Skip to content

Commit

Permalink
Suborigin names can only start with letters.
Browse files Browse the repository at this point in the history
  • Loading branch information
@joelweinberger
joelweinberger committed Oct 26, 2016
1 parent 30eca4d commit d720f4e
Show file tree
Hide file tree
Showing 2 changed files with 35 additions and 20 deletions.
12 changes: 10 additions & 2 deletions index.bs
View file
Original file line number Diff line number Diff line change
Expand Up @@ -461,7 +461,7 @@ spec: XHR; urlPrefix: https://xhr.spec.whatwg.org/
grammar [[!RFC5234]]:

<pre dfn-type="grammar" link-type="grammar">
<dfn>suborigin-name</dfn> = 1*( <a>LOWERALPHA</a> / <a>DIGIT</a> / "-" )
<dfn>suborigin-name</dfn> = "'null'" / <a>LOWERALPHA</a> *( <a>LOWERALPHA</a> / <a>DIGIT</a> )
<dfn>suborigin-policy-option</dfn> = "'unsafe-postmessage-send'"
/ "'unsafe-postmessage-receive'"
/ "'unsafe-cookies'"
Expand All @@ -473,11 +473,19 @@ spec: XHR; urlPrefix: https://xhr.spec.whatwg.org/
User agents MUST ignore multiple suborigin headers and only apply the first.

A resource's <dfn>suborigin namespace</dfn> is the value of the
<a link-type="grammar">suborigin-name</a> in the `suborigin` header.
<a link-type="grammar">suborigin-name</a> in the `suborigin` header, unless
the <a link-type="grammar">suborigin-name</a> is `'null'`, in which case the
<a>suborigin namespace</a> is the empty string.

A resource's <dfn>suborigin policy</dfn> is the list of individual
<a link-type="grammar">suborigin-policy-option</a> values in the `suborigin`
header's <a link-type="grammar">suborigin-policy-list</a>.

Note: A <a link-type="grammar">suborigin-name</a> value of `'null'` is meant
to be equivalent to not including a suborigin header at all, other than to
indicate that suborigins are supported by the user agent and potentially
allowing the setting of a <a>suborigin policy</a>.

