Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make COOP+COEP do not imply crossOriginIsolated. #6098

Merged
merged 6 commits into from
Jan 6, 2021
Merged

Make COOP+COEP do not imply crossOriginIsolated. #6098

Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7480ee1
Make COOP+COEP do not imply crossOriginIsolated.
ArthurSonzogni Nov 18, 2020
075c677
Revert checking targetRealm for transfert SAB.
ArthurSonzogni Dec 15, 2020
b955b10
Editorial fixes
domenic Dec 17, 2020
f28344f
Consolidate a bit with "is origin-keyed"
domenic Dec 17, 2020
7f36cd8
Address annevk@ comments.
ArthurSonzogni Dec 19, 2020
9c2fd1f
wording nit
annevk Jan 4, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
144 changes: 102 additions & 42 deletions source
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8084,16 +8084,16 @@ interface <dfn>DOMStringList</dfn> {
<p>If ! <span>IsSharedArrayBuffer</span>(<var>value</var>) is true, then:

<ol>
<li><p>Let <var>agentCluster</var> be the <span>surrounding agent</span>'s
<span>agent cluster</span>.</p></li>

<li>
<p>If <var>agentCluster</var>'s <span>cross-origin isolated</span> is false, then throw a
<span>"<code>DataCloneError</code>"</span> <code>DOMException</code>.</p>
<p>If the <span>current settings object</span>'s <span
data-x="concept-settings-object-cross-origin-isolated-capability">cross-origin isolated
capability</span> is false, then throw a <span>"<code>DataCloneError</code>"</span>
<code>DOMException</code>.</p>
domenic marked this conversation as resolved.
Show resolved Hide resolved

<p class="note">This check is only needed when serializing (and not when deserializing) as
<span>cross-origin isolated</span> cannot change over time and a
<code>SharedArrayBuffer</code> cannot leave an <span>agent cluster</span>.</p>
the <span data-x="concept-settings-object-cross-origin-isolated-capability">cross-origin
isolated capability</span> cannot change over time and a <code>SharedArrayBuffer</code>
cannot leave an <span>agent cluster</span>.</p>
</li>

<li><p>If <var>forStorage</var> is true, then throw a
Expand Down Expand Up @@ -77983,9 +77983,6 @@ console.assert(iframeWindow.frameElement === null);
keys</span> to <span data-x="agent cluster">agent clusters</span>). User agents are responsible
for collecting agent clusters when it is deemed that nothing can access them anymore.</p>

<p>A <span>browsing context group</span> has a <dfn data-x="bcg cross-origin
isolated">cross-origin isolated</dfn> boolean. It is initially false.</p>

<p>A <span>browsing context group</span> has an associated <dfn>historical agent cluster key
map</dfn>, which is a <span data-x="ordered map">map</span> of <span
data-x="origin">origins</span> to <span data-x="agent cluster key">agent cluster keys</span>. This
Expand All @@ -77996,6 +77993,41 @@ console.assert(iframeWindow.frameElement === null);
<p class="note">The <span>historical agent cluster key map</span> only ever gains entries over the
lifetime of the browsing context group.</p>

<p>A <span>browsing context group</span> has a <dfn
domenic marked this conversation as resolved.
Show resolved Hide resolved
data-x="bcg-cross-origin-isolation">cross-origin isolation mode</dfn>, which is a
<span>cross-origin isolation mode</span>. It is initially "<code
data-x="cross-origin-isolation-none">none</code>".</p>

<p>A <dfn>cross-origin isolation mode</dfn> is one of three possible values: "<dfn><code
data-x="cross-origin-isolation-none">none</code></dfn>", "<dfn><code
data-x="cross-origin-isolation-logical">logical</code></dfn>", or "<dfn><code
data-x="cross-origin-isolation-concrete">concrete</code></dfn>".</p>

<div class="note">
<p>"<code data-x="cross-origin-isolation-logical">logical</code>" and "<code
data-x="cross-origin-isolation-concrete">concrete</code>" are similar. They are both used for
<span data-x="browsing context group">browsing context groups</span> where:</p>

<ul>
<li><p>every top-level <span>Document</span> has `<code data-x=""><span
data-x="http-cross-origin-opener-policy">Cross-Origin-Opener-Policy</span>: <span
data-x="coop-same-origin">same-origin</span></code>`, and</p></li>

