ <h2 class="no-num no-toc no-ref heading settled" id="status"><span class="conten
15111511
<p>The following features are at-risk, and may be dropped during the CR period: </p>
15121512
<ul>
15131513
<li>The <a data-link-type="dfn" href="#sandboxed-secure-browsing-context-flag" id="ref-for-sandboxed-secure-browsing-context-flag">sandboxed secure browsing context flag</a> defined in <a href="#monkey-patching-sandbox-flags">§2.2.1 Sandboxing</a>, as well as its usage in <a href="#is-settings-object-contextually-secure">§3.1 Is an environment settings object contextually secure?</a>. [<a href="#issue-255ee4a4">Issue 2</a>]
1514-
<li>The <code>opener</code> restriction on popups. [<a href="#issue-8ea95bab">Issue 5</a>]
15151514
</ul>
15161515
<p>“At-risk” is a W3C Process term-of-art, and does not necessarily imply that the feature is in danger of being dropped or delayed. It means that the WG believes the feature may have difficulty being interoperably implemented in a timely manner, and marking it as such allows the WG to drop the feature if necessary when transitioning to the Proposed Rec stage, without having to publish a new Candidate Rec without the feature first.</p>
15171516
</div>
@@ -1622,8 +1621,6 @@ <h2 class="heading settled" data-level="1" id="intro"><span class="secno">1. </s
16221621
defined below ensure that these bypasses are difficult and user-visible.</p>
16231622
<p>The following examples summarize the normative text which follows:</p>
16241623
<h3 class="heading settled" data-level="1.1" id="examples-top-level"><span class="secno">1.1. </span><span class="content">Top-level Documents</span><a class="self-link" href="#examples-top-level"></a></h3>
1625-
<p>Top-level documents are secure as long as they don’t have a non-secure <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#opener-browsing-context" id="ref-for-opener-browsing-context">opener browsing context</a>. This is a bit convoluted, so let’s go straight
1626-
to the examples:</p>
16271624
<div class="example" id="example-c3b67557">
16281625
<a class="self-link" href="#example-c3b67557"></a>
16291626
<p><code>http://example.com/</code> opened in a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#top-level-browsing-context" id="ref-for-top-level-browsing-context">top-level browsing
@@ -1648,61 +1645,29 @@ <h3 class="heading settled" data-level="1.1" id="examples-top-level"><span class
16481645
</g>
16491646
</svg>
16501647
</div>
1651-
<div class="example" id="example-601f9a50">
1652-
<a class="self-link" href="#example-601f9a50"></a>
1653-
<p>
1654-
If a secure context opens <code>https://example.com/</code> in a new
1655-
window, that new window will be a secure context, as it is both secure on
1656-
its own merits, and was opened from a secure context:
1657-
<svg height="400" width="400">
1658-
<g transform="translate(10,10)">
1659-
<rect class="secure" height="175" width="297" x="0" y="0"></rect>
1660-
<text transform="translate(10, 20)">https://secure.example.com/</text>
1661-
</g>
1662-
<g transform="translate(10,210)">
1663-
<rect class="secure" height="175" width="297" x="0" y="0"></rect>
1664-
<text transform="translate(10, 20)">https://another.example.com/</text>
1665-
</g>
1666-
<g>
1667-
<path d="M150, 87 C 200 75, 350 75, 150 287"></path>
1668-
</g>
1669-
</svg>
1670-
</p>
1671-
</div>
1672-
<div class="example" id="example-cd14fb7f">
1673-
<a class="self-link" href="#example-cd14fb7f"></a>
1674-
<p>If a non-secure context opens <code>https://example.com/</code> in a new
1675-
window, then things are more complicated. The new window’s status depends on
1676-
how it was opened. If the non-secure context can obtain a reference to the
1677-
secure context, or vice-versa, then the new window is not a secure context. </p>
1678-
<p>This means that the following will both produce non-secure contexts:</p>
1679-
<pre>&lt;a href="https://example.com/" target="_blank">Link!&lt;/a>
1680-
1681-
&lt;script>
1682-
var w = window.open("https://example.com/");
1683-
&lt;/script>
1684-
</pre>
1648+
<div class="example" id="example-7f28e529">
1649+
<a class="self-link" href="#example-7f28e529"></a>
1650+
<p>If a secure context opens <code>https://example.com/</code> in a new
1651+
window, that new window will be a secure context, as it is secure on
1652+
its own merits:</p>
16851653
<svg height="400" width="400">
16861654
<g transform="translate(10,10)">
1687-
<rect class="non-secure" height="175" width="297" x="0" y="0"></rect>
1688-
<text transform="translate(10, 20)">http://non-secure.example.com/</text>
1655+
<rect class="secure" height="175" width="297" x="0" y="0"></rect>
1656+
<text transform="translate(10, 20)">https://secure.example.com/</text>
16891657
</g>
16901658
<g transform="translate(10,210)">
1691-
<rect class="non-secure" height="175" width="297" x="0" y="0"></rect>
1659+
<rect class="secure" height="175" width="297" x="0" y="0"></rect>
16921660
<text transform="translate(10, 20)">https://another.example.com/</text>
16931661
</g>
16941662
<g>
16951663
<path d="M150, 87 C 200 75, 350 75, 150 287"></path>
16961664
</g>
16971665
</svg>
1698-
<p>The link can be broken via the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/links.html#link-type-noopener" id="ref-for-link-type-noopener">link type "<code>noopener</code>"</a>, meaning
1699-
that the following will both produce secure contexts:</p>
1700-
<pre>&lt;a href="https://example.com/" rel="<a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/links.html#link-type-noopener" id="ref-for-link-type-noopener①">noopener</a>" target="_blank">Link!&lt;/a>
1701-
1702-
&lt;script>
1703-
var w = window.open("https://example.com/", "", "<a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/links.html#link-type-noopener" id="ref-for-link-type-noopener②">noopener</a>");
