Skip to content

Commit 3ca842b

Browse files
juliandescottesjuliandescottes
committed
Address review comments
1 parent d57a738 commit 3ca842b

1 file changed

Lines changed: 55 additions & 68 deletions

File tree

‎index.bs‎

Lines changed: 55 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -1003,35 +1003,6 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
10031003
documents are the normative references which ought to be consulted for
10041004
detailed information.
10051005

1006-
<h3 id="webdriver-bidi-integration">
1007-
Integration with WebDriver BiDi
1008-
</h3>
1009-
1010-
<dfn export>WebDriver BiDi CSP bypass is enabled</dfn> is an algorithm defined
1011-
by [[WEBDRIVER-BIDI]] that takes a <a>navigable</a> as input and returns a boolean.
1012-
When this algorithm returns true for a given navigable, Content Security Policy
1013-
enforcement is bypassed for that navigable's active document and its nested
1014-
navigables.
1015-
1016-
Note: This integration point allows WebDriver BiDi to disable CSP enforcement
1017-
during automated testing, similar to Chrome DevTools Protocol's Page.setBypassCSP.
1018-
1019-
<h4 id="obtain-navigable-for-request" algorithm dfn>
1020-
Obtain the navigable for a request
1021-
</h4>
1022-
1023-
Given a <a for="/">request</a> |request|, this algorithm returns a <a>navigable</a> or null.
1024-
1025-
1. Let |navigable| be null.
1026-
1027-
2. If |request|'s [=request/client=] is an [=environment settings object=]:
1028-
1029-
1. Let |environment settings| be |request|'s [=request/client=].
1030-
1031-
2. If there is a [=navigable=] whose [=navigable/active window=] is |environment settings|' [=environment settings object/global object=], set |navigable| to be that [=navigable=].
1032-
1033-
3. Return |navigable|.
1034-
10351006
<h3 id="fetch-integration">
10361007
Integration with Fetch
10371008
</h3>
@@ -1083,15 +1054,13 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
10831054
reports violations based on |request|'s [=request/policy container=]'s
10841055
[=policy container/CSP list=].
10851056

1086-
1. Let |navigable| be the result of [[#obtain-navigable-for-request]] given |request|.
1087-
1088-
2. If |navigable| is not null and [=WebDriver BiDi CSP bypass is enabled=] given |navigable| is true, return "`Allowed`".
1057+
1. If [[#csp-enforcement-disabled-for-request]] given |request| is true, return "`Allowed`".
10891058

1090-
3. Let |CSP list| be |request|'s [=request/policy container=]'s [=policy container/CSP list=].
1059+
2. Let |CSP list| be |request|'s [=request/policy container=]'s [=policy container/CSP list=].
10911060

1092-
4. Let |result| be "`Allowed`".
1061+
3. Let |result| be "`Allowed`".
10931062

1094-
5. <a for=list>For each</a> |policy| of |CSP list|'s [=CSP list/policies=]:
1063+
4. <a for=list>For each</a> |policy| of |CSP list|'s [=CSP list/policies=]:
10951064

10961065
1. If |policy|'s <a for="policy">disposition</a> is "`report`",
10971066
then skip to the next |policy|.
@@ -1107,7 +1076,7 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
11071076

11081077
2. Set |result| to "`Blocked`".
11091078

1110-
6. Return |result|.
1079+
5. Return |result|.
11111080

11121081
<h4 id="should-block-response" algorithm dfn export>
11131082
Should |response| to |request| be blocked by Content Security Policy?
@@ -1117,15 +1086,13 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
11171086
returns `Blocked` or `Allowed`, and reports violations based on |request|'s
11181087
[=request/policy container=]'s [=policy container/CSP list=].
11191088

1120-
1. Let |navigable| be the result of [[#obtain-navigable-for-request]] given |request|.
1121-
1122-
2. If |navigable| is not null and [=WebDriver BiDi CSP bypass is enabled=] given |navigable| is true, return "`Allowed`".
1089+
1. If [[#csp-enforcement-disabled-for-request]] given |request| is true, return "`Allowed`".
11231090

1124-
3. Let |CSP list| be |request|'s [=request/policy container=]'s [=policy container/CSP list=].
1091+
2. Let |CSP list| be |request|'s [=request/policy container=]'s [=policy container/CSP list=].
11251092

