Skip to content

Wildcards in Permissions Policy Origins #482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 18 commits into from
Closed

Wildcards in Permissions Policy Origins #482

Changes from 4 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
003d9f4
Wildcards in Permissions Policy Origins
arichiv Aug 17, 2022
95dd38a
Update index.bs
arichiv Aug 29, 2022
3d32a4b
Update index.bs
arichiv Aug 29, 2022
a0c3f34
Update index.bs
arichiv Aug 29, 2022
2e1edfa
Update index.bs
arichiv Aug 30, 2022
4f863dc
Update index.bs
arichiv Aug 30, 2022
8d8904e
Update index.bs
arichiv Aug 30, 2022
5b37685
Update index.bs
arichiv Aug 31, 2022
8421b5a
Update index.bs
arichiv Aug 31, 2022
5b4453a
Update index.bs
arichiv Sep 15, 2022
947f92c
Update index.bs
arichiv Sep 15, 2022
fe2d861
Update index.bs
arichiv Sep 15, 2022
c20a0d7
Update index.bs
arichiv Oct 4, 2022
3974fac
Update index.bs
arichiv Oct 5, 2022
af420af
Update index.bs
arichiv Oct 5, 2022
f40a6e8
Update index.bs
arichiv Oct 5, 2022
2a48716
Merge branch 'w3c:main' into patch-1
arichiv Oct 5, 2022
7f4572c
Update index.bs
arichiv Oct 5, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 26 additions & 3 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,8 +297,28 @@ spec: HEADER-STRUCTURE; urlPrefix: https://httpwg.org/http-extensions/draft-ietf
then return true.</li>
<li>Otherwise, for each <var>item</var> in the <a>allowlist</a>:
<ol>
<li>If <var>item</var> is [=same origin-domain=] with
<var>origin</var>, then return true.</li>
<li>If <var>item</var> is a <a>serialized-origin</a> that's [=same origin-domain=]
with <var>origin</var>, then return true.</li>
<li>Else if <var>item</var> is a <a>serialized-origin-with-wildcard-subdomain</a>
then:</li>
<ol>
<li>If <var>origin</var> does not have a host with a <a>registrable domain</a>
return false.<li>
<li>Set <var>originWithoutWildcard</var> to be <var>item</var> without the "*."
at the start of the host.</li>
<li>If <var>originWithoutWildcard</var> is [=same origin-domain=] </li> with
<var>origin</var>, then return false.</li>
<li>Set <var>originCandidate</var> to be equal to <var>origin</var> with the
left most domain label (and the dot after it) removed.</li>
<li>While <var>originCandidate</var> has a host with a <a>registrable domain</a>:</li>
<ol>
<li>If <var>originWithoutWildcard</var> is [=same origin-domain=] </li> with
<var>originCandidate</var>, then return true.</li>
<li>Set <var>originCandidate</var> to be equal to <var>originCandidate</var> with
the left most domain label (and the dot after it) removed.</li>
</ol>
<li>return false.</li>
</ol>
</ol>
</li>
<li>return false.</li>
Expand Down Expand Up @@ -338,13 +358,16 @@ spec: HEADER-STRUCTURE; urlPrefix: https://httpwg.org/http-extensions/draft-ietf
<dfn>serialized-policy-directive</dfn> = <a>feature-identifier</a> RWS <a>allow-list</a>
<dfn>feature-identifier</dfn> = 1*( ALPHA / DIGIT / "-")
<dfn>allow-list</dfn> = <a>allow-list-value</a> *(RWS <a>allow-list-value</a>)
<dfn>allow-list-value</dfn> = <a>serialized-origin</a> / "*" / "'self'" / "'src'" / "'none'"
<dfn>allow-list-value</dfn> = <a>serialized-origin</a> / <a>serialized-origin-with-wildcard-subdomain</a> / "*" / "'self'" / "'src'" / "'none'"
</pre>
<p><dfn><code>serialized-origin</code></dfn> is the
<a>serialization of an origin</a>. However, the code points U+0027 ('),
U+0021 (*), U+002C (,) and U+003B (;) MUST NOT appear in the serialization.
If they are required, they must be percent-encoded as "`%27`", "`%2A`",
"`%2C`" or "`%3B`", respectively.</p>
<p><dfn><code>serialized-origin-with-wildcard-subdomain</code></dfn> is a serialization of an
<a>origin</a> whose host is a domain which is the concatenation of the string "*." and a
domain which has a non-null <a>registrable domain</a>.</p>
<div class="note">
The string "<code>'self'</code>" may be used as an origin in an allowlist.
When it is used in this way, it will refer to the origin of the document
Expand Down