diff --git a/source b/source index dc2ce71f574..37a70f76379 100644 --- a/source +++ b/source @@ -10014,6 +10014,8 @@ o.myself = o; URL in their user interface. This is the primary mechanism by which a user can tell if a site is attempting to impersonate another.

+ +

The Document object's origin is defined in DOM. It is initially set when the @@ -10199,7 +10201,8 @@ partial interface Document { On getting, if the document is a cookie-averse Document object, then the user agent must return the empty string. Otherwise, if the Document's origin is an opaque + data-x="concept-document-policy-container">policy container's origin is an opaque origin, the user agent must throw a "SecurityError" DOMException. Otherwise, the user agent must return the cookie-string for the document's URL for a "non-HTTP" API, decoded @@ -10207,7 +10210,8 @@ partial interface Document {

On setting, if the document is a cookie-averse Document object, then the user agent must do nothing. Otherwise, if the Document's origin is an opaque + data-x="concept-document-policy-container">policy container's origin is an opaque origin, the user agent must throw a "SecurityError" DOMException. Otherwise, the user agent must act as it would when receiving a set-cookie-string for the document's @@ -15054,7 +15058,8 @@ interface HTMLLinkElement : HTMLElement {

document's URL
origin
-
document's origin
+
document's policy + container's origin
environment
document's relevant settings object
@@ -15169,7 +15174,8 @@ interface HTMLLinkElement : HTMLElement {
doc's URL
origin
-
doc's origin
+
doc's policy + container's origin
environment
doc's relevant settings object
@@ -24549,7 +24555,8 @@ document.body.appendChild(wbr); the header, and jump to the step labeled sanitize below.

  • Let interface origin be the origin of the Document in which the origin of the Document's policy container in which the download or navigate action resulting in the download was initiated, if any.

    • @@ -29470,7 +29477,8 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ...

    Let key be a tuple consisting of urlString, the img element's crossorigin attribute's mode, and, if that mode is not No CORS, the node - document's origin.

    + document's policy container's + origin.

  • If the list of available images contains an entry for key, @@ -30489,7 +30497,8 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ...crossorigin content attribute.

  • ⌛ Let origin be the img element's node - document's origin.

    • + document's policy container's + origin.

  • ⌛ Let client be the img element's node document's relevant settings object.

    • @@ -32221,7 +32230,8 @@ interface HTMLIFrameElement : HTMLElement {

  • If the result of running is feature enabled in document for origin on feature, document, and document's origin is "Enabled", then return + data-x="concept-document-policy-container">policy container origin is "Enabled", then return true.

  • Return false.

    • @@ -50994,7 +51004,8 @@ You cannot submit this form when the field is incorrect.

  • If this's relevant settings object's origin is not same origin with + data-x="concept-settings-object-policy-container">policy container's origin is not same origin with this's relevant settings object's top-level origin, and this's type attribute is not in the File Upload state or HTMLDialogElement : HTMLElement { document.

  • If control's node document's origin is not the same - as the origin of topDocument, then + data-x="concept-document-policy-container">policy container's origin is not the same + as the origin of topDocument's + policy container, then return.

  • Empty topDocument's @@ -75880,8 +75893,10 @@ END:VCARD data-x="nav-window">active window of each of document's descendant navigables, filtered to include only those navigables whose active document's origin is same origin with - document's origin.

    • + data-x="concept-document-policy-container">policy container's origin is same origin with + document's policy container's + origin.

  • For each window in windows, set window's last activation timestamp to the current high resolution @@ -77556,8 +77571,10 @@ partial interface Navigator {

  • For each ancestorNavigable of target's ancestor navigables: if ancestorNavigable's active document's origin is not same origin with - target's origin, then return.

    • + data-x="concept-document-policy-container">policy container's origin is not same origin with + target's policy container's + origin, then return.

