- From: poot <cvsmail@w3.org>
- Date: Fri, 23 Sep 2011 15:43:23 -0400
- To: public-html-diffs@w3.org
hixie: Define how sandboxing works with plugins in a hypothetical world where plugins honour the sandbox. (whatwg r6573) http://dev.w3.org/cvsweb/html5/spec/Overview.html?r1=1.5266&r2=1.5267&f=h http://html5.org/tools/web-apps-tracker?from=6572&to=6573 =================================================================== RCS file: /sources/public/html5/spec/Overview.html,v retrieving revision 1.5266 retrieving revision 1.5267 diff -u -d -r1.5266 -r1.5267 --- Overview.html 23 Sep 2011 19:14:21 -0000 1.5266 +++ Overview.html 23 Sep 2011 19:43:08 -0000 1.5267 @@ -2683,7 +2683,10 @@ such as the Netscape Plugin API; others might use remote content converters or have built-in support for certain types. Indeed, this specification doesn't require user agents to support plugins at all. - <a href="#refsNPAPI">[NPAPI]</a><div class="impl"> + <a href="#refsNPAPI">[NPAPI]</a><p>A plugin can be <dfn id="concept-plugin-secure" title="concept-plugin-secure">secured</dfn> + if it honors the semantics of the <code title="attr-iframe-sandbox"><a href="#attr-iframe-sandbox">sandbox</a></code> attribute.<p class="example">For example, a secured plugin would prevent its + contents from creating pop-up windows when the plugin is + instantiated inside a sandboxed <code><a href="#the-iframe-element">iframe</a></code>.<div class="impl"> <p class="warning">Browsers should take extreme care when interacting with external content intended for <a href="#plugin" title="plugin">plugins</a>. When third-party software is run with @@ -19719,7 +19722,7 @@ When the attribute is set, the content is treated as being from a unique <a href="#origin">origin</a>, forms and scripts are disabled, links are prevented from targeting other <a href="#browsing-context" title="browsing - context">browsing contexts</a>, and plugins are disabled. The + context">browsing contexts</a>, and plugins are secured. The <code title="attr-iframe-sandbox-allow-same-origin"><a href="#attr-iframe-sandbox-allow-same-origin">allow-same-origin</a></code> keyword allows the content to be treated as being from the same origin instead of forcing it into a unique origin, the <code title="attr-iframe-sandbox-allow-top-navigation"><a href="#attr-iframe-sandbox-allow-top-navigation">allow-top-navigation</a></code> @@ -19793,7 +19796,7 @@ <p>This flag prevents content from instantiating <a href="#plugin" title="plugin">plugins</a>, whether using <a href="#sandboxPluginEmbed">the <code>embed</code> element</a>, <a href="#sandboxPluginObject">the <code>object</code> element</a>, <a href="#sandboxPluginApplet">the <code>applet</code> element</a>, or through <a href="#sandboxPluginNavigate">navigation</a> of a <a href="#nested-browsing-context">nested - browsing context</a>.</p> + browsing context</a>, unless those <a href="#plugin" title="plugin">plugins</a> can be <a href="#concept-plugin-secure" title="concept-plugin-secure">secured</a>.</p> </dd> @@ -20216,33 +20219,6 @@ content</a>, any plugins instantiated for the element must be removed, and the <code><a href="#the-embed-element">embed</a></code> element represents nothing.</p> - <p id="sandboxPluginEmbed">If either: - - <ul><li>the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> was - set on the <a href="#browsing-context">browsing context</a> for which the - <code><a href="#the-embed-element">embed</a></code> element's <code><a href="#document">Document</a></code> is the - <a href="#active-document">active document</a> when that <code><a href="#document">Document</a></code> was - created, or</li> - - <li>the <code><a href="#the-embed-element">embed</a></code> element's <code><a href="#document">Document</a></code> was - parsed from a resource whose <a href="#content-type-sniffing-0" title="Content-Type - sniffing">sniffed type</a> as determined during <a href="#navigate" title="navigate">navigation</a> is - <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code></li> - - </ul><p>...then the user agent must render the <code><a href="#the-embed-element">embed</a></code> element - in a manner that conveys that the <a href="#plugin">plugin</a> was - disabled. The user agent may offer the user the option to override - the sandbox and instantiate the <a href="#plugin">plugin</a> anyway; if the - user invokes such an option, the user agent must act as if the - conditions above did not apply for the purposes of this element.</p> - - <p class="warning">Plugins are disabled in sandboxed browsing - contexts because they might not honor the restrictions imposed by - the sandbox (e.g. they might allow scripting even when scripting in - the sandbox is disabled). User agents should convey the danger of - overriding the sandbox to the user if an option to do so is - provided.</p> - <p>An <code><a href="#the-embed-element">embed</a></code> element is said to be <dfn id="concept-embed-active" title="concept-embed-active">potentially active</dfn> when the following conditions are all met simultaneously:</p> @@ -20250,7 +20226,6 @@ <li>The element's <code><a href="#document">Document</a></code> is <a href="#fully-active">fully active</a>.