## Accessing the Suborigin in JavaScript ## {#suborigin-in-js}

A `suborigin` property is added to the <a>document</a> object which
Expand Down
43 changes: 25 additions & 18 deletions index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1797,7 +1797,7 @@ <h3 class="heading settled" data-level="3.6" id="the-suborigin-header"><span cla
<p>Suborigins are defined by a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport="" id="suborigin">suborigin</dfn> HTTP response header. The syntax
for the name and value of the header are described by the following ABNF
grammar <a data-link-type="biblio" href="#biblio-rfc5234">[RFC5234]</a>:</p>
<pre><dfn class="dfn-paneled" data-dfn-type="grammar" data-export="" id="grammardef-suborigin-name">suborigin-name</dfn> = 1*( <a data-link-type="grammar" href="#grammardef-loweralpha" id="ref-for-grammardef-loweralpha-1">LOWERALPHA</a> / <a data-link-type="grammar" href="https://tools.ietf.org/html/rfc5234#appendix-B.1">DIGIT</a> / "-" )
<pre><dfn class="dfn-paneled" data-dfn-type="grammar" data-export="" id="grammardef-suborigin-name">suborigin-name</dfn> = "'null'" / <a data-link-type="grammar" href="#grammardef-loweralpha" id="ref-for-grammardef-loweralpha-1">LOWERALPHA</a> *( <a data-link-type="grammar" href="#grammardef-loweralpha" id="ref-for-grammardef-loweralpha-2">LOWERALPHA</a> / <a data-link-type="grammar" href="https://tools.ietf.org/html/rfc5234#appendix-B.1">DIGIT</a> )
<dfn class="dfn-paneled" data-dfn-type="grammar" data-export="" id="grammardef-suborigin-policy-option">suborigin-policy-option</dfn> = "'unsafe-postmessage-send'"
/ "'unsafe-postmessage-receive'"
/ "'unsafe-cookies'"
Expand All @@ -1806,8 +1806,13 @@ <h3 class="heading settled" data-level="3.6" id="the-suborigin-header"><span cla
<dfn data-dfn-type="grammar" data-export="" id="grammardef-suborigin-header">suborigin-header<a class="self-link" href="#grammardef-suborigin-header"></a></dfn> = <a data-link-type="grammar" href="#grammardef-suborigin-name" id="ref-for-grammardef-suborigin-name-1">suborigin-name</a> [ <a data-link-type="grammar" href="#grammardef-suborigin-policy-list" id="ref-for-grammardef-suborigin-policy-list-1">suborigin-policy-list</a> ]
</pre>
<p>User agents MUST ignore multiple suborigin headers and only apply the first.</p>
<p>A resource’s <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport="" id="suborigin-namespace">suborigin namespace</dfn> is the value of the <a data-link-type="grammar" href="#grammardef-suborigin-name" id="ref-for-grammardef-suborigin-name-2">suborigin-name</a> in the <code>suborigin</code> header.</p>
<p>A resource’s <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport="" id="suborigin-namespace">suborigin namespace</dfn> is the value of the <a data-link-type="grammar" href="#grammardef-suborigin-name" id="ref-for-grammardef-suborigin-name-2">suborigin-name</a> in the <code>suborigin</code> header, unless
the <a data-link-type="grammar" href="#grammardef-suborigin-name" id="ref-for-grammardef-suborigin-name-3">suborigin-name</a> is <code>'null'</code>, in which case the <a data-link-type="dfn" href="#suborigin-namespace" id="ref-for-suborigin-namespace-5">suborigin namespace</a> is the empty string.</p>
<p>A resource’s <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport="" id="suborigin-policy">suborigin policy</dfn> is the list of individual <a data-link-type="grammar" href="#grammardef-suborigin-policy-option" id="ref-for-grammardef-suborigin-policy-option-2">suborigin-policy-option</a> values in the <code>suborigin</code> header’s <a data-link-type="grammar" href="#grammardef-suborigin-policy-list" id="ref-for-grammardef-suborigin-policy-list-2">suborigin-policy-list</a>.</p>
<p class="note" role="note">Note: A <a data-link-type="grammar" href="#grammardef-suborigin-name" id="ref-for-grammardef-suborigin-name-4">suborigin-name</a> value of <code>'null'</code> is meant
to be equivalent to not including a suborigin header at all, other than to
indicate that suborigins are supported by the user agent and potentially
allowing the setting of a <a data-link-type="dfn" href="#suborigin-policy" id="ref-for-suborigin-policy-1">suborigin policy</a>.</p>
<h3 class="heading settled" data-level="3.7" id="suborigin-in-js"><span class="secno">3.7. </span><span class="content">Accessing the Suborigin in JavaScript</span><a class="self-link" href="#suborigin-in-js"></a></h3>
