Skip to content

Commit 2a397f6

Browse files
dtapuskadomenic
dtapuska
authored and
domenic
committed
Editorial: initialize feature policy before document creation
Instead of delegating to the feature policy spec to initialize feature policy after the document is created, initialize feature policy first and pass it in while constructing the document. This uses w3c/webappsec-permissions-policy#324.
1 parent 7fdd68a commit 2a397f6

1 file changed

Lines changed: 27 additions & 25 deletions

File tree

‎source‎

Lines changed: 27 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -4100,8 +4100,8 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
41004100
<li><dfn data-x="concept-container-policy" data-x-href="https://wicg.github.io/feature-policy/#container-policy">container policy</dfn></li>
41014101
<li><dfn data-x="concept-serialized-feature-policy" data-x-href="https://wicg.github.io/feature-policy/#serialized-feature-policy">serialized feature policy</dfn></li>
41024102
<li><dfn data-x="concept-default-allowlist" data-x-href="https://wicg.github.io/feature-policy/#default-allowlist">default allowlist</dfn></li>
4103-
<li>The <dfn data-x-href="https://wicg.github.io/feature-policy/#initialize-for-document">Initialize a document's feature policy</dfn> algorithm</li>
4104-
<li>The <dfn data-x-href="https://wicg.github.io/feature-policy/#initialize-from-response">Initialize a document's feature policy from a response</dfn> algorithm</li>
4103+
<li>The <dfn data-x-href="https://wicg.github.io/feature-policy/#create-for-browsingcontext">creating a feature policy</dfn> algorithm</li>
4104+
<li>The <dfn data-x-href="https://wicg.github.io/feature-policy/#create-from-response">creating a feature policy from a response</dfn> algorithm</li>
41054105
<li>The <dfn data-x="is-feature-enabled" data-x-href="https://wicg.github.io/feature-policy/#is-feature-enabled">Is feature enabled by policy for origin</dfn> algorithm</li>
41064106
<li>The <dfn data-x="process-feature-policy-attributes" data-x-href="https://wicg.github.io/feature-policy/#process-feature-policy-attributes">Process feature policy attributes</dfn> algorithm</li>
41074107
</ul>
@@ -78048,6 +78048,9 @@ dictionary <dfn>DragEventInit</dfn> : <span>MouseEventInit</span> {
7804878048
origin</span> given <var>browsingContext</var>, <code>about:blank</code>,
7804978049
<var>sandboxFlags</var>, <var>browsingContext</var>'s <span>creator origin</span>, and null.
7805078050

78051+
<li><p>Let <var>featurePolicy</var> be the result of <span>creating a feature policy</span>
78052+
given <var>browsingContext</var> and <var>origin</var>. <ref spec="FEATUREPOLICY"></p></li>
78053+
7805178054
<li>
7805278055
<p>Let <var>realm execution context</var> be the result of <span>creating a new JavaScript
7805378056
realm</span> with the following customizations:</p>
@@ -78067,7 +78070,8 @@ dictionary <dfn>DragEventInit</dfn> : <span>MouseEventInit</span> {
7806778070
documents">HTML document</span> in <span>quirks mode</span>, whose <span
7806878071
data-x="concept-document-content-type">content type</span> is "<code data-x="">text/html</code>",
7806978072
<span>origin</span> is <var>origin</var>, <span>active sandboxing flag set</span> is
78070-
<var>sandboxFlags</var>, and which is both <span>ready for post-load tasks</span> and
78073+
<var>sandboxFlags</var>, <span data-x="concept-document-feature-policy">feature policy</span> is
78074+
<var>feature policy</var>, and which is both <span>ready for post-load tasks</span> and
7807178075
<span>completely loaded</span> immediately.</p></li>
7807278076

7807378077
<li><p>Ensure that <var>document</var> has a single child <code>html</code> node, which itself
@@ -78084,9 +78088,6 @@ dictionary <dfn>DragEventInit</dfn> : <span>MouseEventInit</span> {
7808478088
<span data-x="concept-document-referrer-policy">referrer policy</span> to <var>creator</var>'s
7808578089
<span data-x="concept-document-referrer-policy">referrer policy</span>.</p></li>
7808678090

