diff --git a/source b/source index 06a06e3a2d0..8da47b92954 100644 --- a/source +++ b/source @@ -3942,6 +3942,8 @@ a.setAttribute('href', 'http://example.com/'); // change the content attribute d
  • The Initialize a global object's CSP list algorithm
  • The Initialize a Document's CSP list algorithm
  • The Should element's inline behavior be blocked by Content Security Policy? algorithm
    • +
  • The Should navigation request of type from source in target be blocked by Content Security Policy? algorithm
    • +
  • The Should navigation response to navigation request of type from source in target be blocked by Content Security Policy? algorithm
  • The report-uri directive
  • The EnsureCSPDoesNotBlockStringCompilation abstract operation
  • The Is base allowed for Document? algorithm
    • @@ -81908,6 +81910,11 @@ State: <OUTPUT NAME=I>1</OUTPUT> <INPUT VALUE="Increment" TYPE=BUTTON O +

  • Let navigationType be "form-submission" if the navigation algorithm was invoked as a result of the form submission algorithm, and "other" + otherwise.

    • +

  • Return to whatever algorithm invoked the navigation steps and continue running these steps in parallel.

    • @@ -81919,7 +81926,8 @@ State: <OUTPUT NAME=I>1</OUTPUT> <INPUT VALUE="Increment" TYPE=BUTTON O
    If resource is a response
    -

    Run process a navigate response with resource and +

    Run process a navigate response with null, resource, + navigationType, the source browsing context, and browsingContext, and then abort these steps.

    If resource is a request whose 1</OUTPUT> <INPUT VALUE="Increment" TYPE=BUTTON O the override URL.

    -

  • Run process a navigate response with response and +

  • Run process a navigate response with resource, + response, navigationType, the source browsing context, and browsingContext, and then abort these steps.

    • @@ -82057,8 +82066,8 @@ State: <OUTPUT NAME=I>1</OUTPUT> <INPUT VALUE="Increment" TYPE=BUTTON O
    If resource is a request whose url's scheme is a fetch scheme
    -

    Run process a navigate fetch given resource and - browsingContext.

    +

    Run process a navigate fetch given resource, the source + browsing context, and browsing context, and type.

    Otherwise, resource is a request whose url's scheme @@ -82071,14 +82080,15 @@ State: <OUTPUT NAME=I>1</OUTPUT> <INPUT VALUE="Increment" TYPE=BUTTON O

    To process a navigate fetch, given a request request and browsing context - browsingContext, run these steps:

    + data-x="concept-request">request request, browsing context + sourceBrowsingContext, browsing context browsingContext, and + string type, run these steps:

    1. Let response be null.

      2. -

    2. Set request's client to the - source browsing context's active document's relevant settings +

    3. Set request's client to + sourceBrowsingContext's active document's relevant settings object, target browsing context to browsingContext, destination to "document", @@ -82091,11 +82101,10 @@ State: <OUTPUT NAME=I>1</OUTPUT> <INPUT VALUE="Increment" TYPE=BUTTON O

    4. Set request's omit-Origin-header flag.

    5. If request's method is not `GET`, or, if the navigation algorithm was invoked - as a result of the form submission algorithm, then if - there is an origin of the active document of the source browsing - context, unset request's omit-Origin-header - flag.

      6. + data-x="">GET`, or, if type is "form-submission", then + if there is an origin of the active document of + sourceBrowsingContext, unset request's + omit-Origin-header flag.

    6. Otherwise, if browsingContext is a child browsing context, and the browsing context container of browsingContext has a browsing @@ -82103,11 +82112,24 @@ State: <OUTPUT NAME=I>1</OUTPUT> <INPUT VALUE="Increment" TYPE=BUTTON O data-x="concept-request-origin">origin to that browsing context scope origin and unset request's omit-Origin-header flag.

      7. -

    7. Fetch request.

      8. +
    8. +

      If the Should navigation request of type from source in target be blocked by Content + Security Policy? algorithm returns "Blocked" when executed upon + request, navigationType, sourceBrowsingContext, and + browsingContext, then set response to a network error. +

      + +

      Otherwise:

      + +
        +

      1. Fetch request.

        2. + +

      2. Wait for the task on the networking task + source to process response and set response to the + result.

        3. +
      +
      9. -

    9. Wait for the task on the networking task - source to process response and set response to the - result.

    10. Otherwise, if response has a location URL that is a URL, run the @@ -82200,20 +82223,36 @@ State: <OUTPUT NAME=I>1</OUTPUT> <INPUT VALUE="Increment" TYPE=BUTTON O the fallback response actually is.

      11. -

    11. Run process a navigate response given response and +

    12. Run process a navigate response given request, + response, navigationType, the source browsing context, and browsingContext.

    To process a navigate response, given a response response and browsing context - browsingContext, run these steps:

    + data-x="concept-request">request request, a response response, a string type, and two + browsing contexts source and browsingContext, run these + steps:

    1. -

      If response is a network error, then display the inline content with an appropriate error shown to the - user, with the newly created Document object's origin set to a - new opaque origin, and abort these steps.

      +

      If any of the following are true, then display the inline + content with an appropriate error shown to the user, with the newly created + Document object's origin set to a new opaque origin, and abort these steps.

      + +
        +

      • response is a network error.

        • + +

      • TODO: Define X-Frame-Options + processing here [whatwg/html#1230].

        • + +

      • The Should navigation response to navigation request of type from source in target + be blocked by Content Security Policy? algorithm returns "Blocked" when executed upon request, response, + type, source, and browsingContext.

        • +

      This is where the network errors defined and propagated by the WHATWG Fetch standard, such as DNS or TLS errors, end up being displayed to users.