  • Let topDocument be target's node navigable's top-level traversable's active @@ -81285,7 +81302,8 @@ dictionary DragEventInit : MouseEventInit {

    1. Let effectiveDomain be this's origin's policy container's origin's effective domain.

    2. If effectiveDomain is null, then return the empty string.

      3. @@ -81305,7 +81323,8 @@ dictionary DragEventInit : MouseEventInit { throw a "SecurityError" DOMException.

    3. Let effectiveDomain be this's origin's policy container's origin's effective domain.

    4. If effectiveDomain is null, then throw a @@ -81318,7 +81337,8 @@ dictionary DragEventInit : MouseEventInit {

    5. If the surrounding agent's agent cluster's is origin-keyed is true, then return.

      6. -

    6. Set this's origin's

      Set this's policy + container's origin's domain to the result of parsing the given value.

    @@ -81493,7 +81513,8 @@ dictionary DragEventInit : MouseEventInit {

    The consequences of using this header are that the resulting Document's agent cluster key is its origin, instead of the policy container's origin, instead of the corresponding site. In terms of observable effects, this means that attempting to relax the same-origin restriction using document.domain will instead do @@ -82080,23 +82101,27 @@ dictionary DragEventInit : MouseEventInit { data-x="bc-tlbc">top-level browsing context's active document.

  • Let accessorInclusiveAncestorOrigins be the list obtained by taking the origin of the active - document of each of accessor's active document's inclusive + data-x="policy-container-origin">origin of the active + document's policy container + of each of accessor's active document's inclusive ancestor navigables.

  • Let accessedTopDocument be accessed's top-level browsing context's active document.

  • Let accessedInclusiveAncestorOrigins be the list obtained by taking the origin of the active - document of each of accessed's active document's inclusive + data-x="policy-container-origin">origin of the active + document's policy container + of each of accessed's active document's inclusive ancestor navigables.

  • If any of accessorInclusiveAncestorOrigins are not same origin with - accessorTopDocument's origin, or if + accessorTopDocument's policy + container's origin, or if any of accessedInclusiveAncestorOrigins are not same origin with - accessedTopDocument's origin, then + accessedTopDocument's policy + container's origin, then return.

    This avoids leaking information about cross-origin iframes to a top level frame @@ -82135,8 +82160,10 @@ dictionary DragEventInit : MouseEventInit { data-x="browsing-context-initial-url">initial URL, accessed's top-level browsing context's initial URL, accessor's active - document's origin, accessed's - active document's origin, + document's policy container's + origin, accessed's + active document's policy + container's origin, accessor's top-level browsing context's opener origin at creation, accessed's top-level browsing context's DragEventInit : MouseEventInit {

    then set historyEntry's document state's @@ -90020,7 +90112,8 @@ location.href = '#foo';

  • If initiatorOrigin is not same origin-domain with targetNavigable's active document's origin, then return.

    • + data-x="concept-document-policy-container">policy container's origin, then return.

  • Let request be a new request whose

    response
    response
    -
    origin
    -
    initiatorOrigin
    -
    policy container
    -
    policyContainer
    +
    a clone of policyContainer + with its origin set to + initiatorOrigin
    final sandboxing flag set
    finalSandboxFlags
    @@ -91018,7 +91110,8 @@ location.href = '#foo'; data-x="navigation-params-response">response, navigable, navigationParams's policy container's CSP list, and - navigationParams's origin is false, + navigationParams's policy + container's origin is false, then set failure to true.

  • @@ -91124,7 +91217,8 @@ location.href = '#foo';

  • Set entry's document state's origin to document's origin.

    • + data-x="concept-document-policy-container">policy container's origin.

    @@ -91207,6 +91301,9 @@ location.href = '#foo'; navigable's container document's policy container, and null.

    +

  • Set policyContainer's origin + to responseOrigin.

