From 999f9a981681065423051264b9c2a959348fb7ae Mon Sep 17 00:00:00 2001
From: diekus
conventions or limitations of the host operating system.
+
+ The [=manifest's=] protocol_handlers
member is an array of
+ ProtocolHandlerItems that allows a web application to handle
+ URL protocols.
+
+ Protocol handlers could, for instance, be used for web app + communication where one app directly invokes another and passes data + via custom protocol links. +
++ How protocol handlers are presented, and how many of them are shown + to the user, is at the discretion of the user agent and/or operating + system. +
+
+ The steps for processing the protocol_handlers
+ member are given by the following algorithm. The algorithm
+ takes a sequence<ProtocolHandlerItem>
+ protocol_handlers and a URL manifest
+ URL. This algorithm returns a sequence<ProtocolHandlerItem>.
+
+ To process the the processedProtocolHandlers the user + agent SHOULD [=register a handler=] per item defined in the + [=sequence=]. +
++ A user agent SHOULD ask users for permission before registering a + ProtocolHandlerItem protocol_handlers as the + default handler for a protocol with the host operating system. A user + agent MAY truncate the list of ProtocolHandlerItem + protocol_handlers presented in order to remain consistent + with the conventions or limitations of the host operating system. +
++ In the following example, the developer has included two + ProtocolHandlerItem protocol_handlers. Assuming + the the manifest's URL is + https://example.com/manifest.webmanifest: +
++ { + "protocol_handlers": [ + { + "protocol": "web+music", + "url": "/play?songId=%s" + }, + { + "protocol": "store", + "url": "/buy?songId=%s" + } + ] + } ++
Each ProtocolHandlerItem is an [=object=] that represents represents a protocol that the web application wants to handle. It has the following members:
++ A user agent SHOULD use these values to register + the web application as a handler with the operating system. When the + user activates a protocol handler URL, the user agent SHOULD run + Handling a protocol launch. +
+
+ [[HTML]]'s registerProtocolHandler
method allows web sites
+ to register themselves as possible handlers for particular protocols.
+ What constitutes valid protocol
and url
+ values for ProtocolHandlerItems is defined in that API. Also
+ note that the [[HTML]] API uses scheme
where we use
+ protocol
but the same restrictions apply.
+
+ The protocol member of a ProtocolHandlerItem is a + string that represents the protocol to be handled, such as + "mailto" or "web+auth". +
+
+ The protocol member of a ProtocolHandlerItem is
+ equivalent to {{NavigatorContentUtils/registerProtocolHandler()}}'s
+ scheme
argument defined in [[HTML]], and is processed in
+ the same manner.
+
+ The url member of a ProtocolHandlerItem is the + URL [=manifest/within scope=] of the application that opens when the associated protocol is + activated. +
+
+ The url member of a ProtocolHandlerItem is equivalent
+ to {{NavigatorContentUtils/registerProtocolHandler()}}'s
+ url
argument defined in [[HTML]], and is processed in
+ the same manner.
+
+ When a ProtocolHandlerItem protocol_handler having + [=manifest=] manifest is invoked, run the + following steps: +
+
-
The [=manifest's=] protocol_handlers
member is an array of
- ProtocolHandlerItems that allows a web application to handle
- URL protocols.
+ "manifest">protocol_handlers member is an array
+ of ProtocolHandlerItems that allows a web application to
+ handle URL protocols.
Protocol handlers could, for instance, be used for web app @@ -1042,18 +1043,21 @@
Each ProtocolHandlerItem is an [=object=] that represents represents a protocol that the web application wants to handle. It has the following members:
++ Each ProtocolHandlerItem is an [=object=] that represents + represents a protocol that the web application wants to handle. It has + the following members: +
- A user agent SHOULD use these values to register - the web application as a handler with the operating system. When the - user activates a protocol handler URL, the user agent SHOULD run - Handling a protocol launch. + A user agent SHOULD use these values to register the web application as + a handler with the operating system. When the user activates a protocol + handler URL, the user agent SHOULD run Handling a protocol + launch.
[[HTML]]'s registerProtocolHandler
method allows web sites
to register themselves as possible handlers for particular protocols.
What constitutes valid protocol
and url
values for ProtocolHandlerItems is defined in that API. Also
- note that the [[HTML]] API uses scheme
where we use
- protocol
but the same restrictions apply.
+ note that the [[HTML]] API uses scheme
+ where we use protocol
but the same restrictions apply.