<li><p>every <span>Document</span> has `<code
data-x=""><span>Cross-Origin-Embedder-Policy</span>: <span
data-x="coep-require-corp">require-corp</span></code>`.</p></li>
ArthurSonzogni marked this conversation as resolved.
Show resolved Hide resolved
</ul>

<p>On some platforms, it is difficult to provide the security properties required to grant safe
access to the APIs gated by the <span
data-x="concept-settings-object-cross-origin-isolated-capability">cross-origin isolated
capability</span>. As a result, only "<code
data-x="cross-origin-isolation-concrete">concrete</code>" can grant access that capability.
"<code data-x="cross-origin-isolation-logical">logical</code>" is used on platform not supporting
this capability, where various restrictions imposed by cross-origin isolation will still apply,
but the capability is not granted.</p>
</div>
ArthurSonzogni marked this conversation as resolved.
Show resolved Hide resolved

<p>To <dfn data-x="creating a new browsing context group">create a new browsing context
group</dfn>, run these steps:</p>

Expand Down Expand Up @@ -79644,11 +79676,18 @@ interface <dfn>BarProp</dfn> {

<dt>The <span data-x="concept-settings-object-cross-origin-isolated-capability">cross-origin
isolated capability</span></dt>
<dd><p>Return the logical conjunction of <var>realm</var>'s <span>agent cluster</span>'s
<span>cross-origin isolated</span> and whether <var>window</var>'s <span
data-x="concept-document-window">associated <code>Document</code></span> is <span>allowed to
use</span> the "<code data-x="cross-origin-isolated-feature">cross-origin-isolated</code>"
feature.</p></dd>
<dd>
<p>Return true if both of the following hold, and false otherwise:</p>
<ol>
<li><p><var>realm</var>'s <span>agent cluster</span>'s <span
data-x="agent-cluster-cross-origin-isolation">cross-origin-isolation mode</span> is "<code
data-x="cross-origin-isolation-concrete">concrete</code>", and</p></li>

<li><p><var>window</var>'s <span data-x="concept-document-window">associated
<code>Document</code></span> is <span>allowed to use</span> the "<code
data-x="cross-origin-isolated-feature">cross-origin-isolated</code>" feature.</p></li>
</ol>
</dd>
</dl>
</li>

Expand Down Expand Up @@ -80423,9 +80462,6 @@ interface <dfn>BarProp</dfn> {
a registrable domain suffix of and is not equal to</span> <var>effectiveDomain</var>, then throw
a <span>"<code>SecurityError</code>"</span> <code>DOMException</code>.</p></li>

<li><p>If the <span>surrounding agent</span>'s <span>agent cluster</span>'s <span>cross-origin
isolated</span> is true, then return.</p></li>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this removed? Is it redundant with is origin-keyed now?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, exactly. Another thing to spell out in the commit message.


<li><p>If the <span>surrounding agent</span>'s <span>agent cluster</span>'s <span>is
origin-keyed</span> is true, then return.</p></li>

Expand Down Expand Up @@ -80533,10 +80569,11 @@ interface <dfn>BarProp</dfn> {
and the <code data-x="dom-originAgentCluster">originAgentCluster</code> getter will always return
true.</p>

<p class="note">Similarly, <code>Document</code>s in a <span>cross-origin isolated</span>
<span>agent cluster</span> are automatically origin-keyed. The `<code
data-x="http-origin-agent-cluster">Origin-Agent-Cluster</code>` header might be useful as an
additional hint to implementations about resource allocation, since the `<code
<p class="note">Similarly, <code>Document</code>s whose <span>agent cluster</span>'s
<span data-x="agent-cluster-cross-origin-isolation">cross-origin isolation mode</span> is not
"<code data-x="cross-origin-isolation-none">none</code>" are automatically origin-keyed. The
`<code data-x="http-origin-agent-cluster">Origin-Agent-Cluster</code>` header might be useful as
an additional hint to implementations about resource allocation, since the `<code
data-x="http-cross-origin-opener-policy">Cross-Origin-Opener-Policy</code>` and
`<code>Cross-Origin-Embedder-Policy</code>` headers used to achieve cross-origin isolation are
more about ensuring that everything in the same address space opts in to being there. But adding
Expand Down Expand Up @@ -80900,8 +80937,9 @@ interface <dfn>BarProp</dfn> {
<dd>
<p>This behaves the same as "<code data-x="coop-same-origin">same-origin</code>", with the
addition that it sets the (new) <span>top-level browsing context</span>'s <span data-x="tlbc
group">group</span>'s <span data-x="bcg cross-origin isolated">cross-origin isolated</span> to
true.</p>
group">group</span>'s <span data-x="bcg-cross-origin-isolation">cross-origin isolation
mode</span> to one of "<code data-x="cross-origin-isolation-logical">logical</code>" or "<code
data-x="cross-origin-isolation-concrete">concrete</code>".</p>

