diff --git a/fetch.bs b/fetch.bs index 839376071..39971d6cc 100644 --- a/fetch.bs +++ b/fetch.bs @@ -16,7 +16,7 @@ Markup Shorthands: css off !Commits: @fetchstandard !Tests: web-platform-tests fetch/ (ongoing work) !Translation (non-normative): 日本語 -Translate IDs: typedefdef-bodyinit bodyinit,dictdef-requestinit requestinit,typedefdef-requestinfo requestinfo,enumdef-requesttype requesttype,enumdef-requestdestination requestdestination,enumdef-requestmode requestmode,enumdef-requestcredentials requestcredentials,enumdef-requestcache requestcache,enumdef-requestredirect requestredirect,dictdef-responseinit responseinit,enumdef-responsetype responsetype +Translate IDs: typedefdef-bodyinit bodyinit,dictdef-requestinit requestinit,typedefdef-requestinfo requestinfo,enumdef-requestdestination requestdestination,enumdef-requestmode requestmode,enumdef-requestcredentials requestcredentials,enumdef-requestcache requestcache,enumdef-requestredirect requestredirect,dictdef-responseinit responseinit,enumdef-responsetype responsetype @@ -782,17 +782,6 @@ the time being as other specifications do not require it to be. It is primarily specification device to assist defining CSP and Mixed Content. It is not exposed to JavaScript. [[!CSP]] [[!MIX]] -

A request has an associated -type, which is -the empty string, -"audio", -"font", -"image", -"script", -"style", -"track", or -"video". Unless stated otherwise it is the empty string. -

A request has an associated destination, which is the empty string, @@ -813,23 +802,33 @@ the empty string, "worker", or "xslt". Unless stated otherwise it is the empty string. + + +

A request's destination is +script-like if it is "script", +"serviceworker", "sharedworker", or "worker". + +

Algorithms that use script-like should also consider +"xslt" as that too can cause script execution. It is not included in the list as it is +not always relevant and might require different behavior. +

-

The following table illustrates the relationship between a - request's - initiator, - type, - destination, CSP directives, and features. +

The following table illustrates the relationship between a request's + initiator, destination, CSP directives, and features. - - - - - - -
Initiator - Type Destination CSP directive Features
"" - "" "report" ? CSP, NEL reports. @@ -855,24 +854,20 @@ the empty string, object-src HTML's <embed>
"audio" "audio" media-src HTML's <audio>
"font" "font" font-src CSS' @font-face
"image" "image" img-src HTML's <img src>, /favicon.ico resource, SVG's <image>, CSS' background-image, CSS' cursor, CSS' list-style-image, …
"script" "script" script-src HTML's <script>, importScripts() @@ -889,35 +884,29 @@ the empty string, child-src Worker
"style" "style" style-src HTML's <link rel=stylesheet>, CSS' @import
"track" "track" media-src HTML's <track>
"video" "video" media-src HTML's <video> element
"download" "" - "" ? HTML's download="", "Save Link As…" UI
"imageset" "image" - "image" img-src HTML's <img srcset> and <picture>
"manifest" - "" "manifest" manifest-src HTML's <link rel=manifest> @@ -1635,11 +1624,11 @@ run these steps:
  • Let mimeType be the result of extracting a MIME type from response's header list. -

  • Let type be request's type. +

  • Let destination be request's destination.

  • -

    If type is "script" and one of the following is true, then return - blocked: +

    If destination is script-like and one of the + following is true, then return blocked:

    • mimeType starts with `audio/`, `image/`, or @@ -2218,10 +2207,8 @@ Access-Control-Allow-Credentials: true

      The `X-Content-Type-Options` -response header can be used to require checking of a -response's `Content-Type` -header against the -type of a +response header can be used to require checking of a response's +`Content-Type` header against the destination of a request.

      Its value ABNF: @@ -2250,20 +2237,21 @@ X-Content-Type-Options = "nosniff" ; case-insensitive

    • Let mimeType be the result of extracting a MIME type from response's header list. -

    • Let type be request's type. +

    • Let destination be request's destination. -

    • If type is "script", and mimeType (ignoring parameters) - is not a JavaScript MIME type, then return blocked. +

    • If destination is script-like and + mimeType (ignoring parameters) is not a JavaScript MIME type, then return + blocked. -

    • If type is "style" and mimeType (ignoring parameters) is - not `text/css`, then return blocked. +

    • If destination is "style" and mimeType + (ignoring parameters) is not `text/css`, then return blocked.

    • Return allowed. -

      Only "script" and "style" are considered as any -exploits pertain to those types. Also, considering "image" was not -compatible with deployed content. +

      Only request destinations that are +script-like or "style" are considered as any exploits +pertain to them. Also, considering "image" was not compatible with deployed content. @@ -2334,7 +2322,7 @@ the request.

    • Otherwise, a user agent should set value to the first matching statement, if any, - switching on request's type: + switching on request's destination:

      @@ -2357,18 +2345,14 @@ the request. to request's header list.
    • -

      If request's priority is - null, use request's - initiator, - type, and - destination - appropriately in setting it to a user-agent-defined object. +

      If request's priority is null, then use request's + initiator and destination appropriately in setting + request's priority to a user-agent-defined object.

      The user-agent-defined object could encompass stream weight and dependency for HTTP/2, and equivalent information used to prioritize dispatch and processing of HTTP/1 fetches. -

    • If request is a navigation request, a user agent should, for each header name (hintName) in the first column of the @@ -3853,8 +3837,6 @@ steps: current url, initiator is request's initiator, - type is request's - type, destination is request's destination, origin is request's @@ -4688,7 +4670,6 @@ interface Request { readonly attribute USVString url; [SameObject] readonly attribute Headers headers; - readonly attribute RequestType type; readonly attribute RequestDestination destination; readonly attribute USVString referrer; readonly attribute ReferrerPolicy referrerPolicy; @@ -4717,7 +4698,6 @@ dictionary RequestInit { any window; // can only be set to null }; -enum RequestType { "", "audio", "font", "image", "script", "style", "track", "video" }; enum RequestDestination { "", "audio", "document", "embed", "font", "image", "manifest", "object", "report", "script", "serviceworker", "sharedworker", "style", "track", "video", "worker", "xslt" }; enum RequestMode { "navigate", "same-origin", "no-cors", "cors" }; enum RequestCredentials { "omit", "same-origin", "include" }; @@ -5079,10 +5059,6 @@ return request's

      The headers attribute's getter must return the associated headers. -

      The type attribute's getter must return -request's -type. -

      The destination attribute's getter must return request's destination.