<p>A <code>suborigin</code> property is added to the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document">document</a> object which <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-reflect">reflects</a> the value of the suborigin namespace for the current execution
context. If there is no suborigin namespace, the value should be undefined.</p>
Expand Down Expand Up @@ -1867,9 +1872,9 @@ <h3 class="heading settled" data-level="5.1" id="storage"><span class="secno">5.
<p>The storage APIs, such as <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/webstorage.html#dom-localstorage">localStorage</a></code> and <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/webstorage.html#dom-sessionstorage">sessionStorage</a></code>, are
accessible from within suborigins. By nature of their APIs, they are bound to
the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/#concept-origin">origin</a> of the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document">Document</a></code>, which has the practical effect of
giving a separate <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/webstorage.html#storage-2">Storage</a></code> object to each <a data-link-type="dfn" href="#suborigin-namespace" id="ref-for-suborigin-namespace-5">suborigin namespace</a>. Per
giving a separate <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/webstorage.html#storage-2">Storage</a></code> object to each <a data-link-type="dfn" href="#suborigin-namespace" id="ref-for-suborigin-namespace-6">suborigin namespace</a>. Per
the definitions in <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/webstorage.html#dom-localstorage">localStorage</a></code> and <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/webstorage.html#dom-sessionstorage">sessionStorage</a></code>, the user agent
MUST provide separate <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/webstorage.html#storage-2">Storage</a></code> objects per <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/#concept-origin">origin</a>, and thus per <a data-link-type="dfn" href="#suborigin-namespace" id="ref-for-suborigin-namespace-6">suborigin namespace</a>.</p>
MUST provide separate <code class="idl"><a data-link-type="idl" href="https://html.spec.whatwg.org/multipage/webstorage.html#storage-2">Storage</a></code> objects per <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/#concept-origin">origin</a>, and thus per <a data-link-type="dfn" href="#suborigin-namespace" id="ref-for-suborigin-namespace-7">suborigin namespace</a>.</p>
<h3 class="heading settled" data-level="5.2" id="document-domain"><span class="secno">5.2. </span><span class="content"><code>document.domain</code></span><a class="self-link" href="#document-domain"></a></h3>
<p>The <code class="idl"><a data-link-type="idl">document.domain</a></code> property
User agents MUST ignore modifications to the document.domain property of the
Expand Down Expand Up @@ -1907,7 +1912,7 @@ <h4 class="heading settled" data-level="6.1.2" id="origin-tuple"><span class="se
<li data-md="">
<p>A domain (null or a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain">domain</a>). Null unless stated otherwise.</p>
<li data-md="">
<p>A suborigin (a <a data-link-type="dfn" href="#suborigin-namespace" id="ref-for-suborigin-namespace-7">suborigin namespace</a>). The empty string unless stated
<p>A suborigin (a <a data-link-type="dfn" href="#suborigin-namespace" id="ref-for-suborigin-namespace-8">suborigin namespace</a>). The empty string unless stated
otherwise.</p>
</ul>
<h4 class="heading settled" data-level="6.1.3" id="physical-origin-concept"><span class="secno">6.1.3. </span><span class="content">Physical Origin</span><a class="self-link" href="#physical-origin-concept"></a></h4>
Expand Down Expand Up @@ -1993,7 +1998,7 @@ <h4 class="heading settled" data-level="6.2.1" id="cookies"><span class="secno">
management</a>:</p>
<ul>
<li data-md="">
<p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document">Document</a></code> who has a non-empty <a data-link-type="dfn" href="#suborigin-namespace" id="ref-for-suborigin-namespace-8">suborigin namespace</a>, unless the <a data-link-type="grammar" href="#grammardef-suborigin-policy-option" id="ref-for-grammardef-suborigin-policy-option-3">suborigin-policy-option</a> for the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document">Document</a></code>'s <a data-link-type="dfn" href="#suborigin-policy" id="ref-for-suborigin-policy-1">suborigin policy</a> contains the <a href="#unsafe-cookies">§6.3.3 'unsafe-cookies'</a> value.</p>
