Skip to content

Commit 1ad7739

Browse files
frivoalfrivoal
committed
[css-nav-1] Gate the navigation events on a policy-controlled feature
Closes #3390
1 parent 780417b commit 1ad7739

File tree

1 file changed

+129
-5
lines changed

1 file changed

+129
-5
lines changed

‎css-nav-1/Overview.bs‎

Lines changed: 129 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,9 @@ spec: html; urlPrefix: https://html.spec.whatwg.org/multipage/;
3636
spec: dom; urlPrefix: https://dom.spec.whatwg.org/
3737
type: dfn;
3838
text: document element
39+
spec: feature-policy; urlPrefix: https://wicg.github.io/feature-policy/
40+
type: dfn;
41+
text: is enabled; url: is-feature-enabled
3942
spec: overscroll-behavior; urlPrefix: https://wicg.github.io/overscroll-behavior/;
4043
type: dfn;
4144
text: scroll boundary
@@ -959,6 +962,35 @@ and it cannot be scrolled at the same time.
959962
</div>
960963
</div>
961964

965+
<h2 id=policy-feature>
966+
The <a>navigation-override</a> [=policy-controlled feature=]</h2>
967+
968+
The <dfn>navigation-override</dfn> [=policy-controlled feature=] controls
969+
the availability of mechanisms that enables page authors
970+
to take control over the behavior of spatial navigation,
971+
or to cancel it outright.
972+
973+
* The feature name is "<code>navigation-override</code>"
974+
* The [=default allowlist=] for <a>navigation-override</a> is "<code>self</code>"
975+
976+
As defined in further details in [[#nav]],
977+
if <a>navigation-override</a> is disabled in a document,
978+
the navigation events (see [[#events-navigationevent]]) will not be fired.
979+
980+
Note: This is to prevent a hostile iframe from using these events
981+
in order to highjack the focus.
982+
We recognize that there exists other mechanisms predating spatial navigation
983+
that malicious authors could use
984+
to interfere with the user's ability to control where the focus goes.
985+
Despite that, it seems worthwile to attempt not to increase this attack surface,
986+
although it is possible that such attacks are already sufficiently easy to perform
987+
that this is a lost cause.
988+
Further feedback on this topic,
989+
based on experience with implementation or with mitigating such attacks,
990+
is very welcome.
991+
992+
993+
962994
<h2 id=processing-model>
963995
Processing Model</h2>
964996

