Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add none as an allowed default #515

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

add none as an allowed default #515

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f973c09
add none
fergald May 26, 2023
3c69e51
fix typos
fergald Jun 10, 2024
59b2c00
change algo for headerless
fergald Jun 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 19 additions & 4 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -393,6 +393,17 @@ spec: RFC8941; urlPrefix: https://datatracker.ietf.org/doc/html/rfc8941#
by default in [=child navigables=] whose [=navigable/active
document|document=] is cross-origin with its [=navigable/parent=]'s
[=navigable/active document|document=].</dd>
<dt><dfn for="default allowlist" export><code>none</code></dfn></dt>
<dd>The feature is not allowed in {{Document}}s in [=/top-level
traversables=] by default, as well as those in all [=child
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The "as well as" here feels like it should refer to a previous positive statement -- maybe this sentence should be

By default, the feature is not allowed in Documents in top-level traversables, nor is it allowed in child navigables.

navigables=]. It can be allowed {{Document}}s in [=/top-level
traversables=] by delivering the {{Document}} with a suitable <a
http-header> `Permissions-Policy`</a> header). It can be allowed
in [=child navigables=] if it is allowed in the parent
{{Document}} by explicitly supplying a [=container policy=] on
the [=navigable container=] that overrides this default and by
delivering the {{Document}} with a suitable <a
http-header>`Permissions-Policy`</a> header.</dd>
</dl>
</section>
</section>
Expand Down Expand Up @@ -1045,7 +1056,9 @@ partial interface HTMLIFrameElement {
policy</a>'s [=declared policy/declarations=][|feature|]
<a>matches</a> |origin|, then return "<code>Enabled</code>".
1. Otherwise return "<code>Disabled</code>".
1. Return "<code>Enabled</code>".
1. If |feature|'s <a>default allowlist</a> is <code>*</code> or
<code>self</code>, return "<code>Enabled</code>".
1. Return "<code>Disabled</code>".

</div>
</section>
Expand All @@ -1054,8 +1067,8 @@ partial interface HTMLIFrameElement {

<div class="algorithm" data-algorithm="check-permissions-policy">
To check a permissions policy, given [=permissions policy=] (|policy|), a
[=feature=] (|feature|), an [=origin=] (|origin|) and another [=origin=]
(|document origin|), this algorithm returns "<code>Disabled</code>" if
[=feature=] (|feature|), an [=origin=] (|origin|) and a {{Document}} object
(|document|), this algorithm returns "<code>Disabled</code>" if
|feature| should be considered disabled, and "<code>Enabled</code>"
otherwise.
1. If |policy|'s <a for="permissions policy">inherited policy</a> for
Expand All @@ -1068,9 +1081,11 @@ partial interface HTMLIFrameElement {
1. Otherwise return "<code>Disabled</code>".
1. If |feature|'s <a>default allowlist</a> is <code>*</code>, return
"<code>Enabled</code>".
1. Let |document origin| be |document|'s [=Document/origin=].
1. If |feature|'s <a>default allowlist</a> is <code>'self'</code>, and
|origin| is [=same origin=] with |document origin|, return
"<code>Enabled</code>".
1. If |document| is a headerless document, return "<code>Enabled</code>".
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about defining (somewhere else in the doc):

A document is a <dfn>headerless document<dfn> if any of the following conditions are true:
* Its [=Document/URL=] [=matches about:blank=]
* Its [=Document/URL=] [=matches about:srcdoc=]
* Its [=Document/URL=]'s [=scheme=] is 'data'

And we can add additional cases as we find them. This might also be a good candidate for export to HTML if it turns out to be generally useful.

1. Return "<code>Disabled</code>".

</div>
Expand Down Expand Up @@ -1100,7 +1115,7 @@ partial interface HTMLIFrameElement {
permissions policy=].
1. Let |result| be the result of calling <a abstract-op>Check permissions
policy</a>, given |policy|,
|feature|, |origin|, and |document|'s [=Document/origin=].
|feature|, |origin|, and |document|.
1. Let |report-only result| be the result of calling <a abstract-op>Check
permissions policy</a>, given |report-only policy|, |feature|, |origin|,
and |document|'s [=Document/origin=].
Expand Down