w3c / webappsec-mixed-content

WebAppSec Mixed Content
https://w3c.github.io/webappsec-mixed-content/
Other
12 stars 22 forks source link

Broken references in Mixed Content #61

Closed dontcallmedom-bot closed 1 year ago

dontcallmedom-bot commented 1 year ago

While crawling Mixed Content, the following links to other specifications were detected as pointing to non-existing anchors, which should be fixed:

This issue was detected and reported semi-automatically by Strudy based on data collected in webref.

carlosjoan91 commented 1 year ago

@domenic: This seems to be due to the responsible document concept being removed (in whatwg/html#7694). In this case the document was being used to traverse through embedding documents (starting from an environment settings object) and check if any of their origins was potentially trustworthy.

I'm thinking we can start the loop from the environment settings object's target browsing context (going through its active window's associated document) instead. Would this be equivalent?

domenic commented 1 year ago

It's simpler than that; no need to go through the browsing context. Just look at |settings|'s [=environment settings object/global object=]'s [=Window/associated Document=].

You should probably also remove the "embedding document" concept entirely, and just use https://html.spec.whatwg.org/multipage/document-sequences.html#ancestor-navigables + https://html.spec.whatwg.org/multipage/document-sequences.html#nav-document .

And... you can stop looking at document's relevant settings object's origin, and just look at document's origin instead. The relevant settings object's origin is defined to be the document's origin, so it's just kind of circular as-is :).

carlosjoan91 commented 1 year ago

Thanks for the suggestions, that helps a lot! I've sent #66 to fix this.