Skip to content

Only allow sessions to use features they explicity request or are implicitly granted based on mode #1189

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Apr 2, 2021
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
permissions: Only inherit granted features that are explicitly requested
  • Loading branch information
Manishearth committed Mar 30, 2021
commit b3027283234f3ddee902997373e262861085beee
9 changes: 5 additions & 4 deletions index.bs
Original file line number Diff line number Diff line change
Expand Up @@ -2799,11 +2799,12 @@ To <dfn>resolve the requested features</dfn> given |requiredFeatures| and |optio

1. Let |consentRequired| be an empty [=/list=] of {{DOMString}}.
1. Let |consentOptional| be an empty [=/list=] of {{DOMString}}.
1. Let |granted| be an empty [=/list=] of {{DOMString}}.
1. Let |device| be the result of [=obtain the current device|obtaining the current device=] for |mode|, |requiredFeatures|, and |optionalFeatures|.
1. Let |granted| be a [=/list=] of {{DOMString}} initialized to |device|'s [=XR device/list of enabled features=] for |mode|.
1. Let |previouslyEnabled| be |device|'s [=XR device/list of enabled features=] for |mode|.
1. If |device| is `null` or |device|'s [=list of supported modes=] does not [=list/contain=] |mode|, run the following steps:
1. Return the [=tuple=] (|consentRequired|, |consentOptional|, |granted|)
1. Add every [=feature descriptor=] in the [=default features=] table associated with |mode| to the indicated feature list if it is not already present.
1. Add every [=feature descriptor=] in the [=default features=] table associated with |mode| to |granted| if it is not already present.
1. For each |feature| in |requiredFeatures| perform the following steps:
1. If the |feature| is `null`, [=continue=] to the next entry.
1. If |feature| is not a valid [=feature descriptor=], perform the following steps:
Expand All @@ -2813,7 +2814,7 @@ To <dfn>resolve the requested features</dfn> given |requiredFeatures| and |optio
1. If |feature| is already in |granted|, continue to the next entry.
1. If the requesting document's [=origin=] is not allowed to use any [[#permissions-policy|permissions policy]] required by |feature| as indicated by the [=feature requirements=] table, return `null`.
1. If |session|'s [=XRSession/XR device=] is not [=capable of supporting=] the functionality described by |feature| or the user agent has otherwise determined to reject the feature, return `null`.
1. If the functionality described by |feature| requires [=explicit consent=], append it to |consentRequired|.
1. If the functionality described by |feature| requires [=explicit consent=] and |feature| is not in |previouslyEnabled|, append it to |consentRequired|.
1. Else append |feature| to |granted|.
1. For each |feature| in |optionalFeatures| perform the following steps:
1. If the |feature| is `null`, [=continue=] to the next entry.
Expand All @@ -2824,7 +2825,7 @@ To <dfn>resolve the requested features</dfn> given |requiredFeatures| and |optio
1. If |feature| is already in |granted|, continue to the next entry.
1. If the requesting document's origin is not allowed to use any [[#permissions-policy|permissions policy]] required by |feature| as indicated by the [=feature requirements=] table, continue to the next entry.
1. If |session|'s [=XRSession/XR device=] is not [=capable of supporting=] the functionality described by |feature| or the user agent has otherwise determined to reject the feature, continue to the next entry.
1. If the functionality described by |feature| requires [=explicit consent=], append it to |consentOptional|.
1. If the functionality described by |feature| requires [=explicit consent=] and |feature| is not in |previouslyEnabled|, append it to |consentOptional|.
1. Else append |feature| to |granted|.
1. Return the [=tuple=] `(|consentRequired|, |consentOptional|, |granted|)`

Expand Down