Fenced Frame

• If embedder is an iframe element, then: the flags set on embedder’s iframe sandboxing flag set.

• If embedder is a fencedframe element, then: the flags set on embedder’s fencedframe sandboxing flag set.

1. Let nested traversable be the result of creating a new nested traversable for element.

2. Set nested traversable’s loading mode to "fencedframe".

3. If element has a sandbox attribute, then parse a sandboxing directive given the attribute’s value and element’s fencedframe sandboxing flag set.

It’s not necessary to call the URL and history update steps as we do during usual child navigable creation or top-level traversable creation, but we still need a mechanism to initialize History.length in the new navigable. This is an existing issue in the HTML Standard: https://github.com/whatwg/html/issues/9030.

TODO: destroy the nested traversable

1. If this is not connected:

   1. Assert: this's fenced navigable is null.

      Note: This holds because when the element has been removed from the DOM, its removal steps immediately destroy the fenced navigable.

2. Let navigation url or urn be the given FencedFrameConfig's url if the given FencedFrameConfig's url is not null, and the given FencedFrameConfig's urn otherwise.

3. If navigation url or urn is failure, then return.

4. Let shared storage context be the given FencedFrameConfig's sharedStorageContext.

5. Navigate element’s fenced navigable to navigation url or urn using element’s node document, with historyHandling set to "replace", referrerPolicy set to "no-referrer", and shared storage context.

   Note: See § 3.8.5 Actual navigation changes for the fencedframe-specific changes to the ordinary navigation flow.

1. Assert: namespace is the HTML namespace.

2. If localName is sandbox, then:

   1. If value is null, then empty element’s fencedframe sandboxing flag set.

   2. Otherwise, run parse a sandboxing directive given the value and element’s fencedframe sandboxing flag set.

1. Let pendingMapping be mapping’s pending config mapping.

2. If the size of pendingMapping + the size of mapping’s finalized config mapping ≥ mapping’s maximum number of configs, return failure.

3. Let urn be a randomly generated urn uuid.

4. Assert: urn does not exist in pendingMapping.

5. Set pendingMapping[urn] to config.

6. Return urn.

1. Let pendingMapping be mapping’s pending config mapping.

2. Let finalizedMapping be mapping’s finalized config mapping.

3. If pendingMapping[urn] does not exist, return failure.

4. Remove pendingMapping[urn].

5. Set finalizedMapping[urn] to config.

1. Let nestedMapping be mapping’s nested config mapping.

2. If nestedConfigs is null, return.

3. For each urn → config of nestedConfigs:

   1. Set nestedMapping[urn] to config.

   2. Set nestedMapping[urn]'s is ad component to true.

1. Let nestedMapping be mapping’s nested config mapping.

2. Let pendingMapping be mapping’s pending config mapping.

3. Let finalizedMapping be mapping’s finalized config mapping.

4. If nestedMapping[urn] exists, return its value.

5. If pendingMapping[urn] exists, wait until it does not exist.

6. If finalizedMapping[urn] exists, return its value.

7. Return failure.

1. Assert that reporting map[destination] is a list (i.e., that destination’s metadata has not yet been finalized).

2. Let pending event list be reporting map[destination].

3. Set reporting map[destination] to a struct with the following items:

   reporting url declarer origin

   reporting url declarer origin

   reporting url map

   destination map

   reporting macro map

   macro map

4. For each pending event of pending event list:

   1. Send a beacon with destination map, pending event’s event, pending event’s request initiator, and pending event’s initiator referrer policy.

1. Let destination url be an empty string.

2. Let attributionReportingEligibility be "unset".

3. Let processResponse be null.

4. Let useParallelQueue be false.

5. If event is either a destination enum event or an automatic beacon event, then:

   1. Let destination map be destination info’s reporting url map.

   2. Let eventType be either event’s destination type, or automatic type, depending on which variant event is.

   3. If destination map[eventType] does not exist, return.

   4. Set destination url to destination map[eventType].

   5. If event’s attributionReportingEnabled is true and event’s attributionReportingContextOrigin is suitable:

      1. If event’s eventType matches one of the automatic beacon event type values, set attributionReportingEligibility to "navigation-source".

