W3C home > Mailing lists > Public > public-webappsec@w3.org > July 2015

Re: CfC: Mixed Content to PR; deadline July 6th.

From: Anne van Kesteren <annevk@annevk.nl>
Date: Thu, 30 Jul 2015 11:43:05 +0200
Message-ID: <CADnb78hYJSvsZL+NWiEaY=JrhRM_zHX8FdaPM5UyJZpRLkQBmA@mail.gmail.com>
To: Mike West <mkwst@google.com>
Cc: Brian Smith <brian@briansmith.org>, Brad Hill <hillbrad@gmail.com>, Wendy Seltzer <wseltzer@w3.org>, Dan Veditz <dveditz@mozilla.com>, Kristijan Burnik <burnik@google.com>, "public-webappsec@w3.org" <public-webappsec@w3.org>, Alex Russell <slightlyoff@google.com>, Ryan Sleevi <sleevi@google.com>
On Thu, Jul 30, 2015 at 10:43 AM, Mike West <mkwst@google.com> wrote:
> Doesn't the set of `window` checks and associated copy behavior that we
> discussed prevent this? That is, `fetch(e.request)` works because it copies
> the window object rather than setting `no-window`. This code would set
> `no-window`, and would therefore fail.
>
> Have I misunderstood the algorithm in Fetch?

You haven't. My bad. But if a document had previous requested
unsafe.example/x and put it in the cache, and the service worker would
reply with that, you'd have something similar that would work.


-- 
https://annevankesteren.nl/
Received on Thursday, 30 July 2015 09:43:30 UTC

This archive was generated by hypermail 2.3.1 : Monday, 23 October 2017 14:54:14 UTC