From 11482ed9c420ba6661d2216b9083eb4abfce6c93 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Tue, 18 Feb 2020 11:45:02 +0100 Subject: [PATCH 1/3] Prevent [[CryptographicNonce]] from being emptied And also clarify some prose around the nonce content attribute; fixes #5288. --- source | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/source b/source index 31b314f586f..ca07f791909 100644 --- a/source +++ b/source @@ -7118,11 +7118,11 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute

Elements that have a nonce content attribute ensure that the crytographic nonce is only exposed to script (and not to side-channels like CSS attribute - selectors) by extracting the value from the content attribute, moving it into an internal slot + selectors) by taking the value from the content attribute, moving it into an internal slot named [[CryptographicNonce]], and exposing it to script via the - HTMLOrSVGElement interface mixin. Unless otherwise specified, the slot's value - is the empty string.

+ data-dfn-type="attribute">[[CryptographicNonce]], exposing it to script via the + HTMLOrSVGElement interface mixin, and setting the content attribute to the empty + string. Unless otherwise specified, the slot's value is the empty string.

element . nonce
@@ -7148,7 +7148,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute introduced.

Whenever an element including HTMLOrSVGElement has its nonce attribute is set or changed, set this element's + data-x="attr-nonce">nonce content attribute is set or changed, set this element's [[CryptographicNonce]] to the given value.

Whenever an element including HTMLOrSVGElement becomes browsing-context @@ -7165,10 +7165,19 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute attr whose value is not the empty string, then:

    +

  1. Let nonce be element's + [[CryptographicNonce]].

    2. +

  2. Set an attribute value for element using "nonce" and the empty string.

    3. + +

  3. Set element's [[CryptographicNonce]] to + nonce.

+ +

If element's [[CryptographicNonce]] were not restored it + would be the empty string at this point.

From b43d1e81f8a1e7446f86537128acd86a5128d1a3 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Wed, 19 Feb 2020 14:07:28 +0100 Subject: [PATCH 2/3] use attribute change steps --- source | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/source b/source index ca07f791909..56b1d0518cc 100644 --- a/source +++ b/source @@ -7147,9 +7147,22 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute issue #2369, where this behavior was introduced.

-

Whenever an element including HTMLOrSVGElement has its nonce content attribute is set or changed, set this element's - [[CryptographicNonce]] to the given value.

+

The following attribute change + steps are used for the nonce content attribute: + +

    +

  1. If element does not include HTMLOrSVGElement, then + return.

    2. + +

  2. If localName is not nonce or + namespace is not null, then return.

    3. + +

  3. If value is null, then set element's + [[CryptographicNonce]] to the empty string.

    4. + +

  4. Otherwise, set element's [[CryptographicNonce]] to + value.

    5. +

Whenever an element including HTMLOrSVGElement becomes browsing-context connected, the user agent must execute the following steps on the element:

From aed568ab4d6b9697b951a5c04a0e3e61d72674b6 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Thu, 20 Feb 2020 10:07:29 +0100 Subject: [PATCH 3/3] include --- source | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/source b/source index 56b1d0518cc..a40b1e838c8 100644 --- a/source +++ b/source @@ -2824,6 +2824,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
  • legacy platform object
  • primary interface
  • interface object
    • +
  • include
  • interface prototype object
  • [[Realm]] field of a platform object
  • callback context
    • @@ -7151,7 +7152,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute steps are used for the nonce content attribute:
      -

    1. If element does not include HTMLOrSVGElement, then +

    2. If element does not include HTMLOrSVGElement, then return.

    3. If localName is not nonce or @@ -7164,8 +7165,9 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute value.

    -

    Whenever an element including HTMLOrSVGElement becomes browsing-context - connected, the user agent must execute the following steps on the element:

    +

    Whenever an element including HTMLOrSVGElement + becomes browsing-context connected, the user agent must execute the following steps + on the element:

    1. Let CSP list be element's Document creation and initialization.

      -

      The cloning steps for elements that include - HTMLOrSVGElement must set the [[CryptographicNonce]] slot on the copy - to the value of the slot on the element being cloned.

      +

      The cloning steps for elements that + include HTMLOrSVGElement must set the + [[CryptographicNonce]] slot on the copy to the value of the slot on the element being + cloned.

      Lazy loading attributes