@@ -4259,7 +4259,7 @@ while still preserving as much of the <em>usefulness</em> of '':visited'' as pos
4259
4259
containing [=tuples=] of three pieces of information:
4260
4260
* a visited [=/URL=]
4261
4261
* an [=/origin=] for the site that started a navigation
4262
- * an [=/origin =] for the top-level site containing the frame that started the navigation.
4262
+ * a [=/site =] for the top-level site containing the frame that started the navigation.
4263
4263
(This will often be the same as the previous,
4264
4264
but can differ if the user clicks a link in a iframe, for example.)
4265
4265
@@ -4270,8 +4270,8 @@ while still preserving as much of the <em>usefulness</em> of '':visited'' as pos
4270
4270
add an entry to |visited history|
4271
4271
recording the navigation's destination URL,
4272
4272
the origin of the page containing the link or script,
4273
- and the origin of the top-level site containing that page
4274
- (which might be the same as the previous origin).
4273
+ and the (schemeful) site of the top-level site containing that
4274
+ page (which might be the same site as the previous origin).
4275
4275
4276
4276
Note: This allows a site to see '':visited'' information
4277
4277
for links that the user has clicked
@@ -4280,9 +4280,10 @@ while still preserving as much of the <em>usefulness</em> of '':visited'' as pos
4280
4280
where the site is A.
4281
4281
4282
4282
Additionally, add an entry to |visited history|
4283
- recording the destination's URL,
4284
- and the <em> destination's</em> origin
4285
- for both origin values.
4283
+ recording the destination's URL, the <em> destination's</em>
4284
+ origin, and the <em> destination's</em> site. Do this only
4285
+ for navigations from top-level frames or iframes which are
4286
+ same-origin with their top-level frame.
4286
4287
4287
4288
Note: This allows for a site to see '':visited'' information about its own pages
4288
4289
(which is already observable by the site)
@@ -4304,11 +4305,11 @@ while still preserving as much of the <em>usefulness</em> of '':visited'' as pos
4304
4305
only allow it to match '':visited'' if
4305
4306
the link's destination,
4306
4307
the origin of the page containing the link,
4307
- and the origin of the top-level site containing the link
4308
+ and the top-level site containing the link
4308
4309
match a tuple in |visited history|.
4309
4310
4310
4311
<div class=note>
4311
- The inclusion of both page origin and top-level site origin
4312
+ The inclusion of both page origin and top-level site
4312
4313
prevents several possible privacy attacks,
4313
4314
such as:
4314
4315
0 commit comments