W3C home > Mailing lists > Public > public-webappsec@w3.org > July 2015

Re: CfC: Mixed Content to PR; deadline July 6th.

From: Mike West <mkwst@google.com>
Date: Mon, 20 Jul 2015 14:51:34 +0200
Message-ID: <CAKXHy=f=Gr1Ph6n39vLC7Q9tPdPQhJR5VXpM7x=_L_21M0vmnQ@mail.gmail.com>
To: Anne van Kesteren <annevk@annevk.nl>
Cc: Brian Smith <brian@briansmith.org>, Brad Hill <hillbrad@gmail.com>, Wendy Seltzer <wseltzer@w3.org>, Dan Veditz <dveditz@mozilla.com>, Kristijan Burnik <burnik@google.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>, Alex Russell <slightlyoff@google.com>, Ryan Sleevi <sleevi@google.com>
On Mon, Jul 20, 2015 at 2:45 PM, Anne van Kesteren <annevk@annevk.nl> wrote:

> On Mon, Jul 20, 2015 at 2:35 PM, Mike West <mkwst@google.com> wrote:
> > I'll poke at MIX this afternoon to bake in the passthrough loophole
> > discussed here. It's not entirely clear to me how to distinguish a
> `fetch()`
> > issued from the Document from the `fetch(event.request)` issued from the
> > Service Worker (as they'll both have a `context` of "fetch", right? and
> both
> > point to the same `window`?). Perhaps it makes sense to divide the
> "fetch"
> > context into "fetch" and "passthrough-fetch" in the same way we divided
> > "image" and "image-set"?
>
> Why do you need to distinguish them? It seems to me you only need to
> disallow mixed content when request's window is "no-window", which
> would apply to both documents and workers.
>

Wouldn't that allow `fetch([insecure url goes here], { window: null })` in
a document? I might be misreading the bits around
https://fetch.spec.whatwg.org/#dom-request, but it seems like "no-window"
can be set imperatively.

My goal would be to limit the carveout to the `self.onfetch = function
(event) { event.respondWith(fetch(event.request)); }` case. Is that too
limiting? Would you suggest allowing documents to `fetch()` things as well?

-mike
Received on Monday, 20 July 2015 12:52:24 UTC

This archive was generated by hypermail 2.3.1 : Monday, 23 October 2017 14:54:13 UTC