Skip to content

Commit 48d6105

Browse files
yutakahiranoyutakahirano
committed
fix
1 parent 158c73d commit 48d6105

File tree

1 file changed

+127
-2
lines changed

1 file changed

+127
-2
lines changed

‎source

+127-2
Original file line numberDiff line numberDiff line change
@@ -81836,6 +81836,34 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
8183681836
</ol>
8183781837
</li>
8183881838

81839+
<li>
81840+
<p>If <var>browsingContext</var> is a <span>child browsing context</span>:</p>
81841+
81842+
<ol>
81843+
<li><p>Let <var>request for CORP check</var> be a copy of <var>request</var>.</p></li>
81844+
81845+
<li><p>Set <var>request for CORP check</var>'s
81846+
<span data-x="concept-request-origin">origin</span> to <var>browsingContext</var>'s
81847+
<span data-x="bc-container-document">container document</span>'s <span>origin</span>.</p></li>
81848+
81849+
<li><p>Set <var>request for CORP check</var>'s
81850+
<span data-x="concept-request-client">client</span> to
81851+
<var>browsingContext</var>'s <span data-x="bc-container-document">container document</span>'s
81852+
<span>relevant settings object</span>.</p></li>
81853+
81854+
<li>
81855+
<p>If the result of <span>cross-origin resource policy check</span> with <var>request for CORP
81856+
check</var> and <var>response</var> is <code data-x="">blocked</code>, then set
81857+
<var>response</var> to a <span>network error</span>.</p>
81858+
81859+
<p class="note">Here we're running the <span>cross-origin resource policy check</span> against
81860+
the <span>parent browsing context</span> rather than <var>sourceBrowsingContext</var>. This is
81861+
because we do care about the same-originness of the embedded content against the parent
81862+
context, not the navigation source.</p>
81863+
</li>
81864+
</ol>
81865+
</li>
81866+
8183981867
<li><p>If <var>response</var> has a <span data-x="concept-response-location-url">location
8184081868
URL</span> that is failure, then set <var>response</var> to a <span>network
8184181869
error</span>.</p></li>
@@ -81923,6 +81951,97 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
8192381951
<var>activeDocumentNavigationOrigin</var>, and <var>reservedEnvironment</var>.</p></li>
8192481952
</ol>
8192581953

