From b3f7d5cc2a2ecb50903efb922a8edfefbe1c5f34 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Thu, 13 Feb 2020 17:47:32 +0100 Subject: [PATCH] data: URLs (#72) As long as they have a creator, anyway. (Note that data: URLs cannot be opened in a top-level browsing context, such as a popup, except via a user-initiated navigation.) Tests: https://github.com/web-platform-tests/wpt/pull/21146 and https://github.com/web-platform-tests/wpt/pull/21781. Fixes #69. Nice! --- index.html | 119 +++++++++++++++++++++++++------------------------ index.src.html | 27 +++++------ 2 files changed, 70 insertions(+), 76 deletions(-) diff --git a/index.html b/index.html index ecb2f70..92d4d46 100644 --- a/index.html +++ b/index.html @@ -1029,7 +1029,7 @@ } /* } */ - @supports (display:grid) { + @supports (display:grid) and (display:contents) { /* Use #toc over .toc to override non-@supports rules. */ #toc { display: grid; @@ -1167,6 +1167,18 @@ margin-left: auto; margin-right: auto; } + .overlarge { + /* Magic to create good table positioning: + "content column" is 50ems wide at max; less on smaller screens. + Extra space (after ToC + content) is empty on the right. + + 1. When table < content column, centers table in column. + 2. When content < table < available, left-aligns. + 3. When table > available, fills available + scroll bar. + */ + display: grid; + grid-template-columns: minmax(0, 50em); + } .overlarge > table { /* limit preferred width of table */ max-width: 50em; @@ -1176,7 +1188,6 @@ @media (min-width: 55em) { .overlarge { - margin-left: calc(13px + 26.5rem - 50vw); margin-right: calc(13px + 26.5rem - 50vw); max-width: none; } @@ -1184,14 +1195,12 @@ @media screen and (min-width: 78em) { body:not(.toc-inline) .overlarge { /* 30.5em body padding 50em content area */ - margin-left: calc(40em - 50vw) !important; margin-right: calc(40em - 50vw) !important; } } @media screen and (min-width: 90em) { body:not(.toc-inline) .overlarge { /* 4em html margin 30.5em body padding 50em content area */ - margin-left: 0 !important; margin-right: calc(84.5em - 100vw) !important; } } @@ -1212,9 +1221,9 @@ } } - + - +

Top-level Documents

- +

http://example.com/ opened in a top-level browsing context is not a secure context, as it was not delivered over @@ -609,7 +608,7 @@

5. Return "`Not Secure`" if any of the following are true: - 1. |document|'s active sandboxing flag set contains the + 1. |document|'s active sandboxing flag set contains the sandboxed secure browsing context flag. Note: This check is "at risk". See [[#monkey-patching-sandbox-flags]] @@ -620,7 +619,7 @@

3. |settings|'s HTTPS state is "`deprecated`". - 4. |document|'s active sandboxing flag set includes the + 4. |document|'s active sandboxing flag set includes the sandboxed origin browsing context flag, and [[#is-url-trustworthy]] returns "`Not Trustworthy`" when executed upon |settings|'s creation URL. @@ -634,7 +633,7 @@

look at the origin of its URL to determine whether we would have considered it trustworthy had it not been sandboxed. - 5. |document|'s active sandboxing flag set does not include the + 5. |document|'s active sandboxing flag set does not include the sandboxed origin browsing context flag, and [[#is-origin-trustworthy]] returns "`Not Trustworthy`" when executed upon |settings|'s origin. @@ -715,21 +714,15 @@

A potentially trustworthy URL is one which either inherits - context from it's creator (`about:blank`, `about:srcdoc`) or one whose + context from it's creator (`about:blank`, `about:srcdoc`, `data`) or one whose origin is a potentially trustworthy origin. Given a {{URL}} (|url|), the following algorithm returns "`Potentially Trustworthy`" or "`Not Trustworthy`" as appropriate: - 1. If |url|'s scheme is "`data`", return "`Not + 1. If |url| is "`about:blank`" or "`about:srcdoc`", return "`Potentially Trustworthy`". - Note: This aligns the definition of a secure context with the - de facto "`data:` URL as opaque origin" - behavior that a majority of today's browsers have agreed upon, rather - than the de jure "`data:` URL inherits origin" - behavior defined in HTML. - - 2. If |url| is "`about:blank`" or "`about:srcdoc`", return "`Potentially + 2. If |url|'s scheme is "`data`", return "`Potentially Trustworthy`". 3. Return the result of executing [[#is-origin-trustworthy]] on |url|'s @@ -879,7 +872,7 @@

`localhost`

resolvers SHOULD/MAY treat them specially. For better or worse, resolvers often ignore these suggestions, and will send `localhost` to the network for resolution in a number of circumstances. - + Given that uncertainty, user agents MAY treat localhost names as having potentially trustworthy origins if and only if they also adhere to the localhost name resolution rules spelled out in [[!let-localhost-be-localhost]]