</li> <li>The element has either a <code title="attr-embed-src"><a href="#attr-embed-src">src</a></code> attribute set or a <code title="attr-embed-type"><a href="#attr-embed-type">type</a></code> attribute set (or both).</li> <li>The element's <code title="attr-embed-src"><a href="#attr-embed-src">src</a></code> attribute is either absent or its value is the empty string.</li> - <li>The element is not in a <code><a href="#document">Document</a></code> whose <a href="#browsing-context">browsing context</a> had the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> set when the <code><a href="#document">Document</a></code> was created (unless this has been overridden as described above).</li> <li>The element's <code><a href="#document">Document</a></code> was not parsed from a resource whose <a href="#content-type-sniffing-0" title="Content-Type sniffing">sniffed type</a> as determined during <a href="#navigate" title="navigate">navigation</a> is <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code> (unless this has been overridden as described above).</li> <li>The element is not a descendant of a <a href="#media-element">media element</a>.</li> <li>The element is not a descendant of an <code><a href="#the-object-element">object</a></code> element that is not showing its <a href="#fallback-content">fallback content</a>.</li> @@ -20295,6 +20270,35 @@ <a href="#plugin">plugin</a> that had been instantiated for that element must be unloaded.</p> + <p id="sandboxPluginEmbed">When a <a href="#plugin">plugin</a> is to be + instantiated but it cannot be <a href="#concept-plugin-secure" title="concept-plugin-secure">secured</a> and either: + + <ul><li>the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> was + set on the <a href="#browsing-context">browsing context</a> for which the + <code><a href="#the-embed-element">embed</a></code> element's <code><a href="#document">Document</a></code> is the + <a href="#active-document">active document</a> when that <code><a href="#document">Document</a></code> was + created, or</li> + + <li>the <code><a href="#the-embed-element">embed</a></code> element's <code><a href="#document">Document</a></code> was + parsed from a resource whose <a href="#content-type-sniffing-0" title="Content-Type + sniffing">sniffed type</a> as determined during <a href="#navigate" title="navigate">navigation</a> is + <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code></li> + + </ul><p>...then the user agent must not instantiate the + <a href="#plugin">plugin</a>, and must instead render the <code><a href="#the-embed-element">embed</a></code> + element in a manner that conveys that the <a href="#plugin">plugin</a> was + disabled. The user agent may offer the user the option to override + the sandbox and instantiate the <a href="#plugin">plugin</a> anyway; if the + user invokes such an option, the user agent must act as if the + conditions above did not apply for the purposes of this element.</p> + + <p class="warning">Plugins that cannot be <a href="#concept-plugin-secure" title="concept-plugin-secure">secured</a> are disabled in + sandboxed browsing contexts because they might not honor the + restrictions imposed by the sandbox (e.g. they might allow scripting + even when scripting in the sandbox is disabled). User agents should + convey the danger of overriding the sandbox to the user if an option + to do so is provided.</p> + <p class="note">The <code><a href="#the-embed-element">embed</a></code> element is unaffected by the CSS 'display' property. The selected plugin is instantiated even if the element is hidden with a 'display:none' CSS style.</p> @@ -20520,13 +20524,15 @@ <p>If the <code title="attr-object-classid"><a href="#attr-object-classid">classid</a></code> attribute is present, and has a value that isn't the empty string, then: if the user agent can find a <a href="#plugin">plugin</a> suitable - according to the value of the <code title="attr-object-classid"><a href="#attr-object-classid">classid</a></code> attribute, and <a href="#sandboxPluginObject">plugins aren't being sandboxed</a>, - then that <a href="#plugin">plugin</a> <a href="#object-plugin">should be - used</a>, and the value of the <code title="attr-object-data"><a href="#attr-object-data">data</a></code> attribute, if any, should be - passed to the <a href="#plugin">plugin</a>. If no suitable - <a href="#plugin">plugin</a> can be found, or if the <a href="#plugin">plugin</a> - reports an error, jump to the last step in the overall set of - steps (fallback).