Treat 'data:' documents as unique, opaque origins (whatwg#1756)

mikewest · foolip · commit 00769464e801 · 2016-09-13T11:20:33.000+02:00
This patch changes the handling of 'data:' URLs to which user agents navigate. Rather than inheriting the origin of the settings object responsible for the navigation, they will be treated as unique, opaque origins. This aligns the spec with the behavior found in Chrome, Safari, Opera, and Edge. Closes whatwg#1753.
diff --git a/source b/source
@@ -79507,6 +79507,9 @@ callback <dfn>FrameRequestCallback</dfn> = void (<span>DOMHighResTimeStamp</span
      <dt id="sandboxOrigin">If the <code>Document</code>'s <span>active sandboxing flag set</span>
      has its <span>sandboxed origin browsing context flag</span> set</dt>
 
+     <dt>If the <code>Document</code> was generated from a <span data-x="data
+     protocol"><code>data:</code> URL</span></dt>
+
      <dd><p>A unique <span data-x="concept-origin-opaque">opaque origin</span> assigned when the
      <code>Document</code> is created.</p></dd>
 
@@ -79534,10 +79537,6 @@ callback <dfn>FrameRequestCallback</dfn> = void (<span>DOMHighResTimeStamp</span
 
      <dt>If the <code>Document</code> is a non-initial "<code>about:blank</code>" document</dt>
 
-     <dt>If the <code>Document</code> was generated from a <span data-x="data
-     protocol"><code>data:</code> URL</span> found in another <code>Document</code> or in a
-     script</dt>
-
      <dd><p>The <span data-x="concept-settings-object-origin">origin</span> of the <span>incumbent
      settings object</span> when the <span>navigate</span> algorithm was invoked, or, if no <span
      data-x="concept-script">script</span> was involved, the <span>origin</span> of the <span>node
@@ -79560,10 +79559,9 @@ callback <dfn>FrameRequestCallback</dfn> = void (<span>DOMHighResTimeStamp</span
      container</span>'s <span>node document</span>.</p></dd>
 
 
-     <dt>If the <code>Document</code> was obtained in some other manner (e.g. a <span data-x="data
-     protocol"><code>data:</code> URL</span> typed in by the user or that was returned as the
-     location of a redirect, a <code>Document</code> created using the <code
-     data-x="dom-DOMImplementation-createDocument">createDocument()</code> API, etc)</dt>
+     <dt>If the <code>Document</code> was obtained in some other manner (e.g. a <code>Document</code>
+     created using the <code data-x="dom-DOMImplementation-createDocument">createDocument()</code>
+     API, etc)</dt>
 
      <dd>
       <p>The default behavior as defined in the WHATWG DOM standard applies. <ref spec=DOM>.</p>
