Skip to content

Commit 158c73d

Browse files
yutakahiranoyutakahirano
committed
fix
1 parent a485387 commit 158c73d

File tree

1 file changed

+110
-4
lines changed

1 file changed

+110
-4
lines changed

‎source

+110-4
Original file line numberDiff line numberDiff line change
@@ -3151,6 +3151,18 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
31513151
</dd>
31523152

31533153

3154+
<dt>Reporting</dt>
3155+
3156+
<dd>
3157+
<p>The following terms are defined in <cite>Reporting</cite>: <ref
3158+
spec=REPORTING></p>
3159+
3160+
<ul class="brief">
3161+
<li><dfn data-x-href="https://w3c.github.io/reporting/#queue-report">Queue a report</dfn></li>
3162+
</ul>
3163+
</dd>
3164+
3165+
31543166
<dt>XMLHttpRequest</dt>
31553167

31563168
<dd>
@@ -6516,15 +6528,15 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
65166528
values: "<code data-x="">unsafe-none</code>", "<code data-x="">require-corp</code>",
65176529
initially "<code data-x="">unsafe-none</code>".</p></li>
65186530

6519-
<li><p>A string or null(<dfn data-x="embedder-policy-reporting-endpoint">reporting
6520-
endpoint</dfn>), initially null.</p></li>
6531+
<li><p>A string(<dfn data-x="embedder-policy-reporting-endpoint">reporting
6532+
endpoint</dfn>), initially the empty string.</p></li>
65216533

65226534
<li><p>A string(<dfn data-x="embedder-policy-report-only-value">report only value</dfn>) with one
65236535
of the following values: "<code data-x="">unsafe-none</code>",
65246536
"<code data-x="">require-corp</code>", initially "<code data-x="">unsafe-none</code>".</p></li>
65256537

6526-
<li><p>A string or null(<dfn data-x="embedder-policy-report-only-reporting-endpoint">report only
6527-
reporting endpoint</dfn>), initially null.</p></li>
6538+
<li><p>A string(<dfn data-x="embedder-policy-report-only-reporting-endpoint">report only
6539+
reporting endpoint</dfn>), initially the empty string.</p></li>
65286540
</ul>
65296541

65306542
<p>To <dfn>obtain an embedder policy</dfn> from a
@@ -97964,6 +97976,92 @@ interface <dfn>SharedWorkerGlobalScope</dfn> : <span>WorkerGlobalScope</span> {
9796497976

9796597977
<h4 id="worker-processing-model"><span id="processing-model-10"></span>Processing model</h4>
9796697978

