eliott/servo
1
0
Fork 0
mirror of https://github.com/servo/servo synced 2026-04-26 01:25:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

script: Check same-origin-domain when evaluating javscript: URLs. (#41969)

Browse Source 
These changes introduce a new OriginSnapshot type, which is an immutable
version of MutableOrigin (ie. an origin that includes an optional domain
modifier). This is now propagated as part of LoadData's origin, allowing
us to perform the same-origin-domain check for javascript: URLs as
needed.

Testing: Newly-passing tests.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>
This commit is contained in:
Josh Matthews
2026-01-17 21:32:51 -05:00
committed by GitHub
parent bc1ec4bfaf
commit a97a345d6e
13 changed files with 93 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
components/script/dom/html/htmliframeelement.rs
View File

@@ -272,7 +272,7 @@ impl HTMLIFrameElement {
let window = self.owner_window();
let pipeline_id = Some(window.pipeline_id());
let mut load_data = LoadData::new(
LoadOrigin::Script(document.origin().immutable().clone()),
LoadOrigin::Script(document.origin().snapshot()),
url,
pipeline_id,
window.as_global_scope().get_referrer(),
@@ -368,7 +368,7 @@ impl HTMLIFrameElement {
let propagate_encoding_to_child_document = url.origin().same_origin(window.origin());
let mut load_data = LoadData::new(
LoadOrigin::Script(document.origin().immutable().clone()),
LoadOrigin::Script(document.origin().snapshot()),
url,
creator_pipeline_id,
window.as_global_scope().get_referrer(),
@@ -412,7 +412,7 @@ impl HTMLIFrameElement {
let window = self.owner_window();
let pipeline_id = Some(window.pipeline_id());
let mut load_data = LoadData::new(
LoadOrigin::Script(document.origin().immutable().clone()),
LoadOrigin::Script(document.origin().snapshot()),
url,
pipeline_id,
window.as_global_scope().get_referrer(),