81954+
<p>To <dfn>queue a Cross-Origin Embedder Policy violation on navigation</dfn> given a
81955+
<span data-x="concept-request">request</span>(<var>request</var>), a string(<var>endpoint</var>)
81956+
and an <span>environment settings object</span>(<var>settings</var>), run the following
81957+
steps:</p>
81958+
81959+
<ol>
81960+
<li>
81961+
<p>Let <var>blocked url</var> be <var>request</var>'s
81962+
<span data-x="concept-request-url">URL</span>.</p>
81963+
81964+
<p class="note">This is not <var>request</var>'s
81965+
<span data-x="concept-request-current-url">current URL</span> in order to avoid leaking
81966+
information about redirect targets (see
81967+
<a href="https://w3c.github.io/webappsec-csp/#security-violation-reports">here</a> too).</p>
81968+
</li>
81969+
81970+
<li><p>Set <var>blocked url</var>'s <span data-x="concept-url-username">username</span>
81971+
to the empty string, and its <span data-x="concept-url-password">password</span> to
81972+
<code data-x="">null</code>.</p></li>
81973+
81974+
<li><p>Let <var>serialized blocked url</var> be <var>blocked url</var>
81975+
<span data-x="concept-url-serializer">serialized</span> with the <code data-x="">exclude fragment
81976+
flag</code> set.</p></li>
81977+
81978+
<li>
81979+
<p>Let <var>body</var> be a new object containing the following properties with keys:</p>
81980+
81981+
<table class="data">
81982+
<thead>
81983+
<tr>
81984+
<th>key</th>
81985+
<th>value</th>
81986+
</tr>
81987+
</thead>
81988+
<tbody>
81989+
<tr>
81990+
<td>type</td>
81991+
<td>"<code data-x="">navigation</code>"</td>
81992+
</tr>
81993+
<tr>
81994+
<td>blocked-url</td>
81995+
<td><var>serialized blocked url</var></td>
81996+
</tr>
81997+
</tbody>
81998+
</table>
81999+
</li>
82000+
82001+
<li><p><span data-x="queue a report">Queue</span> <var>body</var> as
82002+
"<code data-x="">coep</code>" for <var>endpoint</var> on <var>settings</var>.
82003+
</ol>
82004+
82005+
<p>To <dfn>check a navigation response's adherence to its embedder policy</dfn> given a
82006+
<span data-x="concept-request">request</span>(<var>request</var>), a
82007+
<span data-x="concept-response">response</span>(<var>response</var>), and a
82008+
<span>browsing context</span>(<var>target</var>), run the following steps:</p>
82009+
82010+
<ol>
82011+
<li><p>Return <code data-x="">allowed</code> if <var>target</var> is not a <span>child browsing
82012+
context</span>.</p></li>
82013+
82014+
<li><p>Let <var>response policy</var> be the result of
82015+
<span data-x="obtain an embedder policy">obtaining an embedder policy</span> from
82016+
<var>response</var>.</p></li>
82017+
82018+
<li><p>Let <var>parent policy</var> be <var>target</var>'s
82019+
<span data-x="bc-container-document">container document</span>'s
82020+
<span data-x="concept-document-embedder-policy">embedder policy</span>.</p></li>
82021+
82022+
<li><p>If <var>parent policy</var>'s <span data-x="embedder-policy-report-only-value">report
82023+
only value</span> is "<code data-x="">require-corp</code>" and <var>response policy</var>'s
82024+
<span data-x="embedder-policy-value">value</span> is "<code data-x="">unsafe-none</code>",
82025+
then <span>queue a Cross-Origin Embedder Policy violation on navigation</span>
82026+
with <var>request</var>, <var>parent policy</var>'s <span
82027+
data-x="embedder-policy-report-only-reporting-endpoint">report only reporting endpoint</span>
82028+
and <var>target</var>'s <span data-x="bc-container-document">container document</span>'s
82029+
<span>relevant settings object</span>.</p></li>
82030+
82031+
<li><p>If <var>parent policy</var>'s <span data-x="embedder-policy-value">value</span> is
82032+
"<code data-x="">unsafe-none</code>" or <var>policy</var>'s
82033+
<span data-x="embedder-policy-value">value</span> is "<code data-x="">require-corp</code>",
82034+
then return <code data-x="">allowed</code>.</p></li>
82035+
82036+
<li><p><span>Queue a Cross-Origin Embedder Policy violation on navigation</span>
82037+
with <var>request</var>, <var>parent policy</var>'s
82038+
<span data-x="embedder-policy-reporting-endpoint">reporting endpoint</span> and
82039+
<var>target</var>'s <span data-x="bc-container-document">container document</span>'s
82040+
<span>relevant settings object</span>.</p></li>
82041+
82042+
<li><p>Return <code data-x="">blocked</code>.</p></li>
82043+
</ol>
82044+
8192682045
<p>To <dfn data-export="">process a navigate response</dfn>, given null or a <span
8192782046
data-x="concept-request">request</span> <var>request</var>, a <span
8192882047
data-x="concept-response">response</span> <var>response</var>, a string <var>navigationType</var>,
@@ -81952,6 +82071,11 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
8195282071
data-x="">Blocked</code>" when executed upon <var>request</var>, <var>response</var>,
8195382072
<var>navigationType</var>, <var>source</var>, and <var>browsingContext</var>. <ref
8195482073
spec="CSP"></p></li>
82074+
82075+
<li><p>The result of <span
82076+
data-x="check a navigation response's adherence to its embedder policy">checking a
82077+
navigation response's adherence to its embedder policy</span> with <var>request</var>,
82078+
<var>response</var> and <var>browsingContext</var> is <code data-x="">blocked</code>.
8195582079
</ul>
8195682080

8195782081
<p class="note">This is where the network errors defined and propagated by <cite>Fetch</cite>,
@@ -97978,7 +98102,8 @@ interface <dfn>SharedWorkerGlobalScope</dfn> : <span>WorkerGlobalScope</span> {
9797898102

9797998103
<p>To <dfn>queue a Cross-Origin Embedder Policy violation on worker initialization</dfn> given a
9798098104
<span data-x="concept-request">request</span>(<var>request</var>), a string(<var>endpoint</var>)
97981-
and an <span>environment settings object</span>(settings), run the following steps.</p>
98105+
and an <span>environment settings object</span>(<var>settings</var>), run the following
98106+
steps.</p>
9798298107

9798398108
<ol>
9798498109
<li>
@@ -97996,7 +98121,7 @@ interface <dfn>SharedWorkerGlobalScope</dfn> : <span>WorkerGlobalScope</span> {
9799698121
<code data-x="">null</code>.</p></li>
9799798122

9799898123
<li><p>Let <var>serialized blocked url</var> be <var>blocked url</var>
97999-
<span data-x="concept-url-serializer">serialized</span>with the <code data-x="">exclude fragment
98124+
<span data-x="concept-url-serializer">serialized</span> with the <code data-x="">exclude fragment
9800098125
flag</code> set.</p></li>
9800198126

9800298127
<li>

0 commit comments

Comments
 (0)