1704-
&lt;/script>
1705-
</pre>
1666+
</div>
1667+
<div class="example" id="example-4cfa3d2b">
1668+
<a class="self-link" href="#example-4cfa3d2b"></a>
1669+
<p>Likewise, if a non-secure context opens <code>https://example.com/</code> in a new window,
1670+
that new window will be a secure context, even through its opener was non-secure:</p>
17061671
<svg height="400" width="400">
17071672
<g transform="translate(10,10)">
17081673
<rect class="non-secure" height="175" width="297" x="0" y="0"></rect>
@@ -2056,15 +2021,6 @@ <h3 class="heading settled" data-level="3.1" id="is-settings-object-contextually
20562021
<li data-md="">
20572022
<p><var>document</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#active-sandboxing-flag-set" id="ref-for-active-sandboxing-flag-set">active sandboxing flag set</a> contains the <a data-link-type="dfn" href="#sandboxed-secure-browsing-context-flag" id="ref-for-sandboxed-secure-browsing-context-flag②">sandboxed secure browsing context flag</a>.</p>
20582023
<p class="note" role="note"><span>Note:</span> This check is "at risk". See <a href="#monkey-patching-sandbox-flags">§2.2.1 Sandboxing</a> for details.</p>
2059-
<li data-md="">
2060-
<p><var>document</var> has an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#creator-browsing-context" id="ref-for-creator-browsing-context">creator browsing context</a> (<var>context</var>), and <var>context</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#creator-context-security" id="ref-for-creator-context-security">creator context security</a> is "<code>Not Secure</code>".</p>
2061-
<p class="note" role="note"><span>Note:</span> Since we take account of <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#creator-browsing-context" id="ref-for-creator-browsing-context①">creator browsing contexts</a>'
2062-
status, a popups' status depends on how it is opened, as discussed
2063-
in <a href="#examples-top-level">§1.1 Top-level Documents</a>.</p>
2064-
<p class="issue" id="issue-8ea95bab"><a class="self-link" href="#issue-8ea95bab"></a> This exclusion is "at risk",
2065-
as implementation is lagging, and there’s some discussion as to
2066-
whether or not it can be softened while maintaining the mitigations
2067-
against direct communication channels. <a href="https://github.com/w3c/webappsec-secure-contexts/issues/42">&lt;https://github.com/w3c/webappsec-secure-contexts/issues/42></a></p>
20682024
<li data-md="">
20692025
<p><var>settings</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#https-state" id="ref-for-https-state②">HTTPS state</a> is "<code>deprecated</code>".</p>
20702026
<li data-md="">
@@ -2444,8 +2400,6 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
24442400
<li><a href="https://html.spec.whatwg.org/multipage/origin.html#active-sandboxing-flag-set">active sandboxing flag set</a>
24452401
<li><a href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context">browsing context</a>
24462402
<li><a href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-creation-url">creation url</a>
2447-
<li><a href="https://html.spec.whatwg.org/multipage/browsers.html#creator-browsing-context">creator browsing context</a>
2448-
<li><a href="https://html.spec.whatwg.org/multipage/browsers.html#creator-context-security">creator context security</a>
24492403
<li><a href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object">current settings object</a>
24502404
<li><a href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-domain">domain</a>
24512405
<li><a href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object">environment settings object</a>
@@ -2454,9 +2408,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
24542408
<li><a href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-host">host</a>
24552409
<li><a href="https://html.spec.whatwg.org/multipage/webappapis.html#https-state">https state</a>
24562410
<li><a href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element">iframe</a>
2457-
<li><a href="https://html.spec.whatwg.org/multipage/links.html#link-type-noopener">link type "noopener"</a>
24582411
<li><a href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque">opaque origin</a>
2459-
<li><a href="https://html.spec.whatwg.org/multipage/browsers.html#opener-browsing-context">opener browsing context</a>
24602412
<li><a href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin">origin</a>
24612413
<li><a href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin">origin <small>(for environment settings object)</small></a>
24622414
<li><a href="https://html.spec.whatwg.org/multipage/workers.html#concept-WorkerGlobalScope-owner-set">owner set</a>
@@ -2569,10 +2521,6 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
25692521
<div class="issue"> This is currently defined in Step 11.4.2 of the WHATWG’s HTML (landed in <a href="https://github.com/whatwg/html/pull/1560">whatwg/html#1560</a>. It has not yet been
25702522
picked up by the W3C’s version of that algorithm. <a href="https://github.com/w3c/workers/issues/6">&lt;https://github.com/w3c/workers/issues/6></a><a href="#issue-39cab00b"> ↵ </a></div>
25712523
<div class="issue"> Upstream this to HTML.<a href="#issue-10e3374e"> ↵ </a></div>
2572-
<div class="issue"> This exclusion is "at risk",
2573-
as implementation is lagging, and there’s some discussion as to
2574-
whether or not it can be softened while maintaining the mitigations
2575-
against direct communication channels. <a href="https://github.com/w3c/webappsec-secure-contexts/issues/42">&lt;https://github.com/w3c/webappsec-secure-contexts/issues/42></a><a href="#issue-8ea95bab"> ↵ </a></div>
25762524
</div>
25772525
<aside class="dfn-panel" data-for="secure-contexts">
25782526
<b><a href="#secure-contexts">#secure-contexts</a></b><b>Referenced in:</b>