The protocol member of a ProtocolHandlerItem is a string that represents the protocol to be handled, such as @@ -1896,22 +1909,23 @@
The protocol member of a ProtocolHandlerItem is
equivalent to {{NavigatorContentUtils/registerProtocolHandler()}}'s
- scheme
argument defined in [[HTML]], and is processed in
- the same manner.
+ scheme
+ argument defined in [[HTML]].
The url member of a ProtocolHandlerItem is the - URL [=manifest/within scope=] of the application that opens when the associated protocol is - activated. + URL [=manifest/within scope=] of the application that opens + when the associated protocol is activated.
The url member of a ProtocolHandlerItem is equivalent
to {{NavigatorContentUtils/registerProtocolHandler()}}'s
- url
argument defined in [[HTML]], and is processed in
- the same manner.
+ url
argument defined in [[HTML]].
When a ProtocolHandlerItem protocol_handler having - [=manifest=] manifest is invoked, run the - following steps: + [=manifest=] manifest is invoked, it goes through the same + steps used to [=invoke a protocol handler=] defined in [=HTML=], + where the user agent SHOULD navigate to [=url=] and the appropriate + browsing context is set to a new top level browsing context.
-+ Privacy concerns for custom scheme handling are detailed in the + + Security and privacy section of + {{NavigatorContentUtils/registerProtocolHandler()}}. +
++ The user agent MUST ask for permission when using a protocol + handler for the first time. This feature requires user interaction + and a script cannot communicate with another application on its + own. +
+To process the the processedProtocolHandlers the user - agent SHOULD [=register a handler=] per item defined in the + agent SHOULD [=register a protocol handler=] per item defined in the [=sequence=].
From 228e2e6bcd02f956fba4d069f4b7968f1d82323c Mon Sep 17 00:00:00 2001
From: diekus
system.
- The steps for processing the
The [=manifest's=]
@@ -1026,28 +1026,18 @@ protocol_handlers
+ The steps for processing the `protocol_handlers`
member are given by the following algorithm. The algorithm
takes a sequence<ProtocolHandlerItem>
From 81bdeda983da67ad1e4163c10ff858b1e3c9f4c8 Mon Sep 17 00:00:00 2001
From: Diego Gonzalez <73939538+diekus@users.noreply.github.com>
Date: Fri, 7 May 2021 12:25:39 +0100
Subject: [PATCH 06/25] Update index.html
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Co-authored-by: Marcos Cáceres
-
in the sequence:
protocol_handlers
member is an array
- of ProtocolHandlerItems that allows a web application to
+ of protocol handler descriptions that allows a web application to
handle URL protocols.
to the user, is at the discretion of the user agent and/or operating
system.
- The steps for processing the protocol_handlers
- member are given by the following algorithm. The algorithm
- takes a sequence<ProtocolHandlerItem>
- protocol_handlers and a URL manifest
- URL. This algorithm returns a sequence<ProtocolHandlerItem>.
-
To process the `protocol_handlers` member, given [=object=] |json:JSON|, |manifest:ordered map|, and |manifest URL:URL|:
A user agent SHOULD ask users for permission before registering a - ProtocolHandlerItem protocol_handlers as the + protocol handler description protocol_handlers as the default handler for a protocol with the host operating system. A user - agent MAY truncate the list of ProtocolHandlerItem + agent MAY truncate the list of protocol handler description protocol_handlers presented in order to remain consistent with the conventions or limitations of the host operating system.
-- Each ProtocolHandlerItem is an [=object=] that represents + Each protocol handler description is an [=object=] that represents represents a protocol that the web application wants to handle. It has the following members:
@@ -1889,9 +1879,8 @@registerProtocolHandler
method allows web sites
to register themselves as possible handlers for particular protocols.
What constitutes valid protocol
and url
- values for ProtocolHandlerItems is defined in that API. Also
- note that the [[HTML]] API uses scheme
+ values for protocol handler descriptions is defined in that API. Also
+ note that the [[HTML]] API uses [=url/scheme=]
where we use protocol
but the same restrictions apply.
- The protocol member of a ProtocolHandlerItem is a + The protocol member of a protocol handler description is a string that represents the protocol to be handled, such as - "mailto" or "web+auth". + `mailto` or `web+auth`.
- The protocol member of a ProtocolHandlerItem is + The protocol member of a protocol handler description is equivalent to {{NavigatorContentUtils/registerProtocolHandler()}}'s scheme argument defined in [[HTML]]. @@ -1915,12 +1904,12 @@
- The url member of a ProtocolHandlerItem is the + The url member of a protocol handler description is the URL [=manifest/within scope=] of the application that opens when the associated protocol is activated.
