Skip to content

Commit de54b41

Browse files
annevkannevk
committed
Cleanup origin serialization
Origin serialization didn’t properly serialize hosts and ports and used the domain to Unicode and domain to ASCII algorithms incorrectly, passing domain labels rather than domains (not accounting for the fact that the host might not be a domain either). This depends on #868 landing since it assumes aliasing is no longer a thing. This also depends on the URL Standard changing to no longer pass the default port when computing the origin of a URL. Instead, an origin and a URL should share the same data model subset, where port can be null. Since they serialise the same way, that makes things easier to understand. See whatwg/url#102 for that. This fixes #611, https://www.w3.org/Bugs/Public/show_bug.cgi?id=28788, and https://www.w3.org/Bugs/Public/show_bug.cgi?id=29056.
1 parent 438155d commit de54b41

File tree

1 file changed

+45
-54
lines changed

1 file changed

+45
-54
lines changed

‎source‎

Lines changed: 45 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -2740,7 +2740,6 @@ a.setAttribute('href', 'http://example.com/'); // change the content attribute d
27402740
<li><dfn data-noexport="" data-x-href="https://url.spec.whatwg.org/#percent-decode">Percent decode</dfn>
27412741
<li><dfn data-noexport="" data-x-href="https://url.spec.whatwg.org/#set-the-username">set the username</dfn>
27422742
<li><dfn data-noexport="" data-x-href="https://url.spec.whatwg.org/#set-the-password">set the password</dfn>
2743-
<li>The <dfn data-noexport="" data-x-href="https://url.spec.whatwg.org/#concept-domain-to-ascii">domain to ASCII</dfn> algorithm</li>
27442743
<li>The <dfn data-noexport="" data-x-href="https://url.spec.whatwg.org/#concept-domain-to-unicode">domain to Unicode</dfn> algorithm</li>
27452744
<li>The <dfn data-noexport="" data-x-href="https://url.spec.whatwg.org/#concept-urlencoded"><code>application/x-www-form-urlencoded</code></dfn> format
27462745
<li>The <dfn data-noexport="" data-x-href="https://url.spec.whatwg.org/#concept-urlencoded-serializer"><code>application/x-www-form-urlencoded</code> serializer</dfn>
@@ -8521,19 +8520,19 @@ partial /*sealed*/ interface <dfn>Document</dfn> {
85218520

85228521
<p id="sandboxCookies">On getting, if the document is a <span>cookie-averse <code>Document</code>
85238522
object</span>, then the user agent must return the empty string. Otherwise, if the
8524-
<code>Document</code>'s <span>origin</span> is not a scheme/host/port tuple, the user agent must
8525-
throw a <code>SecurityError</code> exception. Otherwise, the user agent must return the
8526-
<span>cookie-string</span> for <span>the document's address</span> for a "non-HTTP" API, decoded
8527-
using <span>UTF-8 decode without BOM</span>. <ref spec=COOKIES> <!--INSERT FINGERPRINT-->
8528-
</p>
8523+
<code>Document</code>'s <span>origin</span> is not a <span
8524+
data-x="concept-origin-tuple">tuple</span>, the user agent must throw a <code>SecurityError</code>
8525+
exception. Otherwise, the user agent must return the <span>cookie-string</span> for <span>the
8526+
document's address</span> for a "non-HTTP" API, decoded using <span>UTF-8 decode without
8527+
BOM</span>. <ref spec=COOKIES> <!--INSERT FINGERPRINT--></p>
85298528

85308529
<p>On setting, if the document is a <span>cookie-averse <code>Document</code> object</span>, then
85318530
the user agent must do nothing. Otherwise, if the <code>Document</code>'s <span>origin</span> is
8532-
not a scheme/host/port tuple, the user agent must throw a <code>SecurityError</code> exception.
8533-
Otherwise, the user agent must act as it would when <span data-x="receives a
8534-
set-cookie-string">receiving a set-cookie-string</span> for <span>the document's address</span>
8535-
via a "non-HTTP" API, consisting of the new value <span data-x="utf-8 encode">encoded as
8536-
UTF-8</span>. <ref spec=COOKIES> <ref spec=ENCODING></p>
8531+
not a <span data-x="concept-origin-tuple">tuple</span>, the user agent must throw a
8532+
<code>SecurityError</code> exception. Otherwise, the user agent must act as it would when <span
8533+
data-x="receives a set-cookie-string">receiving a set-cookie-string</span> for <span>the
8534+
document's address</span> via a "non-HTTP" API, consisting of the new value <span data-x="utf-8
8535+
encode">encoded as UTF-8</span>. <ref spec=COOKIES> <ref spec=ENCODING></p>
85378536