@@ -1044,13 +1076,15 @@ To run the <dfn>spatial navigation steps</dfn> in <var>direction</var>, do the f
10441076
* If <var>candidates</var> contains at least 1 item:
10451077
1. Let <var>bestCandidate</var> be the result of <a>selecting the best candidate</a>
10461078
within <var>candidates</var> in <var>direction</var> starting from <var>searchOrigin</var>
1047-
2. <span class=api><a>Fire an event</a> named <a event>navbeforefocus</a> at <var>eventTarget</var> using {{NavigationEvent}}
1079+
2. If <a>navigation-override</a> <a>is enabled</a> in the [=node document=] of <var>eventTarget</var> for the <a spec=html for="/">origin</a> of the [=active document=] of the [=top-level browsing context=], then
1080+
<span class=api><a>fire an event</a> named <a event>navbeforefocus</a> at <var>eventTarget</var> using {{NavigationEvent}}
10481081
with its {{NavigationEvent/dir}} set to <var>direction</var> and {{NavigationEvent/relatedTarget}} set to <var>bestCandidate</var>
10491082
and with it's <code>bubbles</code> and <code>cancelable</code> attributes set to <code>true</code>,
10501083
and return if the result is <code>false</code></span>
10511084
3. Run the <a>focusing steps</a> for <var>bestCandidate</var> and return
10521085
* Else if <var>eventTarget</var> <a>can be manually scrolled</a>:
1053-
1. <span class=api><a>Fire an event</a> named <a event>navbeforescroll</a> at <var>eventTarget</var> using {{NavigationEvent}}
1086+
1. If <a>navigation-override</a> <a>is enabled</a> in the [=node document=] of <var>eventTarget</var> for the <a spec=html for="/">origin</a> of the [=active document=] of the [=top-level browsing context=], then
1087+
<span class=api><a>fire an event</a> named <a event>navbeforescroll</a> at <var>eventTarget</var> using {{NavigationEvent}}
10541088
with its {{NavigationEvent/dir}} set to <var>direction</var>
10551089
and {{NavigationEvent/relatedTarget}} set to <var>eventTarget</var>
10561090
and with it's <code>bubbles</code> and <code>cancelable</code> attributes set to <code>true</code>,
@@ -1062,14 +1096,16 @@ To run the <dfn>spatial navigation steps</dfn> in <var>direction</var>, do the f
10621096
within <var>container</var>, excluding <var>searchOrigin</var>
10631097
8. If <var>candidates</var> is empty:
10641098
* If <var>container</var> is a <a>scroll container</a> that <a>can be manually scrolled</a>:
1065-
1. <span class=api><a>Fire an event</a> named <a event>navbeforescroll</a> at <var>eventTarget</var> using {{NavigationEvent}}
1099+
1. If <a>navigation-override</a> <a>is enabled</a> in the [=node document=] of <var>eventTarget</var> for the <a spec=html for="/">origin</a> of the [=active document=] of the [=top-level browsing context=], then
1100+
<span class=api><a>fire an event</a> named <a event>navbeforescroll</a> at <var>eventTarget</var> using {{NavigationEvent}}
10661101
with its {{NavigationEvent/dir}} set to <var>direction</var>
10671102
and {{NavigationEvent/relatedTarget}} set to <var>container</var>
10681103
and with it's <code>bubbles</code> and <code>cancelable</code> attributes set to <code>true</code>,
10691104
and return if the result is <code>false</code></span>
10701105
2. <a>Directionally scroll the element</a> <var>container</var> in <var>direction</var> and return.
10711106
* Else,
1072-
1. <span class=api><a>Fire an event</a> named <a event>navnotarget</a> at <var>eventTarget</var> using {{NavigationEvent}}
1107+
1. If <a>navigation-override</a> <a>is enabled</a> in the [=node document=] of <var>eventTarget</var> for the <a spec=html for="/">origin</a> of the [=active document=] of the [=top-level browsing context=], then
1108+
<span class=api><a>fire an event</a> named <a event>navnotarget</a> at <var>eventTarget</var> using {{NavigationEvent}}
10731109
with its {{NavigationEvent/dir}} set to <var>direction</var> and {{NavigationEvent/relatedTarget}} set to <var>container</var>
10741110
and with it's <code>bubbles</code> and <code>cancelable</code> attributes set to <code>true</code>,
10751111
and return if the result is <code>false</code>.</span>
@@ -1088,7 +1124,8 @@ To run the <dfn>spatial navigation steps</dfn> in <var>direction</var>, do the f
10881124
and return to the step labeled <i>loop</i>.
10891125
9. Let <var>bestCandidate</var> be the result of <a>selecting the best candidate</a>
10901126
within <var>candidates</var> in <var>direction</var> starting from <var>searchOrigin</var>
1091-
10. <span class=api><a>Fire an event</a> named <a event>navbeforefocus</a> at <var>eventTarget</var> using {{NavigationEvent}}
1127+
10. If <a>navigation-override</a> <a>is enabled</a> in the [=node document=] of <var>eventTarget</var> for the <a spec=html for="/">origin</a> of the [=active document=] of the [=top-level browsing context=], then
1128+
<span class=api><a>fire an event</a> named <a event>navbeforefocus</a> at <var>eventTarget</var> using {{NavigationEvent}}
10921129
with its {{NavigationEvent/dir}} set to <var>direction</var> and {{NavigationEvent/relatedTarget}} set to <var>bestCandidate</var>
10931130
and with it's <code>bubbles</code> and <code>cancelable</code> attributes set to <code>true</code>,
10941131
and return if the result is <code>false</code></span>
@@ -1398,6 +1435,93 @@ To <dfn lt="directionally scroll an element | directionally scroll the element">
13981435