<p class="note">"<code data-x="coop-same-origin-plus-COEP">same-origin-plus-COEP</code>" cannot
be directly set via the `<code
Expand Down Expand Up @@ -81308,10 +81346,22 @@ interface <dfn>BarProp</dfn> {
<li><p>Let <var>newBrowsingContext</var> be the result of <span>creating a new top-level browsing
context</span>.</p></li>

<li><p>If <var>navigationCOOP</var>'s <span data-x="coop-struct-value">value</span> is "<code
data-x="coop-same-origin-plus-COEP">same-origin-plus-COEP</code>", then set
<var>newBrowsingContext</var>'s <span data-x="tlbc group">group</span>'s <span data-x="bcg
cross-origin isolated">cross-origin isolated</span> to true.</p></li>
<li>
<p>If <var>navigationCOOP</var>'s <span data-x="coop-struct-value">value</span> is "<code
data-x="coop-same-origin-plus-COEP">same-origin-plus-COEP</code>", then set
<var>newBrowsingContext</var>'s <span data-x="tlbc group">group</span>'s <span
data-x="bcg-cross-origin-isolation">cross-origin isolation mode</span> to either "<code
data-x="cross-origin-isolation-logical">logical</code>" or "<code
data-x="cross-origin-isolation-concrete">concrete</code>". The choice of which is
<span>implementation-defined</span>.</p>

<p class="note">It is difficult on some platforms to provide the security properties required by
the <span data-x="concept-settings-object-cross-origin-isolated-capability">cross-origin
isolated capability</span>. Only "<code
data-x="cross-origin-isolation-concrete">concrete</code>" might grant access to it. "<code
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s/might/will/

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using "might" was intentional. This also depends on the feature policy bit.

For instance: BCG cross-origin-isolation-concrete + document using Feature-Policy: cross-origin-isolated 'none' won't grant the window.crossOriginIsolated bit.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In my last patchset. I used can. It sounds less confusing than might, and more precise than will.

data-x="cross-origin-isolation-logical">logical</code>" won't, and is used by implementations on
other platforms.</p>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This other is weird, since we already started with some platforms that might use "logical".

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree. I removed ,and is used by implementations on other platforms.

</li>

<li>
<p>If <var>sandboxFlags</var> is not empty, then:</p>
Expand Down Expand Up @@ -86741,8 +86791,8 @@ interface <dfn>BeforeUnloadEvent</dfn> : <span>Event</span> {
<p>Contains various <code>Window</code> objects which can potentially reach each other, either
directly or by using <code data-x="dom-document-domain">document.domain</code>.</p>

<p>If the encompassing <span>agent cluster</span>'s <span>cross-origin isolated</span> is true,
then all the <code>Window</code> objects will be <span>same origin</span>, can reach each other
<p>If the encompassing <span>agent cluster</span>'s <span>is origin-keyed</span> is true, then
all the <code>Window</code> objects will be <span>same origin</span>, can reach each other
directly, and <code data-x="dom-document-domain">document.domain</code> will no-op.</p>

<p class="note">Two <code>Window</code> objects that are <span>same origin</span> can be in
Expand Down Expand Up @@ -86825,8 +86875,10 @@ interface <dfn>BeforeUnloadEvent</dfn> : <span>Event</span> {

<div w-nodev>

<p>An <span>agent cluster</span> has an associated <dfn>cross-origin isolated</dfn> (a boolean),
which is initially false.</p>
<p>An <span>agent cluster</span> has an associated <dfn
data-x="agent-cluster-cross-origin-isolation">cross-origin isolation mode</dfn>, which is a
<span>cross-origin isolation mode</span>. It is initially "<code
data-x="cross-origin-isolation-none">none</code>".</p>

<p>An <span>agent cluster</span> has an associated <dfn>is origin-keyed</dfn> (a boolean), which
is initially false.</p>
Expand Down Expand Up @@ -86854,8 +86906,9 @@ interface <dfn>BeforeUnloadEvent</dfn> : <span>Event</span> {