<p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document">Document</a></code> who has a non-empty <a data-link-type="dfn" href="#suborigin-namespace" id="ref-for-suborigin-namespace-9">suborigin namespace</a>, unless the <a data-link-type="grammar" href="#grammardef-suborigin-policy-option" id="ref-for-grammardef-suborigin-policy-option-3">suborigin-policy-option</a> for the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document">Document</a></code>'s <a data-link-type="dfn" href="#suborigin-policy" id="ref-for-suborigin-policy-2">suborigin policy</a> contains the <a href="#unsafe-cookies">§6.3.3 'unsafe-cookies'</a> value.</p>
</ul>
<p>Modify the paragraph following this list to read "scheme/host/port/suborigin
tuple" instead of "scheme/host/port tuple".</p>
Expand All @@ -2006,7 +2011,7 @@ <h4 class="heading settled" data-level="6.2.1" id="cookies"><span class="secno">
</ol>
<p class="note" role="note">Note: A <a data-link-type="dfn" href="http://www.w3.org/TR/html51/dom.html#cookie-averse">cookie-averse</a> <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document">Document</a></code> object has the property that direct
access to <code>document.cookie</code> returns the empty string, and assigning to <code>document.cookie</code> has no effect whatsoever. However, that network cookies are
not affected and documents with different <a data-link-type="dfn" href="#suborigin-namespace" id="ref-for-suborigin-namespace-9">suborigin namespaces</a> on the
not affected and documents with different <a data-link-type="dfn" href="#suborigin-namespace" id="ref-for-suborigin-namespace-10">suborigin namespaces</a> on the
same <a data-link-type="dfn" href="#physical-origin" id="ref-for-physical-origin-4">physical origin</a> share the same cookies on the network.</p>
<p class="note" role="note">Note: For practical purposes, this means that a developer cannot use <code>document.cookie</code> directly because assignment and reading of the object are both
no-ops. However, a <a data-link-type="dfn" href="http://www.w3.org/TR/html51/dom.html#cookie-averse">cookie-averse</a> <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document">Document</a></code> may
Expand All @@ -2015,12 +2020,12 @@ <h4 class="heading settled" data-level="6.2.1" id="cookies"><span class="secno">
<h3 class="heading settled" data-level="6.3" id="security-model-opt-outs"><span class="secno">6.3. </span><span class="content">Security Model Opt-Outs</span><a class="self-link" href="#security-model-opt-outs"></a></h3>
<p>For backwards compatibility, Suborigins provide several opt-opts from the
standard security model. A developer can choose to use these opt-outs by
specifying a <a data-link-type="dfn" href="#suborigin-policy" id="ref-for-suborigin-policy-2">suborigin policy</a> in <a href="#the-suborigin-header">the
specifying a <a data-link-type="dfn" href="#suborigin-policy" id="ref-for-suborigin-policy-3">suborigin policy</a> in <a href="#the-suborigin-header">the
suborigin header</a></p>
<p>Since these opt-outs weaken the security model of suborigins, developers SHOULD
NOT use these options unless they are required to make their application work.</p>
<p>The values of <a data-link-type="grammar" href="#grammardef-suborigin-policy-option" id="ref-for-grammardef-suborigin-policy-option-4">suborigin-policy-option</a> that may be
present in a <a data-link-type="dfn" href="#suborigin-policy" id="ref-for-suborigin-policy-3">suborigin policy</a> have the following effects:</p>
present in a <a data-link-type="dfn" href="#suborigin-policy" id="ref-for-suborigin-policy-4">suborigin policy</a> have the following effects:</p>
<h4 class="heading settled" data-level="6.3.1" id="unsafe-postmessage-receive"><span class="secno">6.3.1. </span><span class="content"><code>'unsafe-postmessage-receive'</code></span><a class="self-link" href="#unsafe-postmessage-receive"></a></h4>
When a message is sent <i>to</i> a
frame with a <code>postMessage</code> <code>target</code> of a serialized physical origin, but not
Expand Down Expand Up @@ -2060,7 +2065,7 @@ <h4 class="heading settled" data-level="6.3.2" id="unsafe-postmessage-send"><spa