97979+
<p>To <dfn>queue a Cross-Origin Embedder Policy violation on worker initialization</dfn> given a
97980+
<span data-x="concept-request">request</span>(<var>request</var>), a string(<var>endpoint</var>)
97981+
and an <span>environment settings object</span>(settings), run the following steps.</p>
97982+
97983+
<ol>
97984+
<li>
97985+
<p>Let <var>blocked url</var> be <var>request</var>'s
97986+
<span data-x="concept-request-url">URL</span>.</p>
97987+
97988+
<p class="note">This is not <var>request</var>'s
97989+
<span data-x="concept-request-current-url">current URL</span> in order to avoid leaking
97990+
information about redirect targets (see
97991+
<a href="https://w3c.github.io/webappsec-csp/#security-violation-reports">here</a> too).</p>
97992+
</li>
97993+
97994+
<li><p>Set <var>blocked url</var>'s <span data-x="concept-url-username">username</span>
97995+
to the empty string, and its <span data-x="concept-url-password">password</span> to
97996+
<code data-x="">null</code>.</p></li>
97997+
97998+
<li><p>Let <var>serialized blocked url</var> be <var>blocked url</var>
97999+
<span data-x="concept-url-serializer">serialized</span>with the <code data-x="">exclude fragment
98000+
flag</code> set.</p></li>
98001+
98002+
<li>
98003+
<p>Let <var>body</var> be a new object containing the following properties with keys:</p>
98004+
98005+
<table class="data">
98006+
<thead>
98007+
<tr>
98008+
<th>key</th>
98009+
<th>value</th>
98010+
</tr>
98011+
</thead>
98012+
<tbody>
98013+
<tr>
98014+
<td>type</td>
98015+
<td>"<code data-x="">worker initialization</code>"</td>
98016+
</tr>
98017+
<tr>
98018+
<td>blocked-url</td>
98019+
<td><var>serialized blocked url</var></td>
98020+
</tr>
98021+
</tbody>
98022+
</table>
98023+
</li>
98024+
98025+
<li><p><span data-x="queue a report">Queue</span> <var>body</var> as
98026+
"<code data-x="">coep</code>" for <var>endpoint</var> on <var>settings</var>.
98027+
</ol>
98028+
98029+
<p>To <dfn>check a global object's embedder policy</dfn> given a
98030+
<code>WorkerGlobalScope</code>(<var>worker global scope</var>), an <span>environment settings
98031+
object</span>(owner) and a <span data-x="concept-request">request</span>, run the following
98032+
steps.</p>
98033+
98034+
<ol>
98035+
<li><p>If <var>worker global scope</var> is not a <code>DedicatedWorkerGlobalScope</code> object,
98036+
then return "<code data-x="">allowed</code>".</p></li>
98037+
98038+
<li><p>Let <var>policy</var> be <var>worker global scope</var>'s
98039+
<span data-x="concept-WorkerGlobalScope-embedder-policy">embedder policy</span>.
98040+
98041+
<li><p>Let <var>owner policy</var> be <var>owner</var>'s
98042+
<span data-x="concept-settings-object-embedder-policy">embedder policy</span>.
98043+
98044+
<li><p>If <var>owner policy</var>'s <span data-x="embedder-policy-report-only-value">report
98045+
only value</span> is "<code data-x="">require-corp</code>" and <var>policy</var>'s
98046+
<span data-x="embedder-policy-value">value</span> is "<code data-x="">unsafe-none</code>",
98047+
then <span>queue a Cross-Origin Embedder Policy violation on worker initialization</span>
98048+
with <var>request</var>, <var>owner's policy</var>'s <span
98049+
data-x="embedder-policy-report-only-reporting-endpoint">report only reporting endpoint</span>
98050+
and <var>owner</var>.</p></li>
98051+
98052+
<li><p>If <var>owner policy</var>'s <span data-x="embedder-policy-value">value</span> is
98053+
"<code data-x="">unsafe-none</code>" or <var>policy</var>'s
98054+
<span data-x="embedder-policy-value">value</span> is "<code data-x="">require-corp</code>",
98055+
then return "<code data-x="">allowed</code>".</p></li>
98056+
98057+
<li><p><span>Queue a Cross-Origin Embedder Policy violation on worker initialization</span>
98058+
with <var>request</var>, <var>owner's policy</var>'s
98059+
<span data-x="embedder-policy-reporting-endpoint">reporting endpoint</span> and
98060+
<var>owner</var>.</p></li>
98061+
98062+
<li><p>Return "<code data-x="">blocked</code>".</p></li>
98063+
</ol>
98064+
9796798065
<p>When a user agent is to <dfn data-export="">run a worker</dfn> for a script with
9796898066
<code>Worker</code> or <code>SharedWorker</code> object <var>worker</var>, <span>URL</span>
9796998067
<var>url</var>, <span>environment settings object</span> <var>outside settings</var>,
@@ -98103,6 +98201,11 @@ interface <dfn>SharedWorkerGlobalScope</dfn> : <span>WorkerGlobalScope</span> {
9810398201
<span data-x="obtain an embedder policy">obtaining an embedder policy</span> from
9810498202
<var>response</var>.</p></li>
9810598203

98204+
<li><p>If the result of <span data-x="check a global object's embedder policy">Checking a
98205+
global object's embedder policy</span> with <var>worker global scope</var>, <var>owner</var>
98206+
and <var>request</var> is "<code data-x="">blocked</code>", then set <var>response</var>
98207+
to a <span>network error</span>.
98208+
9810698209
<li><p>Execute the <span>Initialize a <code data-x="">global object</code>'s CSP list</span>
9810798210
algorithm on <var>worker global scope</var> and <var>response</var>. <ref spec="CSP"></p></li>
9810898211

@@ -120604,6 +120707,9 @@ INSERT INTERFACES HERE
120604120707
<dt id="refsMEDIASTREAM">[MEDIASTREAM]</dt>
120605120708
<dd><cite><a href="https://w3c.github.io/mediacapture-main/getusermedia.html">Media Capture and Streams</a></cite>, D. Burnett, A. Bergkvist, C. Jennings, A. Narayanan. W3C.</dd>
120606120709

120710+
<dt id="refsREPORTING">[REPORTING]</dt>
120711+
<dd><cite><a href="https://w3c.github.io/reporting/">Reporting</a></cite>, D. Creager, I. Clelland, M. West. W3C.</dd>
120712+
120607120713
<dt id="refsMFREL">[MFREL]</dt>
120608120714
<dd><cite><a href="http://microformats.org/wiki/existing-rel-values#HTML5_link_type_extensions">Microformats Wiki: existing rel values</a></cite>. Microformats.</dd>
120609120715

0 commit comments

Comments
 (0)