This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 21505 - This algorithm does not work well for data URLs. The origin of a data URL resource is a unique identifier. That seems broken for data URLs found in the same document.
Summary: This algorithm does not work well for data URLs. The origin of a data URL res...
Status: RESOLVED FIXED
Alias: None
Product: WHATWG
Classification: Unclassified
Component: HTML (show other bugs)
Version: unspecified
Hardware: Other other
: P3 normal
Target Milestone: Unsorted
Assignee: Ian 'Hixie' Hickson
QA Contact: contributor
URL: http://www.whatwg.org/specs/web-apps/...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-04-02 08:57 UTC by contributor
Modified: 2013-05-30 22:05 UTC (History)
3 users (show)

See Also:

Attachments

Description contributor 2013-04-02 08:57:06 UTC 
Specification: http://www.whatwg.org/specs/web-apps/current-work/
Multipage: http://www.whatwg.org/C#downloading-resources
Complete: http://www.whatwg.org/c#downloading-resources

Comment:
This algorithm does not work well for data URLs. The origin of a data URL
resource is a unique identifier. That seems broken for data URLs found in the
same document.

Posted from: 207.218.72.65
User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.6 Safari/537.36
Comment 1 Ian 'Hixie' Hickson 2013-04-09 17:56:05 UTC 
The fix here is to make the step that says "Let resource origin be the origin of the resource being downloaded" instead say that /resource origin/ is the origin of the resource's URL, unless its scheme is data:, in which case it's the same as interface origin. (And move the step that defines 'interface origin' up so we can refer to it.)

Right?
Comment 2 Anne 2013-04-10 10:55:25 UTC 
Yes, I think for now that is fine.

In the future this can use the resource's CORS-same-origin vs CORS-cross-origin flag as the former will be set for data URL downloads.
Comment 3 contributor 2013-05-30 22:05:59 UTC 
Checked in as WHATWG revision r7873.
Check-in comment: Allow data: URLs to be given download='' attribute names.
http://html5.org/tools/web-apps-tracker?from=7872&to=7873