<li><p>Let <var>key</var> be <var>site</var>.</p></li>

<li><p>If <var>group</var>'s <span data-x="bcg cross-origin isolated">cross-origin
isolated</span> is true, then set <var>key</var> to <var>origin</var>.</p></li>
<li><p>If <var>group</var>'s <span data-x="bcg-cross-origin-isolation">cross-origin isolation
mode</span> is not "<code data-x="cross-origin-isolation-none">none</code>", then set
<var>key</var> to <var>origin</var>.</p></li>

<li><p>Otherwise, if <var>group</var>'s <span>historical agent cluster key
map</span>[<var>origin</var>] <span data-x="map exists">exists</span>, then set <var>key</var> to
Expand All @@ -86880,8 +86933,10 @@ interface <dfn>BeforeUnloadEvent</dfn> : <span>Event</span> {
<ol>
<li><p>Let <var>agentCluster</var> be a new <span>agent cluster</span>.</p></li>

<li><p>Set <var>agentCluster</var>'s <span>cross-origin isolated</span> to <var>group</var>'s
<span data-x="bcg cross-origin isolated">cross-origin isolated</span>.</p></li>
<li><p>Set <var>agentCluster</var>'s <span
data-x="agent-cluster-cross-origin-isolation">cross-origin isolation mode</span> to
<var>group</var>'s <span data-x="bcg-cross-origin-isolation">cross-origin isolation
mode</span>.</p></li>

<li><p>Set <var>agentCluster</var>'s <span>is origin-keyed</span> to true if <var>key</var>
equals <var>origin</var>; otherwise false.</p></li>
Expand Down Expand Up @@ -87262,8 +87317,9 @@ interface <dfn>BeforeUnloadEvent</dfn> : <span>Event</span> {
href="https://github.com/tc39/ecma262/issues/1357">tc39/ecma262#1357</a>.</span></p></li>

<li>
<p>If <var>agent</var>'s <span>agent cluster</span>'s <span>cross-origin isolated</span> is
false, then:</p>
<p>If <var>agent</var>'s <span>agent cluster</span>'s <span
data-x="agent-cluster-cross-origin-isolation">cross-origin isolation mode</span> is "<code
data-x="cross-origin-isolation-none">none</code>", then:</p>

<ol>
<li><p>Let <var>global</var> be <var>realm</var>'s <span data-x="concept-realm-global">global
Expand Down Expand Up @@ -99183,8 +99239,11 @@ interface <dfn>SharedWorkerGlobalScope</dfn> : <span>WorkerGlobalScope</span> {
<p>If <var>worker global scope</var>'s <span
data-x="concept-WorkerGlobalScope-embedder-policy">embedder policy</span> is "<code
data-x="coep-require-corp">require-corp</code>" and <var>is shared</var> is true, then set
<var>agent</var>'s <span>agent cluster</span>'s <span>cross-origin isolated</span> to
true.</p>
<var>agent</var>'s <span>agent cluster</span>'s <span
data-x="agent-cluster-cross-origin-isolation">cross-origin isolation mode</span> to "<code
data-x="cross-origin-isolation-logical">logical</code>" or "<code
data-x="cross-origin-isolation-concrete">concrete</code>". The one chosen is
<span>implementation-defined</span>.</p>

<p class="XXX">This really ought to be set when the agent cluster is created, which requires a
redesign of this section.</p>
Expand All @@ -99197,8 +99256,9 @@ interface <dfn>SharedWorkerGlobalScope</dfn> : <span>WorkerGlobalScope</span> {

<li><p>Set <var>worker global scope</var>'s <span
data-x="concept-WorkerGlobalScope-cross-origin-isolated-capability">cross-origin isolated
capability</span> to <var>agent</var>'s <span>agent cluster</span>'s <span>cross-origin
isolated</span>.</p></li>
capability</span> to true if <var>agent</var>'s <span>agent cluster</span>'s <span
data-x="agent-cluster-cross-origin-isolation">cross-origin isolation mode</span> is "<code
data-x="cross-origin-isolation-concrete">concrete</code>".</p></li>

<li><p>If <var>is shared</var> is false and <var>owner</var>'s <span
data-x="concept-settings-object-cross-origin-isolated-capability">cross-origin isolated
Expand Down