85388537
<p class="note">Since the <code data-x="dom-document-cookie">cookie</code> attribute is accessible
85398538
across frames, the path restrictions on cookies are only a tool to help manage which cookies are
@@ -78086,15 +78085,15 @@ callback <dfn>FrameRequestCallback</dfn> = void (<span>DOMHighResTimeStamp</span
7808678085
<dl>
7808778086

7808878087

78089-
<dt><dfn data-x="concept-origin-opaque-identifiers">Opaque identifiers</dfn></dt>
78088+
<dt><dfn data-x="concept-origin-opaque-identifier">Opaque identifiers</dfn></dt>
7809078089

7809178090
<dd>
7809278091

7809378092
<p>Internal values, with no serialisation, for which the only meaningful operation is testing
7809478093
for equality.</p>
7809578094

7809678095

78097-
<dt><dfn data-x="concept-origin-tuples">Tuples</dfn></dt>
78096+
<dt><dfn data-x="concept-origin-tuple">Tuples</dfn></dt>
7809878097

7809978098
<dd>
7810078099

@@ -78320,61 +78319,51 @@ callback <dfn>FrameRequestCallback</dfn> = void (<span>DOMHighResTimeStamp</span
7832078319
<hr>
7832178320

7832278321
<p>The <dfn>Unicode serialisation of an origin</dfn> is the string obtained by applying the
78323-
following algorithm to the given <span>origin</span>:</p>
78322+
following algorithm to the given <span>origin</span> <var>origin</var>:</p>
7832478323

7832578324
<ol>
78325+
<li><p>If <var>origin</var> is not a <span data-x="concept-origin-tuple">tuple</span>, then
78326+
return "<code data-x="">null</code>".</p></li>
7832678327

78327-
<li><p>If the <span>origin</span> in question is not a scheme/host/port tuple, then return the
78328-
literal string "<code data-x="">null</code>" and abort these steps.</p></li>
78329-
78330-
<li><p>Otherwise, let <var>result</var> be the scheme part of the <span>origin</span>
78331-
tuple.</p></li>
78328+
<li><p>Let <var>host</var> be the host part of <var>origin</var>.</p></li>
7833278329

78333-
<li><p>Append the string "<code data-x="">://</code>" to <var>result</var>.</p></li>
78330+
<li><p>Let <var>unicodeHost</var> be <var>host</var> if <var>host</var> is not a <span
78331+
data-x="concept-domain">domain</span>, and the result of applying <span>domain to Unicode</span>
78332+
to <var>host</var> otherwise.</p></li>
7833478333

78335-
<li><p>Apply the <span>domain to Unicode</span> algorithm to each component of the host
78336-
part of the <span>origin</span> tuple, and append the results &mdash; each component, in the same
78337-
order, separated by U+002E FULL STOP characters (.) &mdash; to <var>result</var>. <ref spec=URL></p></li>
78334+
<li><p>Let <var>unicodeOrigin</var> be a new <span data-x="concept-origin-tuple">tuple</span>
78335+
consisting of the scheme part of <var>origin</var>, <var>unicodeHost</var>, and the port part of
78336+
<var>origin</var>.</p></li>
7833878337

78339-
<li><p>If the port part of the <span>origin</span> tuple gives a port that is different from the
78340-
default port for the protocol given by the scheme part of the <span>origin</span> tuple, then
78341-
append a U+003A COLON character (:) and the given port, in base ten, to <var>result</var>.</p></li>
78342-
78343-
<li><p>Return <var>result</var>.</p></li>
78338+
<li>
78339+
<p>Return the <span>ASCII serialisation of an origin</span>, given <var>unicodeOrigin</var>.</p>
7834478340

78341+
<p class="note">The name <span>ASCII serialisation of an origin</span> is misleading, as it
78342+
merely serialises an origin, which are all ASCII by default due to the <span>URL
78343+
parser</span>.</p>
78344+
</li>
7834578345
</ol>
7834678346

7834778347

7834878348
<p>The <dfn>ASCII serialisation of an origin</dfn> is the string obtained by applying the
78349-
following algorithm to the given <span>origin</span>:</p>
78349+
following algorithm to the given <span>origin</span> <var>origin</var>:</p>
7835078350