1126-
4. Let |result| be "`Allowed`".
1093+
3. Let |result| be "`Allowed`".
11271094

1128-
5. <a for=list>For each</a> |policy| of |CSP list|'s [=CSP list/policies=]:
1095+
4. <a for=list>For each</a> |policy| of |CSP list|'s [=CSP list/policies=]:
11291096

11301097
1. <a for=set>For each</a> |directive| of |policy|:
11311098

@@ -1144,7 +1111,7 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
11441111
response. That is, that a Service Worker hasn't substituted a file which
11451112
would violate the page's CSP.
11461113

1147-
6. Return |result|.
1114+
5. Return |result|.
11481115

11491116
<h4 id="potentially-report-hash" algorithm dfn export>Potentially report hash</h4>
11501117

@@ -1246,11 +1213,9 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
12461213
Given a {{Document}} |document|, the user agent performs the following
12471214
steps in order to initialize CSP for |document|:
12481215

1249-
1. Let |navigable| be |document|'s [=/node navigable=].
1216+
1. If |document|'s [=/node navigable=] is not null and [=WebDriver BiDi CSP bypass is enabled=] given |document|'s [=/node navigable=] is true, then set |document|'s [=Document/policy container=]'s [=policy container/CSP list=] to an empty list.
12501217

1251-
2. If |navigable| is not null and [=WebDriver BiDi CSP bypass is enabled=] given |navigable| is true, then set |document|'s [=Document/policy container=]'s [=policy container/CSP list=] to an empty list.
1252-
1253-
3. <a for=list>For each</a> |policy| of |document|'s [=Document/policy container=]'s
1218+
2. <a for=list>For each</a> |policy| of |document|'s [=Document/policy container=]'s
12541219
[=policy container/CSP list=]:
12551220

12561221
1. <a for=set>For each</a> |directive| of |policy|:
@@ -1289,13 +1254,11 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
12891254
<ol class="algorithm">
12901255
1. Assert: |element| is not null.
12911256

1292-
2. Let |navigable| be |element|'s [=/node navigable=].
1293-
1294-
3. If |navigable| is not null and [=WebDriver BiDi CSP bypass is enabled=] given |navigable| is true, return "`Allowed`".
1257+
2. If |element|'s [=/node navigable=] is not null and [=WebDriver BiDi CSP bypass is enabled=] given |element|'s [=/node navigable=] is true, return "`Allowed`".
12951258

1296-
4. Let |result| be "`Allowed`".
1259+
3. Let |result| be "`Allowed`".
12971260

1298-
5. <a for=list>For each</a> |policy| of |element|'s {{Document}}'s <a for="/">global object</a>'s
1261+
4. <a for=list>For each</a> |policy| of |element|'s {{Document}}'s <a for="/">global object</a>'s
12991262
<a for="global object">CSP list</a>'s [=CSP list/policies=]:
13001263

13011264
1. <a for=set>For each</a> |directive| of |policy|'s <a for="policy">directive set</a>:
@@ -1326,7 +1289,7 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
13261289
8. If |policy|'s <a for="policy">disposition</a> is "`enforce`", then
13271290
set |result| to "`Blocked`".
13281291

1329-
6. Return |result|.
1292+
5. Return |result|.
13301293
</ol>
13311294

13321295
<h4 id="should-block-navigation-request" algorithm dfn export>
@@ -1339,17 +1302,15 @@ spec:SRI; urlPrefix: https://w3c.github.io/webappsec-subresource-integrity
13391302
the navigation, and "`Allowed`" otherwise:
13401303

13411304
<ol class="algorithm">
1342-
1. Let |navigable| be the result of [[#obtain-navigable-for-request]] given |navigation request|.
1343-
1344-
2. If |navigable| is not null and [=WebDriver BiDi CSP bypass is enabled=] given |navigable| is true, return "`Allowed`".
1305+
1. If [[#csp-enforcement-disabled-for-request]] given |navigation request| is true, return "`Allowed`".
13451306

1346-
3. Let |result| be "`Allowed`".
1307+
2. Let |result| be "`Allowed`".
13471308

