From a61e36d7d769e60bdd1d1da7eb9762432d05760c Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Wed, 14 Sep 2016 16:11:01 +0200 Subject: [PATCH 1/2] Remove Fetch's same-origin data URL flag The change to Fetch discussed in https://github.com/whatwg/fetch/issues/381 made it obsolete. Closes #1778, and closes #1779 as these are all treated as same-origin now per the change to Fetch. --- source | 5 ----- 1 file changed, 5 deletions(-) diff --git a/source b/source index d7ca5b74789..5b35bcf2421 100644 --- a/source +++ b/source @@ -2840,7 +2840,6 @@ a.setAttribute('href', 'http://example.com/'); // change the content attribute d
  • priority
  • origin
  • omit-Origin-header flag
    • -
  • same-origin data-URL flag
  • referrer
  • synchronous flag
  • mode
    • @@ -26172,8 +26171,6 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ... picture, set request's initiator to "imageset".

    -

    ⌛ Set request's same-origin data-URL flag.

    -

    ⌛ Set request's referrer policy to the current state of the element's referrerpolicy attribute.

    @@ -27037,8 +27034,6 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ... data-x="">imageset", and set request's synchronous flag.

    -

  • Set request's same-origin data-URL flag.

    • -

  • Set request's referrer policy to the current state of the element's referrerpolicy attribute.

    • From d1088a26e4b5302ad514847b06325955bab1fc21 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Thu, 15 Sep 2016 12:34:58 +0200 Subject: [PATCH 2/2] Define how data URLs affect workers Fixes #1243. Basically, data URLs create (shared) workers that have a unique opaque origin. --- source | 56 ++++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 40 insertions(+), 16 deletions(-) diff --git a/source b/source index 5b35bcf2421..538ac58744f 100644 --- a/source +++ b/source @@ -96549,7 +96549,9 @@ interface SharedWorkerGlobalScope : WorkerGlobalScope {

    A SharedWorkerGlobalScope object has an associated constructor url and constructor origin, constructor url, and name. They are initialized when the SharedWorkerGlobalScope object is created, in the run a worker @@ -96762,6 +96764,11 @@ interface SharedWorkerGlobalScope : WorkerGlobalScope {

    If is shared is true, then:

      +

    1. Set worker global scope's constructor origin to + outside settings's origin.

      2. +

    2. Set worker global scope's constructor url to url.

      3. @@ -97142,7 +97149,7 @@ interface AbstractWorker {
      The API URL character encoding
      -

      Return UTF-8.

      +

      Return UTF-8.

      @@ -97157,7 +97164,10 @@ interface AbstractWorker {
      The origin
      -

      Return inherited origin.

      +

      Return a unique opaque origin if worker + global scope's url's scheme is "data", and inherited + origin otherwise.

      @@ -97298,8 +97308,10 @@ enum WorkerType { "classic", "module" };

    3. Let worker URL be the resulting URL record.

      -

      Any same-origin URL will do, including blob: URLs.

      +

      Any same-origin URL (including blob: URLs) can be used. data: + URLs can also be used, but they create a worker with an opaque origin.

    4. Let worker be a new Worker object.

      5. @@ -97373,8 +97385,10 @@ interface SharedWorker : EventTarget {

    5. Otherwise, let urlRecord be the resulting URL record.

      -

      Any same-origin URL will do, including blob: URLs.

      +

      Any same-origin URL (including blob: URLs) can be used. data: + URLs can also be used, but they create a worker with an opaque origin.

    6. Let worker be a new SharedWorker object.

      7. @@ -97395,15 +97409,25 @@ interface SharedWorker : EventTarget {

      1. Let worker global scope be null.

        2. -

      2. If there exists a SharedWorkerGlobalScope object whose closing flag is false, whose name is exactly equal to name, - whose constructor url - equals urlRecord, and whose relevant - settings object's origin is - same origin with outside settings's origin, then set worker global scope - to that SharedWorkerGlobalScope object.

        3. +
      3. +

        If there exists a SharedWorkerGlobalScope object whose closing flag is false, constructor origin is + same origin with outside settings's origin, constructor url equals urlRecord, and name is name, then set + worker global scope to that SharedWorkerGlobalScope object.

        + +

        data: URLs create a worker with an opaque origin. Both the constructor origin and + constructor url are + compared so the same data: URL can be used within an + origin to get to the same SharedWorkerGlobalScope object, but cannot + be used to bypass the same origin restriction.

        +

      4. If worker global scope is not null, but the user agent has been