register() lacks same origin check

[annevk]

Am I missing something or does register() not perform a same origin check anywhere?

[mozfreddyb]

The "Start Register" algorithm has some checks in step 3 and 4:

• step 3 checks that scheme is http or https
• step 4 checks that the scriptURL's path doesn't contain "%2F" or "%5C".

The only invokation of Start Register is in ServiceWorkerContainer.register(), which does not apply any checks, just parsing in step 3.

P.S.: This issue filed was based on a question I had directed at @annevk based on folks requesting subresource integrity support for ServiceWorkers - which is providing most of its on cross-origin resources only.

[mkruisselbrink]

Start Register schedules a "Register" job, which ends up invoking https://w3c.github.io/ServiceWorker/#register-algorithm, which does do same origin checks in step 2 and 3 (the "referrer" is set to "client's creation URL" in the register() method.

This definitely could be cleaned up more to make it clearer. I remember there was a good reason for making this this complicated back when I spec'ed header-based installation, but that was a bad idea anyway. So probably it could be done much more straight forward.

[annevk]

Thanks, though note that it does not actually do a same origin check. It checks if A is B, not if A is same origin with B. Those are different checks.

[annevk]

What happens in case of a cross-origin redirect?

[wanderview]

Per step 5 of "perform the fetch" here:

https://w3c.github.io/ServiceWorker/#update-algorithm

The request.redirect mode is set to "error".

[annevk]

I see, but it's weird that "perform the fetch" isn't passed to the algorithm (or is an official optional parameter). @domenic that might be worth cleaning up.

[mfalken]

I moved this to whatwg/html#6339.

[mfalken]

I missed the comment here: #1518 (comment)

[mfalken]

Fixed in #1568