7835178351
<ol>
78352+
<li><p>If <var>origin</var> is not a <span data-x="concept-origin-tuple">tuple</span>, then
78353+
return "<code data-x="">null</code>".</p></li>
7835278354

78353-
<li><p>If the <span>origin</span> in question is not a scheme/host/port tuple, then return the
78354-
literal string "<code data-x="">null</code>" and abort these steps.</p></li>
78355-
78356-
<li><p>Otherwise, let <var>result</var> be the scheme part of the <span>origin</span>
78357-
tuple.</p></li>
78355+
<li><p>Otherwise, let <var>result</var> be the scheme part of <var>origin</var>.</p></li>
7835878356

78359-
<li><p>Append the string "<code data-x="">://</code>" to <var>result</var>.</p></li>
78357+
<li><p>Append "<code data-x="">://</code>" to <var>result</var>.</p></li>
7836078358

78361-
<li>
78362-
78363-
<p>Apply the <span>domain to ASCII</span> algorithm to each component of the host part of
78364-
the <span>origin</span> tuple, and append the results &mdash; each component, in the same order,
78365-
separated by U+002E FULL STOP characters (.) &mdash; to <var>result</var>. <ref spec=URL></p>
78359+
<li><p>Append the host part of <var>origin</var>, <span data-x="host
78360+
serialiser">serialised</span>, to <var>result</var>.</p></li>
7836678361

78367-
<p>If the <span>domain to ASCII</span> algorithm returns failure, e.g. because a component is too long or because it contains
78368-
invalid characters, then throw a <code>SecurityError</code> exception and abort these steps.</p>
78369-
78370-
</li>
78371-
78372-
<li><p>If the port part of the <span>origin</span> tuple gives a port that is different from the
78373-
default port for the protocol given by the scheme part of the <span>origin</span> tuple, then
78374-
append a U+003A COLON character (:) and the given port, in base ten, to <var>result</var>.</p></li>
78362+
<li><p>If the port part of <var>origin</var> is non-null, append a U+003A COLON character (:),
78363+
and the port part, <span data-x="serialise an integer">serialised</span>, to
78364+
<var>result</var>.</p></li>
7837578365

7837678366
<li><p>Return <var>result</var>.</p></li>
78377-
7837878367
</ol>
7837978368

7838078369

@@ -78432,9 +78421,10 @@ callback <dfn>FrameRequestCallback</dfn> = void (<span>DOMHighResTimeStamp</span
7843278421

7843378422
<p>Each <code>Document</code> object has an associated <dfn data-x="the document's
7843478423
domain">domain</dfn>. Its initial value is the host component of the document's
78435-
<span>origin</span>, if the value of that <span>origin</span> is a scheme/host/port tuple and if
78436-
the <code>Document</code> object has a <span data-x="concept-document-bc">browsing context</span>,
78437-
and the empty <span data-x="concept-domain">domain</span> otherwise.</p>
78424+
<span>origin</span>, if the value of that <span>origin</span> is a <span
78425+
data-x="concept-origin-tuple">tuple</span> and if the <code>Document</code> object has a <span
78426+
data-x="concept-document-bc">browsing context</span>, and the empty <span
78427+
data-x="concept-domain">domain</span> otherwise.</p>
7843878428
<!-- Use an empty domain rather than empty string so the host serialiser works fine. -->
7843978429

7844078430
<p>The <dfn><code data-x="dom-document-domain">domain</code></dfn> attribute's getter must return
@@ -95691,8 +95681,9 @@ interface <dfn>WindowLocalStorage</dfn> {
9569195681
instead of returning a <code>Storage</code> object if the request violates a policy decision
9569295682
(e.g. if the user agent is configured to not allow the page to persist data).</p></li>
9569395683

95694-
<li><p>If the <code>Document</code>'s <span>origin</span> is not a scheme/host/port tuple, then
95695-
throw a <code>SecurityError</code> exception and abort these steps.</p></li>
95684+
<li><p>If the <code>Document</code>'s <span>origin</span> is not a <span
95685+
data-x="concept-origin-tuple">tuple</span>, then throw a <code>SecurityError</code> exception and
95686+
abort these steps.</p></li>
9569695687

9569795688
<li><p>Check to see if the user agent has allocated a local storage area for the
9569895689
<span>origin</span> of the <code>Document</code> of the <code>Window</code> object on which the

0 commit comments

Comments
 (0)