Skip to content

Perform a CSP check when consuming preloaded response #1411

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Mar 17, 2022
Merged

Perform a CSP check when consuming preloaded response #1411

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
67c5661
Perform a CSP check when consuming preloaded response
noamr Mar 10, 2022
304a867
Some fixes
noamr Mar 10, 2022
17161b5
Refactor preload to go through all the checks
noamr Mar 11, 2022
9cfbfe5
nit
noamr Mar 11, 2022
65c6225
Small refactor
noamr Mar 12, 2022
843808e
Switch order of 'pending' check
noamr Mar 16, 2022
9f48410
assert
noamr Mar 16, 2022
948fb73
typo
noamr Mar 16, 2022
808cb65
nits (biggest change here is correction of variable names)
annevk Mar 17, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 26 additions & 12 deletions fetch.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,6 +215,9 @@ lt="authentication entry">authentication entries</a> (for HTTP authentication).

<dt><dfn for="fetch params">timing info</dfn>
<dd>A <a for=/>fetch timing info</a>.

<dt><dfn export for="fetch params">preloaded response candidate</dfn> (default null)
<dd>Null, "<code>pending</code>", or a <a for=/>response</a>.
</dl>

<p>A <dfn export>fetch controller</dfn> is a <a for=/>struct</a> used to enable callers of
Expand Down Expand Up @@ -3892,17 +3895,19 @@ the request.
<a for="environment settings object">origin</a>.

<li><p>Let <var>onPreloadedResponseAvailable</var> be an algorithm that runs the following
step <a>in parallel</a> given a <a for=/>response</a> <var>response</var>: run
<a>fetch finale</a> given <var>response</var> and <var>fetchParams</var>.
step given a <a for=/>response</a> <var>response</var>: set <var>fetchParams</var>'s
<a for="fetch params">preloaded response candidate</a> to <var>response</var>.

<li><p>Let <var>foundPreloadedResource</var> be the result of invoking
<a>consume a preloaded resource</a> for <var>req</var>'s <a for=request>window</a>,
given <var>req</var>'s <a for=request>URL</a>, <var>req</var>'s <a for=request>destination</a>,
<var>req</var>'s <a for=request>mode</a>, <var>req</var>'s <a for=request>credentials mode</a>,
<var>req</var>'s <a for=request>integrity metadata</a>, and
<var>onPreloadedResponseAvailable</var>.

<li><p>If <var>foundPreloadedResource</var> is true, then return.
<a>consume a preloaded resource</a> for <var>request</var>'s <a for=request>window</a>, given
<var>request</var>'s <a for=request>URL</a>, <var>request</var>'s <a for=request>destination</a>,
<var>request</var>'s <a for=request>mode</a>, <var>request</var>'s
<a for=request>credentials mode</a>, <var>request</var>'s <a for=request>integrity metadata</a>,
and <var>onPreloadedResponseAvailable</var>.

<li><p>If <var>foundPreloadedResource</var> is true and <var>fetchParams</var>'s
<a for="fetch params">preloaded response candidate</a> is null, then set <var>fetchParams</var>'s
<a for="fetch params">preloaded response candidate</a> to "<code>pending</code>".
</ol>
</li>

Expand Down Expand Up @@ -4040,14 +4045,25 @@ steps:
corresponding to the first matching statement:

<dl class=switch>
<dt><var>fetchParams</var>'s <a for="fetch params">preloaded response candidate</a> is not null
<dd>
<ol>
<li><p>Wait until <var>fetchParams</var>'s
<a for="fetch params">preloaded response candidate</a> is not "<code>pending</code>".

<li><p><a for=/>Assert</a>: <var>fetchParams</var>'s
<a for="fetch params">preloaded response candidate</a> is a <a for=/>response</a>.

<li><p>Return <var>fetchParams</var>'s <a for="fetch params">preloaded response candidate</a>.
</ol>

<dt><var>request</var>'s <a for=request>current URL</a>'s <a for=url>origin</a> is
<a>same origin</a> with <var>request</var>'s <a for=request>origin</a>, and <var>request</var>'s
<a for=request>response tainting</a> is "<code>basic</code>"
<dt><var>request</var>'s <a for=request>current URL</a>'s <a for=url>scheme</a> is
"<code>data</code>"
<dt><var>request</var>'s <a for=request>mode</a> is
"<code>navigate</code>" or "<code>websocket</code>"

<dd>
<ol>
<li><p>Set <var>request</var>'s
Expand All @@ -4064,7 +4080,6 @@ steps:

<dt><var>request</var>'s <a for=request>mode</a> is
"<code>same-origin</code>"

<dd><p>Return a <a>network error</a>.

<dt><var>request</var>'s <a for=request>mode</a> is
Expand Down Expand Up @@ -4096,7 +4111,6 @@ steps:

<dt><var>request</var>'s <a for=request>current URL</a>'s <a for=url>scheme</a> is not an
<a>HTTP(S) scheme</a>

<dd><p>Return a <a>network error</a>.

<dt><var>request</var>'s <a>use-CORS-preflight flag</a> is set
Expand Down