    • +

  • Return a new navigation params, with

    @@ -91220,9 +91317,6 @@ location.href = '#foo';
    response
    response
    -
    origin
    -
    responseOrigin
    -
    policy container
    policyContainer
    @@ -91392,7 +91486,8 @@ location.href = '#foo';
    origin
    navigable's active document's origin
    + data-x="concept-document-policy-container">policy container's origin
    cross-origin opener policy
    navigable's active document's
    current context is navigation source
    true if navigable's active document's origin is same origin with + data-x="concept-document-policy-container">policy container's origin is same origin with entry's document state's initiator origin otherwise false
    @@ -91605,7 +91701,8 @@ location.href = '#foo'; child navigable, and the result of performing a cross-origin resource policy check with navigable's container document's origin, navigable's policy container's origin, navigable's container document's relevant settings object, request's destination, response, and true is @@ -91795,6 +91892,9 @@ location.href = '#foo'; sourceSnapshotParams's source policy container, null, and responsePolicyContainer.

    • +

  • Set resultPolicyContainer's origin to responseOrigin

    • . +

  • Return a new navigation params, with

    @@ -91808,9 +91908,6 @@ location.href = '#foo';
    response
    response
    -
    origin
    -
    responseOrigin
    -
    policy container
    resultPolicyContainer
    @@ -91845,10 +91942,13 @@ location.href = '#foo'; node navigable is a top-level traversable or if all of its Document's ancestor navigables all have active documents whose origins are the same origin as the element's - node document's origin. If an element + data-x="concept-document-policy-container">policy containers' origins are the same origin as the element's + node document's policy + container's origin. If an element has a browsing context scope origin, then its value is the origin of the element's node document.

    + data-x="policy-container-origin">origin of the element's node document's + policy container.

    This definition is broken and needs investigation to see what it was intended to express: see issue #4703.

    @@ -92200,7 +92300,8 @@ location.href = '#foo';

  • If targetEntry's document's origin is not oldOrigin, then set + data-x="concept-document-policy-container">policy container's origin is not oldOrigin, then set targetEntry's serialized state to StructuredSerializeForStorage(null).

    @@ -92220,7 +92321,8 @@ location.href = '#foo'; context whose disowned is false; and

  • targetEntry's document's origin is not oldOrigin

    • + data-x="concept-document-policy-container">policy container's origin is not oldOrigin

    then set targetEntry's document @@ -93149,7 +93251,8 @@ location.href = '#foo'; data-x="navigation-params-navigable">navigable's active browsing context. In such a case, the created Window, Document, and agent will not end up being used; because the created Document's - origin is policy container's origin is opaque, we will end up creating a new agent and Window later in this algorithm to go along with the new Document.

    @@ -93158,7 +93261,8 @@ location.href = '#foo';

  • Let permissionsPolicy be the result of creating a permissions policy from a response given browsingContext, navigationParams's origin, and navigationParams's policy container's origin, and navigationParams's response.

    @@ -93167,7 +93271,8 @@ location.href = '#foo'; been used for navigationParams's navigable's container document, then its origin cannot be same origin-domain with + data-x="concept-document-policy-container">policy container's origin cannot be same origin-domain with the passed origin, because these steps run before the document is created, so it cannot itself yet have used document.domain. Note that this means that Permissions Policy checks are less permissive compared to doing a @@ -93191,9 +93296,11 @@ location.href = '#foo';

  • If browsingContext's active document's is initial about:blank is true, and browsingContext's active - document's origin is same + document's policy container's + origin is same origin-domain with navigationParams's origin, then set window to + data-x="navigation-params-policy-container">policy container's origin, then set window to browsingContext's active window.

    This means that both the initial @@ -93220,7 +93327,8 @@ location.href = '#foo';

  • Let agent be the result of obtaining a similar-origin window agent - given navigationParams's origin, + given navigationParams's policy + container's origin, browsingContext's group, and requestsOAC.

    • @@ -93242,7 +93350,8 @@ location.href = '#foo';

  • Let topLevelCreationURL be creationURL.

  • Let topLevelOrigin be navigationParams's origin.

    • + data-x="navigation-params-policy-container">policy container's origin.