      2. Otherwise, set attributionReportingEligibility to "event-source".

      3. Set processResponse to these steps given a response response:

         1. Let fenced be true.

         2. Run process an attribution eligible response with event’s attributionReportingContextOrigin, attributionReportingEligibility, fenced, and response.

      4. Set useParallelQueue to true.

6. Otherwise:

   1. Assert: event is a destination URL event.

   2. Let macro map be destination info’s reporting macro map.

   3. If macro map is null, return.

   4. Set destination url to event.

   5. Let destination url be the result of substituting macros with macro map into destination url.

7. Optionally, return.

   Note: This implementation-defined condition is intended to allow user agents to drop the beacon for a number of reasons, for example user opt-out or destination url’s site not being enrolled.

8. Let request be a new request with the following properties:

   method

   POST if event is a destination enum event, otherwise GET.

   URL

   destination url

   header list

   A new header list containing a header whose name is "Content-Type" and value is "text/plain".

   body

   If event is a destination enum event, a body whose source is event’s data, otherwise null.

   client

   null

   service-workers mode

   "all"

   The default is "all", so we technically don’t have to set anything here. We do in order to remind ourselves that it might be more appropriate to skip service workers here, like some other beacons.

   origin

   request initiator if event is a destination URL event, and destination info’s reporting url declarer origin otherwise.

   Note: The reporting destination for a destination URL event is determined by the Document that calls reportEvent(), as opposed to a destination enum event or automatic beacon event whose reporting destinations are determined in the worklet that created the fenced frame config that loaded this Document. We set the origin to the origin of the Document or worklet that determined the reporting destination to prevent cross-site request forgery.

   referrer

   request initiator

   referrer policy

   initiator referrer policy

   mode

   "cors"

   credentials mode

   "omit"

   Attribution Reporting eligibility

   attributionReportingEligibility

9. Fetch request with processResponse being processResponse if it is not null and useParallelQueue being useParallelQueue.

   Note: This algorithm can be invoked from while in parallel or while on a Document's main thread. To handle the in parallel invocation correctly, we invoke fetch with useParallelQueue set to true when the optional response-handling algorithm is used, otherwise there is no need to do this even when this algorithm is running in parallel in other instances.

1. Let metadata be reporter’s fenced frame reporting metadata reference.

2. If destination is "direct-seller":

   1. If metadata’s direct seller is seller is true, set destination to "seller".

   2. Otherwise, set destination to "component-seller".

3. If event is a destination URL event:

   1. If event’s origin is not same origin with any of the entries in metadata’s allowed reporting origins:

      1. Set metadata’s attempted custom url report to disallowed origin to true.

   2. If metadata’s attempted custom url report to disallowed origin is true, return.

4. Let reporting map be a reference to metadata’s fenced frame reporting map.

5. If reporting map[destination] does not exist, return.

6. If reporting map[destination] is a list:

   1. Let newEvent be a new pending event with the following:

      destination

      destination

      event

      event

      request initiator

      request initiator

      initiator referrer policy

      initiator referrer policy

   2. Append newEvent to reporting map[destination].

   3. Return.

      Note: The pending event will be sent asynchronously.

7. Assert that reporting map[destination] is a map (i.e., that destination’s metadata has been finalized).

8. Send a beacon with reporting map[destination], event, request initiator, and initiator referrer policy.

1. If event’s eventType starts with "reserved.", then return.

2. reporter event TODO: Fill this in

mapped url

config’s mapped url's value

container size

config’s container size

content size

config’s content size if null, otherwise config’s content size's value

interest group descriptor

config’s interest group descriptor if null, otherwise config’s interest group descriptor's value

on navigate callback

config’s on navigate callback

effective sandboxing flags

config’s effective sandboxing flags if null, otherwise config’s effective sandboxing flags's value

effective enabled permissions

config’s effective enabled permissions if null, otherwise config’s effective enabled permissions's value

