From c0fbcc264fdf8e0624bae306c68015e04be38eb6 Mon Sep 17 00:00:00 2001 From: Andrew Williams Date: Sun, 17 Nov 2024 23:10:39 -0500 Subject: [PATCH] Enforce noopener on cross-top-level-site blob URLs Cause noopener to be set for window.open(), clicks on / elements, and form submissions where the corresponding blob URL is cross-site to the top-level site of the context performing the action. This corresponds to the discussion in https://github.com/w3c/FileAPI/issues/153. --- source | 113 ++++++++++++++++++++++++++++++++++++++------------------- 1 file changed, 76 insertions(+), 37 deletions(-) diff --git a/source b/source index 667b17a3a94..0d819eccb96 100644 --- a/source +++ b/source @@ -25553,7 +25553,8 @@ document.body.appendChild(wbr); web content.

To get an element's noopener, given an a, area, or - form element element and a string target:

+ form element element, a URL record url, and a + string target, perform the following steps. They return a boolean.

  1. If element's link types include the ASCII case-insensitive match for "_blank", then return true.

    2. +
  2. +

    If url's scheme is "blob":

    + +
      +

    1. Let blobOrigin be url's blob URL entry's environment's origin.

      2. + +

    2. Let topLevelOrigin be element's relevant settings + object's top-level origin.

      3. + +

    3. If blobOrigin is not same site with topLevelOrigin, + then return true.

      4. +
    +
    3. +

  3. Return false.

@@ -25585,8 +25604,14 @@ document.body.appendChild(wbr); targetAttributeValue to the result of getting an element's target given subject.

+

  • Let urlRecord be the result of encoding-parsing a URL given + subject's href attribute value, relative to + subject's node document.

    • + +

  • If urlRecord is failure, then return.

    • +

  • Let noopener be the result of getting - an element's noopener with subject and + an element's noopener with subject, urlRecord, and targetAttributeValue.

  • Let targetNavigable be the first return value of applying the rules for @@ -25595,11 +25620,8 @@ document.body.appendChild(wbr);

  • If targetNavigable is null, then return.

    • -

  • Let urlString be the result of encoding-parsing-and-serializing a - URL given subject's href attribute - value, relative to subject's node document.

    • - -

  • If urlString is failure, then return.

    • +

  • Let urlString be the result of applying the URL serializer to urlRecord.

  • If hyperlinkSuffix is non-null, then append it to urlString.

    • @@ -60016,7 +60038,8 @@ fur formTarget.

  • Let noopener be the result of getting - an element's noopener with form and target.

    • + an element's noopener with form, parsed action, and + target.

  • Let targetNavigable be the first return value of applying the rules for choosing a navigable given target, form's node @@ -89830,12 +89853,45 @@ dictionary WindowPostMessageOptions : StructuredSeri

    +

    To get noopener for window open, given a Document + sourceDocument, an ordered map tokenizedFeatures, and a + URL record url, perform the following steps. They return a boolean.

    + +
      +
    1. +

      If url's scheme is "blob":

      + +
        +

      1. Let blobOrigin be url's blob URL entry's environment's origin.

        2. + +

      2. Let topLevelOrigin be sourceDocument's relevant settings + object's top-level origin.

        3. + +

      3. If blobOriginis not same site with topLevelOrigin, + then return true.

        4. +
      +
      2. + +

    2. Let noopener be false.

      3. + +

    3. If tokenizedFeatures["noopener"] exists, then set noopener to the result of parsing tokenizedFeatures["noopener"] as a boolean feature.

      4. + +

    4. Return noopener.

      5. +
    +

    The window open steps, given a string url, a string target, and a string features, are as follows:

    1. If the event loop's termination nesting level is nonzero, - return null.

      2. + then return null.

    2. Let sourceDocument be the entry global object's associated Document.

      3. @@ -89860,37 +89916,20 @@ dictionary WindowPostMessageOptions : StructuredSeri

    3. Let tokenizedFeatures be the result of tokenizing features.

      4. -

    4. Let noopener and noreferrer be false.

      5. +

    5. Let noreferrer be false.

      6. -
    6. -

      If tokenizedFeatures["noopener"] exists, then:

      - -
        -

      1. Set noopener to the result of parsing - tokenizedFeatures["noopener"] as a boolean - feature.

        2. - -

      2. Remove tokenizedFeatures["noopener"].

        3. -
      -
      7. +

    7. If tokenizedFeatures["noreferrer"] exists, then set noreferrer to the result of parsing tokenizedFeatures["noreferrer"] as a boolean feature.

      8. -
    8. -

      If tokenizedFeatures["noreferrer"] exists, then:

      - -
        -

      1. Set noreferrer to the result of parsing - tokenizedFeatures["noreferrer"] as a boolean - feature.

        2. +

      2. Let noopener be the result of getting noopener for window open with + sourceDocument, tokenizedFeatures, and urlRecord.

        3. -

      3. Remove tokenizedFeatures["noreferrer"].

        4. -
      -
      9. +

    9. Remove tokenizedFeatures["noopener"] and tokenizedFeatures["noreferrer"].

    10. Let referrerPolicy be the empty string.