  • If navigable's container is not null, @@ -93286,9 +93395,6 @@ location.href = '#foo';

    content type
    contentType
    -
    origin
    -
    navigationParams's origin
    -
    browsing context
    browsingContext @@ -93767,9 +93873,6 @@ new PaymentRequest(…); // Allowed to use
    response
    a new response
    -
    origin
    -
    origin
    -
    policy container
    a new policy container
    @@ -93812,7 +93915,8 @@ new PaymentRequest(…); // Allowed to use

    Because we ensure the resulting Document's origin is policy container's origin is opaque, and the resulting Document cannot run script with access to the DOM, the existence and properties of this Document are not observable to web developer code. This means that most of the above values, e.g., the @@ -94002,8 +94106,10 @@ new PaymentRequest(…); // Allowed to use

  • If newDocument is given, newDocument's was created via cross-origin redirects is false, and newDocument's origin is the same as - oldDocument's origin, then set + data-x="concept-document-policy-container">policy container's origin is the same as + oldDocument's policy + container's origin, then set newDocument's previous document unload timing to unloadTimingInfo.

    • @@ -94256,9 +94362,10 @@ new PaymentRequest(…); // Allowed to use

    While containerDocument is not null:

      -

    1. If containerDocument's origin - is not same origin with destinationOrigin, then return - false.

      2. +

    2. If containerDocument's policy container's origin is not same origin with + destinationOrigin, then return false.

    3. Set containerDocument to containerDocument's container document.

      4. @@ -94863,7 +94970,8 @@ new PaymentRequest(…); // Allowed to use

      A for now implementation-defined value, null, or an origin. For a "top-level" potential execution environment it is null (i.e., when there is no response yet); otherwise it is the "top-level" environment's origin. For a dedicated worker or worklet it is + data-x="concept-settings-object-policy-container">policy container's origin. For a dedicated worker or worklet it is the top-level origin of its creator. For a shared or service worker it is an implementation-defined value.

      @@ -94936,13 +95044,6 @@ new PaymentRequest(…); // Allowed to use object to parse URLs.

      -
      An origin
      - -
      -

      An origin used in security checks.

      -
      -
      A policy container
      @@ -101297,7 +101398,8 @@ document.body.appendChild(frame)

      The origin getter steps are to return this's relevant settings object's origin, policy container's origin, serialized.

      The

    4. Let entryDocument be the entry global object's associated Document.

      5. -

    5. If document's origin is not +

    6. If document's policy + container's origin is not same origin to entryDocument's origin, then throw a + data-x="concept-document-policy-container">policy container's origin, then throw a "SecurityError" DOMException.

    7. @@ -102516,7 +102620,8 @@ function sendData(data) { modals flag set, then return true.

    8. If window's relevant settings object's origin and window's relevant + data-x="concept-settings-object-policy-container">policy container's origin and window's relevant settings object's top-level origin are not same origin-domain, then return true.

      9. @@ -103216,7 +103321,8 @@ interface Navigator {

    9. If the resulting URL record's scheme is not an HTTP(S) scheme or the resulting URL record's origin is not same origin with - environment's origin, then throw + environment's policy + container's origin, then throw a "SecurityError" DOMException.

    10. @@ -104438,7 +104544,8 @@ typedef (WindowProxy or MessagePort or ServiceWo

      The origin attribute must return the value it was initialized to. It represents, in server-sent events and cross-document - messaging, the origin of the document that + messaging, the policy container's + origin of the document that sent the message (typically the scheme, hostname, and port of the document, but not its path or fragment).

      @@ -105501,7 +105608,8 @@ function receiver(e) {

    11. If targetOrigin is a single U+002F SOLIDUS character (/), then set targetOrigin to incumbentSettings's origin.

      + data-x="concept-settings-object-policy-container">policy container's origin.

    12. Otherwise, if targetOrigin is not a single U+002A ASTERISK character (*), @@ -105533,12 +105641,14 @@ function receiver(e) {

      1. If the targetOrigin argument is not a single literal U+002A ASTERISK character (*) and targetWindow's associated - Document's origin is not + Document's policy + container's origin is not same origin with targetOrigin, then return.

