From 6fbbf7a07b7e15aeaea24785d30c9a6e9b2b763b Mon Sep 17 00:00:00 2001 From: "J.C. Jones" Date: Thu, 16 Feb 2017 14:02:19 -0700 Subject: [PATCH] Refactor the document.domain attribute setter as a standalone algorithm This is in response to W3C/HTML PR #769 (https://github.com/w3c/html/issues/769). The Web Authentication WG's draft currently makes reference to the "Relaxing the same-origin restriction" of the document.domain attribute setter as a way to let relying parties use foo.bar.com to generate scoped credentials for bar.com. However, 1) the attribute setter procedure isn't documented as an algorithm - so we shouldn't call it like one, and 2) we need to override some of the ambient state within it, by changing some of the values to be passed as arguments. We had started some work to inline the procedure as an algorithim within our document, but consensus is that it'd be better if we could avoid future divergence by refactoring this part of the HTML spec instead. --- source | 79 +++++++++++++++++++++++++++++++++------------------------- 1 file changed, 45 insertions(+), 34 deletions(-) diff --git a/source b/source index a02b4f19405..5e641c27f19 100644 --- a/source +++ b/source @@ -79482,48 +79482,19 @@ callback FrameRequestCallback = void (DOMHighResTimeStamp -
- -

The domain attribute's getter must run - these steps:

+

To relax the same-origin restriction for a Document activeDocument and a string inputDomain, the user agent must run these steps:

    -

  1. If this Document object does not have a browsing context, then return the empty string. - -

  2. Let effectiveDomain be this Document's origin's effective domain. - -

  3. If effectiveDomain is an opaque - origin, then return the empty string.

    4. - -

  4. Return effectiveDomain, serialized.

    5. -
- -

The domain attribute's setter must run these - steps:

- -
    -

  1. If this Document object has no browsing - context, then throw a "SecurityError" - DOMException.

    2. - -

  2. If this Document object's active sandboxing flag set has its - sandboxed document.domain browsing context - flag set, then throw a "SecurityError" - DOMException.

    3. - -

  3. If the given value is the empty string, then throw a +

  4. If inputDomain is the empty string, then throw a "SecurityError" DOMException.

    5. -

  5. Let host be the result of parsing the given - value.

    6. +

  6. Let host be the result of parsing the + inputDomain.

  7. If host is failure, then throw a "SecurityError" DOMException.

    8. -

  8. Let effectiveDomain be this Document object's +

  9. Let effectiveDomain be activeDocument's origin's effective domain.

    10. @@ -79556,6 +79527,45 @@ callback FrameRequestCallback = void (DOMHighResTimeStamp +

  10. Return host.

    11. +
+ +
+ +

The domain attribute's getter must run + these steps:

+ +
    +

  1. If this Document object does not have a browsing context, then return the empty string. + +

  2. Let effectiveDomain be this Document's origin's effective domain. + +

  3. If effectiveDomain is an opaque + origin, then return the empty string.

    4. + +

  4. Return effectiveDomain, serialized.

    5. +
+ +

The domain attribute's setter must run these + steps:

+ +
    +

  1. If this Document object has no browsing + context, then throw a "SecurityError" + DOMException.

    2. + +

  2. If this Document object's active sandboxing flag set has its + sandboxed document.domain browsing context + flag set, then throw a "SecurityError" + DOMException.

    3. + +

  3. Let host be the result of + relaxing the same-origin restriction with this Document object as + activeDocument and the given value as inputDomain.

    4. +

  4. Set this Document object's origin's domain to host.

@@ -119631,6 +119641,7 @@ INSERT INTERFACES HERE Ivan Enderlin, Ivo Emanuel Gonçalves, J. King, + J.C. Jones, Jackson Ray Hamilton, Jacob Davies, Jacques Distler,