add none as an allowed default - #515
Conversation
This is described in w3c/webappsec-permissions-policy#515 . It is not added as an available default in the json config as we don't want anyone using it yet. Bug: 1432116 Change-Id: I41f33eb1b4fa212a0420d41e6b950a5a4fe6ade5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4565116 Reviewed-by: Ian Clelland <iclelland@chromium.org> Commit-Queue: Fergal Daly <fergal@chromium.org> Cr-Commit-Position: refs/heads/main@{#1168046}
| [=navigable/active document|document=].</dd> | ||
| <dt><dfn for="default allowlist" export><code>none</code></dfn></dt> | ||
| <dd>The feature is not allowed in {{Document}}s in [=/top-level | ||
| traversables=] by default, as well as those in all [=child |
There was a problem hiding this comment.
The "as well as" here feels like it should refer to a previous positive statement -- maybe this sentence should be
By default, the feature is not allowed in Documents in top-level traversables, nor is it allowed in child navigables.
| 1. If |feature|'s <a>default allowlist</a> is <code>'self'</code>, and | ||
| |origin| is [=same origin=] with |document origin|, return | ||
| "<code>Enabled</code>". | ||
| 1. If |document| is a headerless document, return "<code>Enabled</code>". |
There was a problem hiding this comment.
What about defining (somewhere else in the doc):
A document is a <dfn>headerless document<dfn> if any of the following conditions are true:
* Its [=Document/URL=] [=matches about:blank=]
* Its [=Document/URL=] [=matches about:srcdoc=]
* Its [=Document/URL=]'s [=scheme=] is 'data'
And we can add additional cases as we find them. This might also be a good candidate for export to HTML if it turns out to be generally useful.
|
@fergald Due to w3c/webauthn#2430 I'd like to see this move forward so it can be implemented fully in Chromium, and would greatly appreciate if you can help move this along? And if you need anything from me to help move it along, I would gladly step in to get it going. |
Add
noneas a new possible default allowlist.Surprisingly, I don't think this requires any updates to the algorithms as the updates would be to "Define an inherited policy for feature in container at origin" and "Is feature enabled in document for origin?" would both just be adding "If feature’s default allowlist is None, return "Disabled"." where we are going to return "Disabled" anyway.
Maybe we should add these conditions anyway, to make it explicit. Up to you.
Fixes #513
@clelland
Preview | Diff