Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add SecureContext limitation for [un]registerProtocolHandler API #5080

Merged
merged 5 commits into from
Nov 19, 2019
Merged

Add SecureContext limitation for [un]registerProtocolHandler API #5080

Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
85b7a7f
Introduce secure context requirement for Custom Handlers
Nov 7, 2019
5254b04
fix grammar error
Nov 7, 2019
250a652
Review feedback
Nov 14, 2019
75e9ff3
Further tweak language
Nov 14, 2019
f3cf42d
Replace "Leaking Intranet URLs" with "Leaking private data"
Nov 15, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix grammar error
  • Loading branch information
Eric Lawrence committed Nov 7, 2019
commit 5254b04522e8152e96d8c5795db9fcd13261c565
4 changes: 2 additions & 2 deletions source
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95210,8 +95210,8 @@ interface <dfn>Navigator</dfn> {
contain confidential information. For example, the URL could be <code
data-x="">web+print:https://corp.example.com/future-acquisitions/the-sample-company.egf</code>,
which might reveal to the 3rd party that Example Corporation is intending to acquire The Sample
annevk marked this conversation as resolved.
Show resolved Hide resolved
Company. Implementors might wish to consider allowing administrators to disable this custom
handlers for certain subdomains, content types, or schemes.</p>
Company. Implementors might wish to consider allowing administrators to disable custom handlers
on certain subdomains, content types, or schemes.</p>

<p><strong>Leaking credentials.</strong> User agents must never send username or password
information in the URLs that are escaped and included sent to the handler sites. User agents may
Expand Down