</p> + according to the value of the <code title="attr-object-classid"><a href="#attr-object-classid">classid</a></code> attribute, and either + <a href="#sandboxPluginObject">plugins aren't being sandboxed</a> + or that <a href="#plugin">plugin</a> can be <a href="#concept-plugin-secure" title="concept-plugin-secure">secured</a>, then that + <a href="#plugin">plugin</a> <a href="#object-plugin">should be used</a>, + and the value of the <code title="attr-object-data"><a href="#attr-object-data">data</a></code> + attribute, if any, should be passed to the <a href="#plugin">plugin</a>. If + no suitable <a href="#plugin">plugin</a> can be found, or if the + <a href="#plugin">plugin</a> reports an error, jump to the last step in the + overall set of steps (fallback).</p> </li> @@ -20785,8 +20791,8 @@ <dd> <p>If <a href="#sandboxPluginObject">plugins are being - sandboxed</a>, jump to the last step in the overall set of - steps (fallback).</p> + sandboxed</a> and the plugin that supports <var title="">resource type</var> cannot be <a href="#concept-plugin-secure" title="concept-plugin-secure">secured</a>, jump to the last + step in the overall set of steps (fallback).</p> <p>Otherwise, the user agent should <a href="#object-plugin">use the plugin that supports <var title="">resource type</var></a> and pass the content of the resource to that <a href="#plugin">plugin</a>. If the @@ -20905,13 +20911,12 @@ <li><p>If the <code title="attr-object-data"><a href="#attr-object-data">data</a></code> attribute is absent but the <code title="attr-object-type"><a href="#attr-object-type">type</a></code> - attribute is present, <a href="#sandboxPluginObject">plugins aren't - being sandboxed</a>, and the user agent can find a - <a href="#plugin">plugin</a> suitable according to the value of the <code title="attr-object-type"><a href="#attr-object-type">type</a></code> attribute, then that + attribute is present, and the user agent can find a + <a href="#plugin">plugin</a> suitable according to the value of the <code title="attr-object-type"><a href="#attr-object-type">type</a></code> attribute, and either <a href="#sandboxPluginObject">plugins aren't being sandboxed</a> or + the <a href="#plugin">plugin</a> can be <a href="#concept-plugin-secure" title="concept-plugin-secure">secured</a>, then that <a href="#plugin">plugin</a> <a href="#object-plugin">should be used</a>. If - no suitable <a href="#plugin">plugin</a> can be found, or if the - <a href="#plugin">plugin</a> reports an error, jump to the next step - (fallback).</li> + these conditions cannot be met, or if the <a href="#plugin">plugin</a> + reports an error, jump to the next step (fallback).</li> <li><p>(Fallback.) The <code><a href="#the-object-element">object</a></code> element <a href="#represents">represents</a> the element's children, ignoring any @@ -20935,7 +20940,8 @@ <a href="#plugin">plugin</a> is not a nested <a href="#browsing-context">browsing context</a>.</p> - <p id="sandboxPluginObject">If either:</p> + <p id="sandboxPluginObject">Plugins are considered sandboxed for the + purpose of an <code><a href="#the-object-element">object</a></code> element if either:</p> <ul><li>the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> was set on the <code><a href="#the-object-element">object</a></code> element's <code><a href="#document">Document</a></code>'s @@ -20947,11 +20953,7 @@ sniffing">sniffed type</a> as determined during <a href="#navigate" title="navigate">navigation</a> is <code><a href="#text-html-sandboxed">text/html-sandboxed</a></code></li> - </ul><p>...then the steps above must always act as if they had failed to - find a <a href="#plugin">plugin</a>, even if one would otherwise have been - used.</p> - - <p class="note">The above algorithm is independent of CSS properties + </ul><p class="note">The above algorithm is independent of CSS properties (including 'display', 'overflow', and 'visibility'). For example, it runs even if the element is hidden with a 'display:none' CSS style, and does not run <em>again</em> if the element's visibility @@ -46493,7 +46495,8 @@ <p class="note" id="sandboxPluginNavigate">If the <a href="#sandboxed-plugins-browsing-context-flag">sandboxed plugins browsing context flag</a> was set on the <a href="#browsing-context">browsing context</a> when the <code><a href="#document">Document</a></code> was created, the - synthesized <code><a href="#the-embed-element">embed</a></code> element will <a href="#sandboxPluginEmbed">fail to render the content</a>.</p> + synthesized <code><a href="#the-embed-element">embed</a></code> element will <a href="#sandboxPluginEmbed">fail to render the content</a> if the + relevant <a href="#plugin">plugin</a> cannot be <a href="#concept-plugin-secure" title="concept-plugin-secure">secured</a>.</p> <h4 id="read-ua-inline"><span class="secno">5.5.7 </span><dfn title="navigate-ua-inline">Page load processing model for inline content that doesn't have a DOM</dfn></h4> @@ -67538,6 +67541,7 @@ but it is disabled, the element <a href="#represents">represents</a> its contents.</p> + <p>Otherwise, the user agent should instantiate a Java Language runtime <a href="#plugin">plugin</a>, and should pass the names and values of all the attributes on the element, in the order they were added to
Received on Friday, 23 September 2011 19:43:25 UTC