      2. Let origin be the serialization of incumbentSettings's origin.

        3. + data-x="concept-settings-object-policy-container">policy container's origin.

      3. Let source be the WindowProxy object corresponding to incumbentSettings's global @@ -106286,7 +106396,8 @@ interface BroadcastChannel : EventTarget { any exceptions.

      4. Let sourceOrigin be this's relevant settings object's - origin.

        5. + policy container's origin.

      5. Let sourceStorageKey be the result of running obtain a storage key for non-storage purposes with this's relevant settings @@ -107246,6 +107357,12 @@ interface SharedWorkerGlobalScope : WorkerGlobalScope SharedWorkerGlobalScope object created in the previous step.

        6. +

      6. Set worker global scope's + policy container's + origin to outside settings's + policy container's + origin.

        7. +

      7. Set up a worker environment settings object with realm execution context, outside settings, and unsafeWorkerCreationTime, and let inside settings be the result.

        8. @@ -107264,7 +107381,8 @@ interface SharedWorkerGlobalScope : WorkerGlobalScope

      8. Set worker global scope's constructor origin to outside settings's origin.

        9. + data-x="concept-settings-object-policy-container">policy container        's origin.

      9. Set worker global scope's constructor url to @@ -107614,7 +107732,8 @@ interface SharedWorkerGlobalScope : WorkerGlobalScope

        1. Let inherited origin be outside settings's origin.

          2. + data-x="concept-settings-object-policy-container">policy container's origin.

        2. Let realm be the value of execution context's Realm component.

          3. @@ -107649,14 +107768,6 @@ interface SharedWorkerGlobalScope : WorkerGlobalScope data-x="concept-WorkerGlobalScope-url">url.

          -
          The origin
          -
          -

          Return a unique opaque origin if worker - global scope's url's scheme is "data", and inherited - origin otherwise.

          -
          -
          The policy container

          Return worker global scope's SharedWorkerGlobalScope : WorkerGlobalScope +

        3. Assert that settings object's policy container's origin is an opaque + origin.

          4. + +

        4. If worker global scope's url's scheme is not "data", then set + settings object's policy + container's origin to inherited + origin.

          5. +

        5. Set settings object's id to a new unique opaque string, creation URL to worker global scope's url, top-level creation URL to null, @@ -108812,8 +108935,6 @@ interface WorkletGlobalScope {}; object outsideSettings:

            -

          1. Let origin be a unique opaque - origin.

          2. Let inheritedAPIBaseURL be outsideSettings's API base URL.

            3. @@ -108822,6 +108943,10 @@ interface WorkletGlobalScope {}; container">clone of outsideSettings's policy container.

            +

          3. Set inheritedPolicyContainer's origin to a unique opaque origin.

            4. +

          4. Let realm be the value of executionContext's Realm component.

            5. @@ -108861,11 +108986,6 @@ interface WorkletGlobalScope {}; available to worklet code make use of the API base URL.

          6. -
          The origin
          -
          -

          Return origin.

          -
          -
          The policy container

          Return inheritedPolicyContainer.

          @@ -109517,7 +109637,8 @@ interface Storage { session storage area.

          Throws a "SecurityError" DOMException if the - Document's origin is an Document's policy + container's origin is an opaque origin or if the request violates a policy decision (e.g., if the user agent is configured to not allow the page to persist data).

          @@ -109577,7 +109698,8 @@ interface Storage { storage area.

          Throws a "SecurityError" DOMException if the - Document's origin is an Document's policy + container's origin is an opaque origin or if the request violates a policy decision (e.g., if the user agent is configured to not allow the page to persist data).

          @@ -111584,9 +111706,11 @@ dictionary StorageEventInit : EventInit {

        6. Let parentDocument be d's container document.

          7. -

        7. If parentDocument's origin is +

        8. If parentDocument's policy + container's origin is same origin with d's origin and parentDocument's policy container's origin and parentDocument's character encoding is not UTF-16BE/LE, then return parentDocument's character encoding, with the