Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix up the focused area restrictions. #403

Closed
wants to merge 1 commit into from
Closed

Fix up the focused area restrictions. #403

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -475,9 +475,9 @@ the given [=sensor type=]. See [[FEATURE-POLICY]] for more details.

<h4 id="focused-area" oldids="losing-focus">Focused Area</h4>

[=Sensor readings=] are only available for [=active documents=] whose
origin is [=same origin-domain=] with the [=currently focused area=]
document.
[=Sensor readings=] are only available for [=active documents=] whose origin is
[=same origin-domain=] with the document of the [=currently focused area=] of
the [=top-level browsing context=] of the specified [=active document=].
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure which document the "of the specified active document" clause refers to.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that the idea is that, to determine whether sensor readings are available within a particular document, you look at that document's top-level browsing context, find the focused document inside it, and check whether the two documents are same-origin-domain. ... How about:

Suggested change
the [=top-level browsing context=] of the specified [=active document=].
the same [=top-level browsing context=].

?


This is done in order to mitigate the risk of a skimming attack against the
[=browsing context=] containing an element which has [=gains focus|gained focus=],
Expand Down Expand Up @@ -802,8 +802,10 @@ The <dfn>mandatory conditions</dfn> are the following:
- [=document visibility state|Visibility state=] of the document is "visible".
- The document is [=allowed to use=] all the [=policy-controlled features=] associated
with the given [=sensor type=].
- [=Currently focused area=] belongs to a document whose origin is [=same origin-domain=]
with the origin of the given [=active document=].
- The [=currently focused area=] of the [=top-level browsing context=] of the
[=Document/browsing context=] of the given [=active document=] belongs to a
document whose origin is [=same origin-domain=] with the origin of the given
[=active document=].
- <dfn>Specific conditions</dfn>: The [=extension specifications=] that add new
[=mandatory conditions|conditions=] hook into this specification at this point.

Expand Down