From b319de1d5e387a3e2fb170aa11f9cef2fefd6ef3 Mon Sep 17 00:00:00 2001 From: Domenic Denicola Date: Mon, 9 Aug 2021 18:05:39 -0400 Subject: [PATCH] Ensure PDF browsing contexts have no DOM Previously, the spec allowed either the "page load processing model for content that uses plugins" or the "page load processing model for inline content that doesn't have a DOM" to be used for PDFs. The observable difference was that plugin documents could be same-origin to their containing page, allowing the containing page to observe the element etc. Since 2/3 browsers choose the "no DOM" path, and that path is simpler, we make it the only allowed path. This also fixes a few bugs in the no-DOM processing model: * If it was reached for the PDF case, there was no check to disallow viewing the PDF in a sandboxed browsing context. * It was passing a null request to the Document creation algorithm, which was not allowed. * It would lose the history handling behavior, so it would not properly do replace navigations if requested. * It would lose the navigation id, so it would not properly signal the results to WebDriver BiDi. * It was missing a few other navigation params fields. --- source | 163 +++++++++++++++++++++++---------------------------------- 1 file changed, 66 insertions(+), 97 deletions(-) diff --git a/source b/source index 0d30dee88fe..1fd3747e037 100644 --- a/source +++ b/source @@ -86518,8 +86518,8 @@ interface Location { // but see also javascript" nor a fetch scheme

Run process a navigate URL scheme given resource's URL, browsingContext, and - hasTransientActivation.

+ data-x="concept-request-url">URL, browsingContext, navigationId, + historyHandling, and hasTransientActivation.

@@ -86785,7 +86785,10 @@ interface Location { // but see also id, navigationParams's history handling, and + hasTransientActivation.

  • Return.

    • @@ -86869,7 +86872,9 @@ interface Location { // but see also     Display the inline content with an appropriate error - shown to the user given browsingContext.

    + shown to the user given browsingContext, navigationParams's id, and navigationParams's history handling.

  • Run the environment discarding steps for navigationParams's Location { // but see also application/pdf"

    "text/pdf"
    -

    If the user agent's PDF viewer supported is true, then either follow the steps - given in the plugin section providing - navigationParams and type, or display - the inline content given browsingContext. Once the steps have completed, - return.

    - -

    See issue #6003 for - discussion on picking one of these two behaviors to standardize.

    +

    If navigationParams's final + sandboxing flag set does not have its sandboxed plugins browsing context + flag set, then display an appropriate error + message given browsingContext, navigationParams's id, and navigationParams's history handling.

    + +

    Otherwise, if the user agent's PDF viewer supported is true, then display the PDF inline in a viewer given + browsingContext, navigationParams's id, and navigationParams's history handling.

    Otherwise, proceed onward.

    @@ -86989,11 +86998,13 @@ interface Location { // but see also

    If, given type, the new resource is to be handled by - displaying some sort of inline content, e.g., a native rendering of the content or an error +

    • + data-x="navigate-ua-inline">display the inline content given browsingContext, + navigationParams's id, and + navigationParams's history handling, and + then return.

  • Otherwise, the document's type is such that the resource will not affect browsingContext, e.g., because the resource is to be handed to an external application @@ -87006,8 +87017,9 @@ interface Location { // but see also navigation id navigationId, a history handling + behavior historyHandling, and a boolean hasTransientActivation:

    1. If url is to be handled using a mechanism that does not affect @@ -87020,7 +87032,8 @@ interface Location { // but see also a registered handler for the given scheme. Display the - inline content given browsingContext.

      + inline content given browsingContext, navigationId, and + historyHandling.

      In the case of a registered handler being used, navigate will be invoked with a new URL.

      @@ -87788,98 +87801,54 @@ new PaymentRequest(…); // Allowed to use data-x="attr-media-autoplay">autoplay.

      -

      Page load processing model for content that uses plugins

      +

      Page load processing model for inline content that doesn't have a + DOM

      -

      When a resource that requires an external resource to be rendered is to be loaded, provided - navigation params navigationParams and a string type, the user - agent should: +

      When the user agent is to display a user agent page or PDF viewer inline, provided a + browsing context browsingContext, a navigation id navigationId, and a history handling + behavior historyHandling, the user agent should:

        -

      1. Let document be the result of creating and initializing a Document - object given "html", type, and - navigationParmas.

        2. - -

      2. Set document's mode - to "no-quirks".

        3. - -

      3. Mark document as being a plugin document

        4. - -

      4. Append an html element to document.

        5. - -

      5. Append a head element to the html element.

        6. - -

      6. Append a body element to the html element.

        7. - -

      7. Append an embed to the body element.

        8. - -

      8. Set the src attribute of the embed - element to the address of the resource.

        9. -
      - -

      The term plugin document is used by - Content Security Policy as part of the mechanism that ensures iframes - can't be used to evade plugin-types directives.

      - - - -

      Then, the user agent must act as if it had stopped - parsing.

      - -

      After creating the Document object, but potentially before the page has finished - fully loading, the user agent must update the session history with the new page given - navigationParams and the newly-created Document.

      - -

      User agents may add content to the head element of the Document, or - attributes to the embed element, e.g. to link to a style sheet or to give the - document a title.

      - -

      If the Document's active sandboxing - flag set has its sandboxed plugins browsing context flag set, the synthesized - embed element will fail to render the content if - the relevant plugin cannot be secured.

      - - -

      Page load processing model for inline - content that doesn't have a DOM

      - -

      When the user agent is to display a user agent page inline, provided a browsing - context browsingContext, the user agent should:

      - -
        -
      1. -

        Let navigationParams be a new navigation params whose request is null, response is null, origin is a new opaque origin, final sandboxing flag set is an empty set, cross-origin opener policy is a new cross-origin - opener policy, COOP enforcement - result is a new cross-origin opener policy - enforcement result, reserved environment is null, and browsing context is - browsingContext.

        - -

        The algorithm called in the next step is not prepared to deal with a null response. Probably we should synthesize one - instead.

        -
        2. +

      2. Let navigationParams be a new navigation params whose id is navigationId, request is null, response is a new response, origin + is a new opaque origin, policy container is a new policy + container, final sandboxing flag set + is an empty set, cross-origin opener policy is a + new cross-origin opener policy, COOP enforcement result is a new cross-origin opener policy enforcement result, reserved environment is null, browsing context is + browsingContext, history handling is + historyHandling, and has + cross-origin redirects is false.

      3. Let document be the result of creating and initializing a Document object given "html", "text/html", and navigationParams.

        4. -

      4. Set document's mode - to "no-quirks".

        5. -

      5. Either associate document with a custom rendering that is not rendered using the normal Document rendering rules, or mutate document until it represents the content the user agent wants to render.

      +

      Because we ensure the resulting Document's origin is opaque, and the resulting Document cannot run + script with access to the DOM, the existence and properties of this Document are not + observable to web developer code. This means that most of the above values, e.g. the + text/html type, do not matter. + Similarly, most of the items in navigationParams don't have any observable effect, + besides preventing the Document-creation + algorithm from getting confused, and so are set to default values.

      +

      Once the page has been set up, the user agent must act as if it had