- The url member of a ProtocolHandlerItem is equivalent
+ The url member of a protocol handler description is equivalent
to {{NavigatorContentUtils/registerProtocolHandler()}}'s
url
argument defined in [[HTML]].
- When a ProtocolHandlerItem protocol_handler having
+ When a protocol handler description protocol_handler having
[=manifest=] manifest is invoked, it goes through the same
steps used to [=invoke a protocol handler=] defined in [=HTML=],
where the user agent SHOULD navigate to [=url=] and the appropriate
From 9314353b12f8e3bfcca9b3205da717b2aa3959d2 Mon Sep 17 00:00:00 2001
From: diekus
Privacy concerns for custom scheme handling are detailed in the
-
+
Security and privacy section of
{{NavigatorContentUtils/registerProtocolHandler()}}.
- The user agent MUST ask for permission when using a protocol
- handler for the first time. This feature requires user interaction
- and a script cannot communicate with another application on its
- own.
-
+ The user agent MUST ask for permission when using a protocol
+ handler for the first time. This feature requires user interaction
+ and a script cannot communicate with another application on its
+ own.
+
A user agent SHOULD use these values to register the web application as a handler with the operating system. When the user activates a protocol - handler URL, the user agent SHOULD run Handling a protocol + handler URL, the user agent SHOULD run handling a protocol launch.
From b0112753bf82461784edacea433bcb6370d25e85 Mon Sep 17 00:00:00 2001
From: Diego Gonzalez <73939538+diekus@users.noreply.github.com>
Date: Tue, 18 May 2021 09:58:16 +0100
Subject: [PATCH 11/25] Update index.html
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Co-authored-by: Marcos Cáceres
The protocol member of a protocol handler description is
equivalent to {{NavigatorContentUtils/registerProtocolHandler()}}'s
- scheme
- argument defined in [[HTML]].
+ |scheme| argument defined in [[HTML]].
- [[HTML]]'s
Privacy concerns for custom scheme handling are detailed in the
-
- Security and privacy section of
+ Security and privacy section of
{{NavigatorContentUtils/registerProtocolHandler()}}.
From f0945d49f765cdee2d75928de11c8d90e146db74 Mon Sep 17 00:00:00 2001
From: Diego Gonzalez <73939538+diekus@users.noreply.github.com>
Date: Mon, 24 May 2021 14:02:39 +0100
Subject: [PATCH 14/25] Update index.html
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Co-authored-by: Marcos Cáceres
- The [=manifest's=]
+
Protocol handlers could, for instance, be used for web app
communication where one app directly invokes another and passes data
via custom protocol links.
From 34d479b20b191a0b445eb44eb3d6679ac2582454 Mon Sep 17 00:00:00 2001
From: Diego Gonzalez <73939538+diekus@users.noreply.github.com>
Date: Mon, 24 May 2021 14:16:44 +0100
Subject: [PATCH 16/25] Update index.html
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Co-authored-by: Marcos Cáceres
- To process the the processedProtocolHandlers the user
- agent SHOULD [=register a protocol handler=] per item defined in the
- [=sequence=].
-
A user agent SHOULD ask users for permission before registering a
protocol handler description protocol_handlers as the
From d440080ab4bd3ae67e52c43ca9851e9277a8617e Mon Sep 17 00:00:00 2001
From: diekus
- Each protocol handler description is an [=object=] that represents
+ Each protocol handler description is an [=object=] that
represents a protocol that the web application wants to handle. It has
the following members:
registerProtocolHandler
method allows web sites
+ [[HTML]]'s {{NavigatorContentUtils/registerProtocolHandler()}} allows web sites
to register themselves as possible handlers for particular protocols.
What constitutes valid protocol
and url
values for protocol handler descriptions is defined in that API. Also
From 0d4f273327168949ccac432ef7ed7ff8885a831d Mon Sep 17 00:00:00 2001
From: Diego Gonzalez <73939538+diekus@users.noreply.github.com>
Date: Mon, 24 May 2021 13:59:37 +0100
Subject: [PATCH 13/25] Update index.html
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Co-authored-by: Marcos Cáceres
`protocol_handlers` member
protocol_handlers
member is an array
+ The [=manifest's=] protocol_handlers
member is an array
of protocol handler descriptions that allows a web application to
handle URL protocols.
of protocol handler descriptions that allows a web application to
handle URL protocols.
-
|manifest|, |manifest URL|, and "icons".
ProtocolHandler items
From 18c9046eb6dea351a52c049073183b9beff24c58 Mon Sep 17 00:00:00 2001
From: diekus
- This document reuses text from the [[HTML]] specification, as permitted - by the license of that specification. + This document reuses text from the [[HTML]] specification, as permitted by the license of + that specification.
