Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Partition Blob URL revocation by Storage Key #201

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Partition Blob URL revocation by Storage Key #201

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b988256
Partition Blob URL revocation
recvfrom Oct 25, 2024
bb24aca
Fix duplicate list numbering
recvfrom Oct 25, 2024
c97d7f9
Address review feedback
recvfrom Nov 22, 2024
fd3d0f8
Move partitioning checks into FileAPI
recvfrom Nov 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 35 additions & 8 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1512,15 +1512,25 @@ A [=blob URL store=] is a [=map=]
where [=map/keys=] are [=valid URL strings=]
and [=map/values=] are [=blob URL Entries=].

A <dfn export>blob URL entry</dfn> consists of
an <dfn export for="blob URL entry">object</dfn> (of type {{Blob}} or {{MediaSource}}),
and an <dfn export for="blob URL entry">environment</dfn> (an [=environment settings object=]).

[=map/Keys=] in the [=blob URL store=] (also known as <dfn lt="blob URL|object URL" export>blob URLs</dfn>)
are [=valid URL strings=] that when [=URL parser|parsed=]
result in a [=/URL=] with a [=url/scheme=] equal to "`blob`",
an [=empty host=], and a [=url/path=] consisting of one element itself also a [=valid URL string=].

A <dfn export>blob URL entry</dfn> is used to store an object of type {{Blob}} or {{MediaSource}}.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking at this. I would continue to give a blob URL entry an object field, but just no longer export it. And then explain in a note that specifications have to use "obtain a blob object" to get hold of the object.


A [=blob URL entry=] has an <dfn export for="blob URL entry">environment</dfn> (an [=environment settings object=]).

<div algorithm="obtainBlobObject">
To <dfn export id=blob-url-obtain-object>obtain a blob object</dfn> given a [=blob URL entry=] |blobUrlEntry|, an [=environment=] |environment|, and an optional boolean |isNavigation| (default false):

1. Let |isAuthorized| be true.
1. If |isNavigation| is false, let |isAuthorized| be the result of [=checking for same-partition blob URL usage=] with |blobUrlEntry| and |environment|.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you manipulate an initialized variable, you need to use "set ... to". See the Infra standard for more complete guidance.

1. If |isAuthorized| is false, then return failure.
1. Return |blobUrlEntry|'s object.

</div>

<div algorithm="createBlobURL">
To <dfn id="unicodeBlobURL" lt="generate a new blob URL|generating a new blob URL">
generate a new blob URL</dfn>, run the following steps:
Expand Down Expand Up @@ -1595,6 +1605,22 @@ as the serialization of the origin of the environment that created the blob URL,
but for opaque origins the origin itself might be distinct. This difference isn't
observable though, since a revoked blob URL can't be resolved/fetched anymore anyway.

### Access restrictions on blob URLs ### {#partitioningOfBlobUrls}

<a>Blob URLs</a> can only be fetched from environments where the [=storage key=] matches that of
the environment where the <a>blob URL</a> was created. <a>blob URL</a> navigations are not subject
to this restriction.

<div algorithm="checkForSamePartitionBlobUrlUsage">
To <dfn export id=blob-url-partition-check>check for same-partition blob URL usage</dfn> given a [=blob URL entry=] |blobUrlEntry| and an [=environment=] |environment|:

1. Let |blobStorageKey| be the result of [=obtaining a storage key for non-storage purposes=] with |blobUrlEntry|'s [=blob URL entry/environment=].
1. Let |environmentStorageKey| be the result of [=obtaining a storage key for non-storage purposes=] with |environment|.
1. If |blobStorageKey| is not [=storage key/equal=] to |environmentStorageKey|, then return false.
1. Otherwise, return true.

</div>

<h4 id="lifeTime" dfn for="blob url" lt="lifetime|lifetime stipulation" export>Lifetime of blob URLs</h4>

This specification extends the [=unloading document cleanup steps=] with the following steps:
Expand Down Expand Up @@ -1632,12 +1658,13 @@ The <dfn method for=URL id="dfn-revokeObjectURL">revokeObjectURL(|url|)</dfn> st

1. Let |url record| be the result of [=URL parser|parsing=] |url|.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe change this to urlRecord while here? Having these as separate words is confusing with the url variable.

1. If |url record|'s [=url/scheme=] is not "`blob`", return.
1. Let |origin| be the [=url/origin=] of |url record|.
1. Let |settings| be the [=current settings object=].
1. If |origin| is not [=same origin=] with |settings|'s [=environment settings object/origin=], return.
1. Let |entry| be |url record|'s [=blob URL entry=].
1. If |entry| is null, return.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

then return*

1. Let |isAuthorized| be the result of [=checking for same-partition blob URL usage=] with |entry| and the [=current settings object=].
1. If |isAuthorized| is false, return.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

then return*

1. [=Remove an entry from the Blob URL Store=] for |url|.

Note: This means that rather than throwing some kind of error, attempting to revoke a URL that isn't registered will silently fail.
Note: This means that rather than throwing some kind of error, attempting to revoke a URL that isn't registered or that was registered from an environment in a different storage partition will silently fail.
User agents might display a message on the error console if this happens.

Note: Attempts to dereference |url| after it has been revoked will result in a [=network error=].
Expand Down
Loading