From a08939f010aaae1c73e6ea1c116e2160c75e290e Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Thu, 30 Mar 2017 06:58:18 +0200 Subject: [PATCH] Redact ancestorOrigins using document's referrer Also rewrite the algorithm to avoid loops and use variables correctly. Tests: https://github.com/w3c/web-platform-tests/pull/5402. Fixes #1918. --- source | 82 +++++++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 67 insertions(+), 15 deletions(-) diff --git a/source b/source index 5832f71b7e5..2cb10c3e623 100644 --- a/source +++ b/source @@ -2521,6 +2521,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute append
  • The struct specification type and the associated definition for item
    • +
  • The tuple data structure
  • The forgiving-base64 encode and forgiving-base64 decode algorithms
  • HTML namespace
    • @@ -80996,26 +80997,82 @@ interface Location { // but see also tuples consisting of parent's + origin and referrer.

  • Let current be the browsing context of the Document with which this Location object is associated.

    • + -

  • Loop: If current has no parent browsing context, jump to - the step labeled end.

    • +
  • +

    While current has a parent browsing context:

    -

  • Let current be current's parent browsing - context.

    • +
      +

    1. Append (current's parent browsing + context's active document's origin, current's + active document's referrer) to + parentOrigins.

      2. -

    2. Append the serialization of current's active document's - origin to output.

      3. +

    3. Set current to current's parent browsing + context.

      4. +
    + -

  • Return to the step labeled loop.

    • +

  • Let output be a new list of strings.

    • + +

  • Let lastRedactedOrigin be null.

    • + +
  • +

    For each tuple in parentOrigins:

    + +
      +

    1. If lastRedactedOrigin is not null and tuple's parent's origin is same origin with + lastRedactedOrigin, then append + "null" to output and continue.

      2. + +

    2. Set lastRedactedOrigin to null.

      3. + +

    3. Let origin be null.

      4. -

    4. End: Return output.

      5. +
    5. +

      If tuple's referrer is not the empty + string, then:

      + +
        +

      1. Let referrerURL be the result of parsing + tuple's referrer.

        2. + +

      2. Assert: referrerURL is not failure.

        3. + +

      3. Set origin to referrerURL's origin.

        4. +
      +
      6. + +

    6. If origin is null or tuple's parent's origin is not same origin with origin, then set + lastRedactedOrigin to tuple's parent's origin and append "null" to output.

      7. + +

    7. Otherwise, append the serialization of tuple's parent's origin to output.

      8. +
    +
    • + +

  • Return output.

    • +

    The reliance on browsing contexts and their + active document in this algorithm is safe as the active document is the + Document object that the browsing contexts are + nested through, and both are available when + a Location object is created at which point this algorithm is run.

    +

    A Location object has an associated Location-object-setter navigate algorithm, which given a url, runs these steps:

    @@ -81538,11 +81595,6 @@ interface Location { // but see also     ancestor origins list.

    -

    The details of how the ancestorOrigins attribute works are still - controversial and might change. See issue - #1918 for more information.

    -

    As explained earlier, the Location exotic object