‎index.src.html

+7-61
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ <h1>Secure Contexts</h1>
1919
Markup Shorthands: markdown on
2020
Boilerplate: omit conformance, omit feedback-header
2121
At Risk: The <a>sandboxed secure browsing context flag</a> defined in [[#monkey-patching-sandbox-flags]], as well as its usage in [[#is-settings-object-contextually-secure]]. [<a href="#issue-255ee4a4">Issue 2</a>]
22-
At Risk: The `opener` restriction on popups. [<a href="#issue-8ea95bab">Issue 5</a>]
2322
</pre>
2423
<pre class="link-defaults">
2524
spec:url; type:interface; text:URL
@@ -138,10 +137,6 @@ <h2 id="intro">Introduction</h2>
138137

139138
<h3 id="examples-top-level">Top-level Documents</h3>
140139

141-
Top-level documents are secure as long as they don't have a non-secure
142-
<a>opener browsing context</a>. This is a bit convoluted, so let's go straight
143-
to the examples:
144-
145140
<div class="example">
146141
<p><code>http://example.com/</code> opened in a <a>top-level browsing
147142
context</a> is not a <a>secure context</a>, as it was not delivered over
@@ -170,8 +165,8 @@ <h3 id="examples-top-level">Top-level Documents</h3>
170165

171166
<div class="example">
172167
<p>If a secure context opens <code>https://example.com/</code> in a new
173-
window, that new window will be a secure context, as it is both secure on
174-
its own merits, and was opened from a secure context:
168+
window, that new window will be a secure context, as it is secure on
169+
its own merits:</p>
175170