78087-
<li><p><span>Initialize a document's feature policy</span> given <var>document</var>. <ref
78088-
spec="FEATUREPOLICY"></p></li>
78089-
7809078091
<li><p>Add <var>document</var> to <var>browsingContext</var>'s <span>session
7809178092
history</span>.</p></li>
7809278093

@@ -83669,6 +83670,24 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
8366983670
<var>sandboxFlags</var>, <var>incumbentNavigationOrigin</var>, and
8367083671
<var>activeDocumentNavigationOrigin</var>.
8367183672

83673+
<li>
83674+
<p>Let <var>featurePolicy</var> be the result of <span>creating a feature policy from a response</span>
83675+
given <var>browsingContext</var>, <var>origin</var>, and <var>response</var>. <ref
83676+
spec="FEATUREPOLICY"></p>
83677+
83678+
<div class="note">
83679+
<p>The <span>creating a feature policy from a response</span> algorithm makes use of
83680+
<var>origin</var>. If <code data-x="dom-document-domain">document.domain</code> has been used
83681+
for the <span>browsing context container</span>'s <span>node document</span>, then its
83682+
<span>origin</span> cannot be <span>same origin-domain</span> with <var>>origin</var>, because
83683+
these steps run before the <var>document</var> is created, so it cannot itself yet have used
83684+
<code data-x="dom-document-domain">document.domain</code>. Note that this means that Feature
83685+
Policy checks are less permissive compared to doing a <span>same origin</span> check instead.</p>
83686+
83687+
<p>See below for some examples of this in action.</p>
83688+
</div>
83689+
</li>
83690+
8367283691
<li><p>If <var>browsingContext</var>'s only entry in its <span>session history</span> is the
8367383692
<code>about:blank</code> <code>Document</code> that was added when <var>browsingContext</var> was
8367483693
<span data-x="creating a new browsing context">created</span>, and navigation is occurring with
@@ -83699,7 +83718,8 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
8369983718
<li><p>Let <var>document</var> be a new <code>Document</code>, whose <span
8370083719
data-x="concept-document-type">type</span> is <var>type</var>, <span
8370183720
data-x="concept-document-content-type">content type</span> is <var>contentType</var>,
83702-
<span>origin</span> is <var>origin</var>, and <span>active sandboxing flag set</span> is
83721+
<span>origin</span> is <var>origin</var>, <span data-x="concept-document-feature-policy">feature
83722+
policy</span> is <var>featurePolicy</var>, and <span>active sandboxing flag set</span> is
8370383723
<var>sandboxFlags</var>.</p></li>
8370483724

8370583725
<li id="set-the-document's-address"><p>If <var>request</var> is non-null, then set
@@ -83734,24 +83754,6 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
8373483754
"<code data-x="">no-referrer</code>" at this point.</p>
8373583755
</li>
8373683756

83737-
<li>
83738-
<p><span>Initialize a document's feature policy from a response</span> given
83739-
<var>document</var> and <var>response</var>. <ref spec="FEATUREPOLICY"></p>
83740-
83741-
<div class="note">
83742-
<p>The <span>initialize a document's feature policy from a response</span> algorithm makes use
83743-
of <var>document</var>'s <span>origin</span>. If <code
83744-
data-x="dom-document-domain">document.domain</code> has been used for the <span>browsing
83745-
context container</span>'s <span>node document</span>, then its <span>origin</span> cannot be
83746-
<span>same origin-domain</span> with <var>document</var>'s <span>origin</span>, because these
83747-
steps run when <var>document</var> is initialized, so it cannot itself yet have used <code
83748-
data-x="dom-document-domain">document.domain</code>. Note that this means that Feature Policy
83749-
checks are less permissive compared to doing a <span>same origin</span> check instead.</p>
83750-
83751-
<p>See below for some examples of this in action.</p>
83752-
</div>
83753-
</li>
83754-
8375583757
<li>
8375683758
<p>If <var>response</var> has a `<code data-x="http-refresh">Refresh</code>` header, then:</p>
8375783759

0 commit comments

Comments
 (0)