1348-
4. Let |CSP list| be |navigation request|'s <a for="request">policy
1309+
3. Let |CSP list| be |navigation request|'s <a for="request">policy
13491310
container</a>'s <a for="policy container">CSP list</a>'s [=CSP
13501311
list/policies=].
13511312

1352-
5. <a for=list>For each</a> |policy| of |CSP list|'s [=CSP list/policies=]:
1313+
4. <a for=list>For each</a> |policy| of |CSP list|'s [=CSP list/policies=]:
13531314

13541315
1. <a for=set>For each</a> |directive| of |policy|:
13551316

@@ -1682,6 +1643,35 @@ this algorithm returns normally if compilation is allowed, and throws a
16821643

16831644
4. If |result| is "`Blocked`", throw a {{WebAssembly.CompileError}} exception.
16841645

1646+
<h3 id="webdriver-bidi-integration">
1647+
Integration with WebDriver BiDi
1648+
</h3>
1649+
1650+
<dfn export>WebDriver BiDi CSP bypass is enabled</dfn> is an algorithm defined
1651+
by [[WEBDRIVER-BIDI]] that takes a <a>navigable</a> as input and returns a boolean.
1652+
When this algorithm returns true for a given navigable, Content Security Policy
1653+
enforcement is disabled for that navigable's active document and its nested
1654+
navigables.
1655+
1656+
Note: This integration point allows WebDriver BiDi clients to optionally
1657+
disable CSP enforcement during automated testing, but this is not the default
1658+
behavior.
1659+
1660+
<h4 id="csp-enforcement-disabled-for-request" algorithm dfn>
1661+
Is CSP enforcement disabled for |request|?
1662+
</h4>
1663+
1664+
Given a <a for="/">request</a> |request|, this algorithm returns true if
1665+
[=WebDriver BiDi CSP bypass is enabled=] applies to |request|, and false otherwise.
1666+
1667+
1. If |request|'s [=request/client=] is an [=environment settings object=]:
1668+
1669+
1. Let |environment settings| be |request|'s [=request/client=].
1670+
1671+
2. If there is a [=navigable=] whose [=navigable/active window=] is |environment settings|'s [=environment settings object/global object=] and [=WebDriver BiDi CSP bypass is enabled=] given that [=navigable=] is true, return true.
1672+
1673+
2. Return false.
1674+
16851675
</section>
16861676

16871677
<!-- Big Text: Reporting -->
@@ -3960,25 +3950,22 @@ Content-Type: application/reports+json
39603950
<a>directive</a> if the request violates the policy, and "`Does Not Violate`"
39613951
otherwise.
39623952

3963-
1. Let |navigable| be the result of [[#obtain-navigable-for-request]] given |request|.
3964-
3965-
2. If |navigable| is not null and [=WebDriver BiDi CSP bypass is enabled=] given |navigable| is true, return "`Does Not Violate`".
3953+
1. If [[#csp-enforcement-disabled-for-request]] given |request| is true, return "`Does Not Violate`".
39663954

3967-
3. If |request|'s [=request/initiator=] is "`prefetch`", then return the
3968-
result of executing [[#does-resource-hint-violate-policy]] on |request|,
3969-
|policy|, and |self-origin|.
3955+
2. If |request|'s [=request/initiator=] is "`prefetch`", then return the result of executing
3956+
[[#does-resource-hint-violate-policy]] on |request| and |policy|.
39703957

3971-
4. Let |violates| be "`Does Not Violate`".
3958+
3. Let |violates| be "`Does Not Violate`".
39723959

3973-
5. <a for=set>For each</a> |directive| of |policy|:
3960+
4. <a for=set>For each</a> |directive| of |policy|:
39743961

39753962
1. Let |result| be the result of executing |directive|'s <a
39763963
for="directive">pre-request check</a> on |request|, |policy|, and
39773964
|self-origin|.
39783965

39793966
2. If |result| is "`Blocked`", then let |violates| be |directive|.
39803967

3981-
6. Return |violates|.
3968+
5. Return |violates|.
39823969

39833970
<h5 id="does-resource-hint-violate-policy">
39843971
Does resource hint |request| violate |policy|?

0 commit comments

Comments
 (0)