176171
<svg width="400" height="400">
177172
<g transform="translate(10,10)">
@@ -189,45 +184,8 @@ <h3 id="examples-top-level">Top-level Documents</h3>
189184
</div>
190185

191186
<div class="example">
192-
<p>If a non-secure context opens <code>https://example.com/</code> in a new
193-
window, then things are more complicated. The new window's status depends on
194-
how it was opened. If the non-secure context can obtain a reference to the
195-
secure context, or vice-versa, then the new window is not a secure context.
196-
197-
This means that the following will both produce non-secure contexts:
198-
199-
<pre>
200-
&lt;a href="https://example.com/" target="_blank">Link!&lt;/a>
201-
202-
&lt;script>
203-
var w = window.open("https://example.com/");
204-
&lt;/script>
205-
</pre>
206-
207-
<svg width="400" height="400">
208-
<g transform="translate(10,10)">
209-
<rect height="175" width="297" y="0" x="0" class="non-secure" />
210-
<text transform="translate(10, 20)">http://non-secure.example.com/</text>
211-
</g>
212-
<g transform="translate(10,210)">
213-
<rect height="175" width="297" y="0" x="0" class="non-secure" />
214-
<text transform="translate(10, 20)">https://another.example.com/</text>
215-
</g>
216-
<g>
217-
<path d="M150, 87 C 200 75, 350 75, 150 287"></path>
218-
</g>
219-
</svg>
220-
221-
The link can be broken via the <a>link type "`noopener`"</a>, meaning
222-
that the following will both produce secure contexts:
223-
224-
<pre>
225-
&lt;a href="https://example.com/" rel="<a lt='link type "noopener"'>noopener</a>" target="_blank">Link!&lt;/a>
226-
227-
&lt;script>
228-
var w = window.open("https://example.com/", "", "<a lt='link type "noopener"'>noopener</a>");
229-
&lt;/script>
230-
</pre>
187+
<p>Likewise, if a non-secure context opens <code>https://example.com/</code> in a new window,
188+
that new window will be a secure context, even through its opener was non-secure:</p>
231189

232190
<svg width="400" height="400">
233191
<g transform="translate(10,10)">
@@ -657,21 +615,9 @@ <h3 id="is-settings-object-contextually-secure">
657615
Note: This check is "at risk". See [[#monkey-patching-sandbox-flags]]
658616
for details.
659617

660-
2. |document| has an <a>creator browsing context</a> (|context|), and
661-
|context|'s <a>creator context security</a> is "`Not Secure`".
662-
663-
Note: Since we take account of <a>creator browsing contexts</a>'
664-
status, a popups' status depends on how it is opened, as discussed
665-
in [[#examples-top-level]].
666-
667-
ISSUE(w3c/webappsec-secure-contexts#42): This exclusion is "at risk",
668-
as implementation is lagging, and there's some discussion as to
669-
whether or not it can be softened while maintaining the mitigations
670-
against direct communication channels.
671-
672-
3. |settings|'s <a for="environment settings object">HTTPS state</a> is "`deprecated`".
618+
2. |settings|'s <a for="environment settings object">HTTPS state</a> is "`deprecated`".
673619

674-
4. |document|'s <a>active sandboxing flag set</a> includes the
620+
3. |document|'s <a>active sandboxing flag set</a> includes the
675621
<a>sandboxed origin browsing context flag</a>, and
676622
[[#is-url-trustworthy]] returns "`Not Trustworthy`" when executed upon
677623
|settings|'s <a>creation URL</a>.
@@ -685,7 +631,7 @@ <h3 id="is-settings-object-contextually-secure">
685631
look at the origin of its URL to determine whether we would have
686632
considered it trustworthy had it not been sandboxed.
687633

688-
5. |document|'s <a>active sandboxing flag set</a> does not include the
634+
4. |document|'s <a>active sandboxing flag set</a> does not include the
689635
<a>sandboxed origin browsing context flag</a>, and
690636
[[#is-origin-trustworthy]] returns "`Not Trustworthy`" when executed
691637
upon |settings|'s <a for="environment settings object">origin</a>.

0 commit comments

Comments
 (0)