- Dave Raggett and Dominique Hazael-Massieux contributed to this - specification via the HTML5Apps project. + Dave Raggett and Dominique Hazael-Massieux contributed to this specification via the + HTML5Apps project.
Claudio Gomboli for icon example images.
- Indiana University Bloomington security researchers have contributed to - this specification by reporting potential risks related to out-of-scope - navigation. + Indiana University Bloomington security researchers have contributed to this specification + by reporting potential risks related to out-of-scope navigation.
- This document reuses text from the [[HTML]] specification, as permitted by the license of - that specification. + This document reuses text from the [[HTML]] specification, as permitted + by the license of that specification.
- Dave Raggett and Dominique Hazael-Massieux contributed to this specification via the - HTML5Apps project. + Dave Raggett and Dominique Hazael-Massieux contributed to this + specification via the HTML5Apps project.
Claudio Gomboli for icon example images.
- Indiana University Bloomington security researchers have contributed to this specification - by reporting potential risks related to out-of-scope navigation. + Indiana University Bloomington security researchers have contributed to + this specification by reporting potential risks related to out-of-scope + navigation.
From 6de904e684c744e8b4a7b9a339ea14d324b1d702 Mon Sep 17 00:00:00 2001 From: diekusDate: Mon, 2 Aug 2021 20:06:23 +0100 Subject: [PATCH 25/25] Fixes index.html - fixes orphan ul element - moves protocol handler privacy and security section to main P&S section --- index.html | 116 ++++++++++++++++++++++++++--------------------------- 1 file changed, 58 insertions(+), 58 deletions(-) diff --git a/index.html b/index.html index bc52f53db..353a30e19 100644 --- a/index.html +++ b/index.html @@ -1034,7 +1034,11 @@ URL:URL|:
-
-- Let processedProtocolHandlers be a new [=list=]. +
- Let processedProtocolHandlers be a new [=list=] of + |json:JSON|["protocol_handlers"]. +
+- Set manifest["protocol_handlers"] to + processedProtocolHandlers.
- [=list/For each=] protocol_handler (protocol handler description): @@ -1050,51 +1054,50 @@
+the base URL, and [=this=]'s relevant [=environment settings object=]. If the result is failure, [=iteration/continue=].
- If [=normalizedUrl=] is not [=manifest/within scope=] of + manifest URL, [=iteration/continue=]. +
+- If [=normalizedUrl=] already exists in + processedProtocolHandlers, [=iteration/continue=]. +
+- [=List/Append=] |protocol_handler| to + processedProtocolHandlers. +
If [=normalizedUrl=] is not [=manifest/within scope=] of - manifest URL, [=iteration/continue=]. - -If [=normalizedUrl=] already exists in - processedProtocolHandlers, [=iteration/continue=]. - -[=List/Append=] |protocol_handler| to - processedProtocolHandlers. + [=list/For each=] |processedProtocolHandlers|, the user agent + SHOULD [=register a protocol handler=]. --
+- [=list/For each=] |processedProtocolHandlers|, [=register a - protocol handler=]. -
++ A user agent SHOULD ask users for permission before registering a + protocol handler description protocol_handlers as + the default handler for a protocol with the host operating system. A + user agent MAY truncate the list of protocol handler + description protocol_handlers presented in order to + remain consistent with the conventions or limitations of the host + operating system. +
+- @@ -1944,21 +1946,6 @@
new top level browsing context.
- - Privacy and Security considerations -
-- Privacy concerns for custom scheme handling are detailed in the - Security and privacy section of - {{NavigatorContentUtils/registerProtocolHandler()}}. -
-- The user agent MUST ask for permission when using a protocol handler - for the first time. This feature requires user interaction and a - script cannot communicate with another application on its own. -
-@@ -2135,6 +2122,12 @@
and again as an example, the user agent could install the web application into a list of bookmarks within the user agent itself. +
++ When a web application is installed, a user agent MAY [=register a + protocol handler=]. +
+Application's name @@ -2601,7 +2594,6 @@
- const standalone = matchMedia( '(display-mode: standalone)' ); standalone.onchange = (e) => { @@ -2726,6 +2718,14 @@exploit the fact that an application is being displayed in fullscreen to mimic the user interface of another application. +
+ Privacy concerns for custom scheme handling are detailed in the + Security and privacy section of + {{NavigatorContentUtils/registerProtocolHandler()}}. Before invoking a + protocol handler for the first time, the user agent prompts to request + for permission, there is no communication with another application + beforehand. +