13991436
</div>
14001437

1438+
<h2 class=no-num id=privsec>
1439+
Appendix B. Privacy and Security Considerations</h2>
1440+
1441+
The specification contributors believe that
1442+
all known potential security risks associated with this specification
1443+
have been adequately addressed.
1444+
Further details are provided below.
1445+
1446+
The TAG has developed a self-review questionaire
1447+
to help editors and Working Groups evaluate the risks introduced by their specifications.
1448+
Answers are provided below.
1449+
1450+
<dl>
1451+
<dt>Does this specification deal with personally-identifiable information?
1452+
<dd>No.
1453+
1454+
<dt>Does this specification deal with high-value data?
1455+
<dd>No.
1456+
1457+
<dt>Does this specification introduce new state for an origin that persists across browsing sessions?
1458+
<dd>No.
1459+
1460+
<dt>Does this specification expose persistent, cross-origin state to the web?
1461+
<dd>No.
1462+
1463+
<dt>Does this specification expose any other data to an origin that it doesn’t currently have access to?
1464+
<dd>
1465+
Mostly, no.
1466+
1467+
The one exception identified would be in the following scenario:
1468+
if the author uses `window.navigate` while the focus is in a cross origin iframe,
1469+
if they don't get an event at all it means that either there was something scrollable or focusable within the iframe,
1470+
as the only case where they'd get an event is when the search didn't find anything at all goes up the tree.
1471+
1472+
This is so limited information that it does not seem it would introduces real a security risk,
1473+
but it is as far as the editors can tell information that the author could not get could not get otherwise.
1474+
1475+
<dt>Does this specification enable new script execution/loading mechanisms?
1476+
<dd>No.
1477+
1478+
<dt>Does this specification allow an origin access to a user’s location?
1479+
<dd>No.
1480+
1481+
<dt>Does this specification allow an origin access to sensors on a user’s device?
1482+
<dd>No.
1483+
1484+
<dt>Does this specification allow an origin access to aspects of a user’s local computing environment?
1485+
<dd>No.
1486+
1487+
<dt>Does this specification allow an origin access to other devices?
1488+
<dd>No.
1489+
1490+
<dt>Does this specification allow an origin some measure of control over a user agent’s native UI?
1491+
<dd>
1492+
No control is given over the appearance of the User Agent's UI.
1493+
Some control is given over how the User Agent performs spatial navigation,
1494+
which may be considered part of its user interface.
1495+
This is intentional, to let authors tailor the behavior of spatial navigation to their pages.
1496+
To prevent malicious authors to interefere with the users' desire to control focus and navigate the document,
1497+
this overriding mechanism is disabled by default for cross-origin iframes.
1498+
See [[#policy-feature]].
1499+
1500+
<dt>Does this specification expose temporary identifiers to the web?
1501+
<dd>No.
1502+
1503+
<dt>Does this specification distinguish between behavior in first-party and third-party contexts?
1504+
<dd>No.
1505+
1506+
<dt>How should this specification work in the context of a user agent’s "incognito" mode?
1507+
<dd>No Difference is expected.
1508+
1509+
<dt>Does this specification persist data to a user’s local device?<Paste>
1510+
<dd>No.
1511+
1512+
<dt>Does this specification have a "Security Considerations" and "Privacy Considerations" section?
1513+
<dd>Yes, this is the section you are reading now.
1514+
1515+
<dt>Does this specification allow downgrading default security characteristics?
1516+
<dd>
1517+
It does not allow downgrading any unrelated security mechanism.
1518+
1519+
It **does** allow authors to opt into allowing
1520+
the events needed to override the default behavior of spatial navigation
1521+
in cross origin iframes they trust
1522+
using [[feature-policy]].
1523+
See [[#policy-feature]].
1524+
</dl>
14011525

14021526
<h2 class=no-num id=ack>Acknowledgements</h2>
14031527

0 commit comments

Comments
 (0)