Skip to content

Commit 7cdc83d

Browse files
domenicdomenic
authored
Update and correct <meta name="referrer"> parsing
This stems from w3c/webappsec-referrer-policy#53 and w3c/webappsec-referrer-policy#66 which remove the legacy keyword support from the HTTP Referrrer-Policy header. We instead move that into HTML as a preprocessing step for the <meta name="referrer"> element, before setting the resulting policy on the document. While there, this fixes the <meta name="referrer"> parsing in a few ways compared to the previous specification: - It includes the additional legacy translation "origin-when-crossorigin" => "origin-when-cross-origin". - It no longer strips leading and trailing whitespace. - It allows later <meta name="referrer"> elements to override earlier ones, in order to get nice fallback behavior.
1 parent 81ee034 commit 7cdc83d

File tree

1 file changed

+36
-26
lines changed

1 file changed

+36
-26
lines changed

‎source

Lines changed: 36 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -2863,10 +2863,9 @@ a.setAttribute('href', 'http://example.com/'); // change the content attribute d
28632863

28642864
<ul class="brief">
28652865
<li><dfn data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy">referrer policy</dfn></li>
2866-
<li>The <dfn data-x="referrer-policy-token" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#policy-token"><code>policy-token</code></dfn> production</li>
28672866
<li>The `<dfn data-x="http-referrer-policy" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-header-dfn"><code>Referrer-Policy</code></dfn>` HTTP header</li>
28682867
<li>The <dfn data-x="parse-referrer-policy-header" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#parse-referrer-policy-from-header">parse a referrer policy from a `<code>Referrer-Policy</code>` header</dfn> algorithm</li>
2869-
<li>The <dfn data-x="concept-determine-referrer-policy" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#determine-policy-for-token">determine the referrer policy</dfn> algorithm</li>
2868+
<li>The "<dfn data-x="referrer-policy-no-referrer" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer"><code>no-referrer</code></dfn>", "<dfn data-x="referrer-policy-no-referrer-when-downgrade" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer-when-downgrade"><code>no-referrer-when-downgrade</code></dfn>", "<dfn data-x="referrer-policy-origin-when-cross-origin" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-origin-when-cross-origin"><code>no-referrer-when-downgrade</code></dfn>", and "<dfn data-x="referrer-policy-unsafe-url" data-x-href="https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-unsafe-url"><code>unsafe-url</code></dfn>" referrer policies</li>
28702869
</ul>
28712870

28722871
<p>The following terms are defined in <cite>Mixed Content</cite>: <ref spec=MIX></p>
@@ -13323,7 +13322,8 @@ interface <dfn>HTMLMetaElement</dfn> : <span>HTMLElement</span> {
1332313322
<li>The element is <span>in a document tree</span></li>
1332413323
<li>The element has a <code data-x="attr-meta-name">name</code> attribute, whose value is
1332513324
<code data-x="meta-referrer">referrer</code></li>
13326-
<li>The element has a <code data-x="attr-meta-content">content</code> attribute</li>
13325+
<li>The element has a <code data-x="attr-meta-content">content</code> attribute, whose value
13326+
is not the empty string</li>
1332713327
<li>The element is a child of <span>the <code>head</code> element</span> of the document</li>
1332813328
</ul>
1332913329
</li>
@@ -13333,33 +13333,43 @@ interface <dfn>HTMLMetaElement</dfn> : <span>HTMLElement</span> {
1333313333
substeps:</p>
1333413334

1333513335
<ol>
13336-
<li><p>Let <var>value</var> be the result of <span data-x="strip leading and trailing
13337-
whitespace">stripping leading and trailing whitespace</span> from the value of
13338-
<var>element</var>'s <code data-x="attr-meta-content">content</code> attribute.</p></li>
13336+
<li><p>Let <var>value</var> be the value of <var>element</var>'s <code
13337+
data-x="attr-meta-content">content</code> attribute, <span>converted to ASCII
13338+
lowercase</span>.</p></li>
1333913339

1334013340
<li>
13341-
<p>If <var>value</var> is not the empty string, then:</p>
13342-
13343-
<ol>
13344-
<li>
13345-
<p>Let <var>policy</var> be the result of <span
13346-
data-x="concept-determine-referrer-policy">determining the policy</span> for
13347-
<var>value</var>.</p>
13348-
13349-
<p class="note">This step allows the legacy values <code data-x="">never</code>, <code
13350-
data-x="">default</code>, and <code data-x="">always</code> to take the place of the
13351-
standard referrer policies <code data-x="">no-referrer</code>, <code
13352-
data-x="">no-referrer-when-downgrade</code>, and <code data-x="">unsafe-url</code>,
13353-
respectively. Per the above conformance requirement, these legacy values must never be
13354-
used by authors, even though this step causes them to impact the processing model.</p>
13355-
</li>
13356-
13357-
<li><p>If <var>policy</var> is not the empty string, then set <var>element</var>'s
13358-
<span>node document</span>'s <span data-x="concept-document-referrer-policy">referrer
13359-
policy</span> to <var>policy</var>, and abort this algorithm.</p></li>
13360-
</ol>
13341+
<p>If <var>value</var> is one of the values given in the first column of the following
13342+
table, then set <var>value</var> to the value given in the second column:</p>
13343+
13344+
<table>
13345+
<thead>
13346+
<tr>
13347+
<th>Legacy value
13348+
<th>Referrer policy
13349+
<tbody>
13350+
<tr>
13351+
<td><code data-x="">never</code>
13352+
<td><code data-x="referrer-policy-no-referrer">no-referrer</code>
13353+
<tr>
13354+
<td><code data-x="">default</code>
13355+
<td><code data-x="referrer-policy-no-referrer-when-downgrade">no-referrer-when-downgrade</code>
13356+
<tr>
13357+
<td><code data-x="">always</code>
13358+
<td><code data-x="referrer-policy-unsafe-url">unsafe-url</code>
13359+
<tr>
13360+
<td><code data-x="">origin-when-crossorigin</code>
13361+
<td><code data-x="referrer-policy-origin-when-cross-origin">origin-when-cross-origin</code>
13362+
</table>
1336113363
</li>
13364+
13365+
<li><p>If <var>value</var> is a <span>referrer policy</span>, then set <var>element</var>'s
13366+
<span>node document</span>'s <span data-x="concept-document-referrer-policy">referrer
13367+
policy</span> to <var>policy</var>.</p></li>
1336213368
</ol>
13369+
13370+
<p class="note">The fact that these substeps are applied for each element enables <a
13371+
href="https://w3c.github.io/webappsec-referrer-policy/#unknown-policy-values">deployment of
13372+
fallback values for older user agents</a>. <ref spec="REFERRERPOLICY"></p>
1336313373
</li>
1336413374
</ol>
1336513375

0 commit comments

Comments
 (0)