</div>
<h4 class="heading settled" data-level="6.3.3" id="unsafe-cookies"><span class="secno">6.3.3. </span><span class="content"><code>'unsafe-cookies'</code></span><a class="self-link" href="#unsafe-cookies"></a></h4>
Normally, a <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document">Document</a></code> with a non-empty suborigin namespace is <a data-link-type="dfn" href="http://www.w3.org/TR/html51/dom.html#cookie-averse">cookie-averse</a>, which means that cookies cannot be read or written.
However, if the <a data-link-type="dfn" href="#suborigin-policy" id="ref-for-suborigin-policy-4">suborigin policy</a> contains the <code>unsafe-cookies</code> option,
However, if the <a data-link-type="dfn" href="#suborigin-policy" id="ref-for-suborigin-policy-5">suborigin policy</a> contains the <code>unsafe-cookies</code> option,
the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document">Document</a></code> is <em>not</em> made <a data-link-type="dfn" href="http://www.w3.org/TR/html51/dom.html#cookie-averse">cookie-averse</a>, which leaves
cookies readable and writable by the execution context. See <a href="#cookies">§6.2.1 Cookies</a> for
the precise definition of how this is defined.
Expand Down Expand Up @@ -2383,7 +2388,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
<aside class="dfn-panel" data-for="grammardef-loweralpha">
<b><a href="#grammardef-loweralpha">#grammardef-loweralpha</a></b><b>Referenced in:</b>
<ul>
<li><a href="#ref-for-grammardef-loweralpha-1">3.6. The suborigin header</a>
<li><a href="#ref-for-grammardef-loweralpha-1">3.6. The suborigin header</a> <a href="#ref-for-grammardef-loweralpha-2">(2)</a>
</ul>
</aside>
<aside class="dfn-panel" data-for="suborigin">
Expand All @@ -2395,7 +2400,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
<aside class="dfn-panel" data-for="grammardef-suborigin-name">
<b><a href="#grammardef-suborigin-name">#grammardef-suborigin-name</a></b><b>Referenced in:</b>
<ul>
<li><a href="#ref-for-grammardef-suborigin-name-1">3.6. The suborigin header</a> <a href="#ref-for-grammardef-suborigin-name-2">(2)</a>
<li><a href="#ref-for-grammardef-suborigin-name-1">3.6. The suborigin header</a> <a href="#ref-for-grammardef-suborigin-name-2">(2)</a> <a href="#ref-for-grammardef-suborigin-name-3">(3)</a> <a href="#ref-for-grammardef-suborigin-name-4">(4)</a>
</ul>
</aside>
<aside class="dfn-panel" data-for="grammardef-suborigin-policy-option">
Expand All @@ -2417,17 +2422,19 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
<ul>
<li><a href="#ref-for-suborigin-namespace-1">3. Defining a Suborigin</a> <a href="#ref-for-suborigin-namespace-2">(2)</a>
<li><a href="#ref-for-suborigin-namespace-3">3.4. Representation of Suborigins</a> <a href="#ref-for-suborigin-namespace-4">(2)</a>
<li><a href="#ref-for-suborigin-namespace-5">5.1. Storage</a> <a href="#ref-for-suborigin-namespace-6">(2)</a>
<li><a href="#ref-for-suborigin-namespace-7">6.1.2. Origin Tuple</a>
<li><a href="#ref-for-suborigin-namespace-8">6.2.1. Cookies</a> <a href="#ref-for-suborigin-namespace-9">(2)</a>
<li><a href="#ref-for-suborigin-namespace-5">3.6. The suborigin header</a>
<li><a href="#ref-for-suborigin-namespace-6">5.1. Storage</a> <a href="#ref-for-suborigin-namespace-7">(2)</a>
<li><a href="#ref-for-suborigin-namespace-8">6.1.2. Origin Tuple</a>
<li><a href="#ref-for-suborigin-namespace-9">6.2.1. Cookies</a> <a href="#ref-for-suborigin-namespace-10">(2)</a>
</ul>
</aside>
<aside class="dfn-panel" data-for="suborigin-policy">
<b><a href="#suborigin-policy">#suborigin-policy</a></b><b>Referenced in:</b>
<ul>
<li><a href="#ref-for-suborigin-policy-1">6.2.1. Cookies</a>
<li><a href="#ref-for-suborigin-policy-2">6.3. Security Model Opt-Outs</a> <a href="#ref-for-suborigin-policy-3">(2)</a>
<li><a href="#ref-for-suborigin-policy-4">6.3.3. 'unsafe-cookies'</a>
<li><a href="#ref-for-suborigin-policy-1">3.6. The suborigin header</a>
<li><a href="#ref-for-suborigin-policy-2">6.2.1. Cookies</a>
<li><a href="#ref-for-suborigin-policy-3">6.3. Security Model Opt-Outs</a> <a href="#ref-for-suborigin-policy-4">(2)</a>
<li><a href="#ref-for-suborigin-policy-5">6.3.3. 'unsafe-cookies'</a>
</ul>
</aside>
<aside class="dfn-panel" data-for="physical-origin">
Expand Down

0 comments on commit d720f4e

Please sign in to comment.