fenced frame reporter

1. If config’s fenced frame reporting metadata's value is null, set to null.

2. Otherwise, set to a fenced frame reporter with the following members:

   fenced frame reporting metadata reference

   a reference to config’s fenced frame reporting metadata's value

exfiltration budget metadata reference

1. If config’s exfiltration budget metadata is null, set to null.

2. Otherwise, set to a exfiltration budget metadata reference:

   origin

   config’s exfiltration budget metadata's value's origin

   amount to debit reference

   a reference to config’s exfiltration budget metadata's value's amount to debit

nested configs

1. If config’s nested configs is null, set to null.

2. Otherwise:

   1. Let results be a new map.

   2. For each nested config of config’s nested configs's value:

      1. Let urn be a randomly generated urn uuid.

      2. Set results[urn] to nested config.

   3. Set nested configs to results.

partition nonce

a random, unique partition nonce

embedder shared storage context

config’s embedder shared storage context

is ad component

config’s is ad component

cross-origin reporting allowed

config’s cross-origin reporting allowed

has disabled untrusted network

false

1. Let config be a new FencedFrameConfig object.

2. Set config’s url to the result of running the URL parser on url.

3. Return config.

1. If forStorage is true, then throw a DataCloneError DOMException.

2. Set serialized.[[Url]] to value’s url.

3. Set serialized.[[Urn]] to value’s urn.

4. Set serialized.[[SharedStorageContext]] to value’s sharedStorageContext.

1. Initialize value’s url to serialized.[[Url]].

2. Initialize value’s urn to serialized.[[Urn]].

3. Initialize value’s sharedStorageContext to serialized.[[SharedStorageContext]].

1. TODO: Spec this. Substitute the keys from macros with the corresponding values into string, and return the new string. There is no recursive substitution.

1. Let urn be null.

2. If urnOrConfig is a USVString, set urn to urnOrConfig.

3. Otherwise, set urn to urnOrConfig’s urn.

4. If urn is not a valid urn uuid (i.e., won’t pass the ABNF in Section 3 of urn uuid), throw a TypeError.

5. For each key → _ of replacements:

   1. If key does not start with ${ or %%, throw a TypeError.

   2. If key does not end with } or %%, throw a TypeError.

6. Let p be a new promise.

7. Let global be this's relevant global object.

8. Run the following steps in parallel:

   1. Let mapping be global’s navigable's traversable navigable's fenced frame config mapping.

   2. Let config be the result of finding a config in mapping with urn.

   3. If config is failure, queue a global task on the DOM manipulation task source given global, to resolve p with undefined, and abort these steps.

   4. Let substitutedUrl be the result of substituting macros with replacements into config’s mapped url's value.

   5. Set config’s mapped url's value to substitutedUrl.

   6. Queue a global task on the DOM manipulation task source given global, to resolve p with undefined.

9. Return p.

1. Let urn be null.

2. If urnOrConfig is a USVString, set urn to urnOrConfig.

3. Otherwise, set urn to urnOrConfig’s urn.

4. If urn is not a valid urn uuid (i.e., won’t pass the ABNF in Section 3 of urn uuid), throw a TypeError.

5. Let p be a new promise.

6. Let global be this's relevant global object.

7. Run the following steps in parallel:

   1. Let mapping be global’s navigable's traversable navigable's fenced frame config mapping.

   2. If mapping’s finalized config mapping[urn], does not exist, then queue a global task on the DOM manipulation task source given global, to resolve p with undefined, and abort these steps.

   3. Let config be mapping’s finalized config mapping[urn].

   4. Queue a global task on the DOM manipulation task source given global, to resolve p with config’s mapped url's value.

   5. If send_reports is true, then run the steps in config’s on navigate callback.

8. Return p.

1. Let instance be this's relevant global object's browsing context's fenced frame config instance.

2. If instance is null, then throw a DOMException.

3. If this's relevant settings object's origin and instance’s mapped url's origin are not same origin, then then throw a DOMException.

4. Let maxAdComponents be 40.

5. If numAdComponents > maxAdComponents, then set numAdComponents to maxAdComponents.

6. Let adComponentsURNs be an empty list of urns.

7. For each urn → config of instance’s nested configs:

   1. If numAdComponents equals 0, then break.

   2. Append urn to adComponentsURNs.

   3. Set numAdComponents to numAdComponents − 1.

8. Return adComponentsURNs.

1. Let instance be this's relevant global object's browsing context's fenced frame config instance.

2. If instance is null, then return.

3. If instance’s is ad component is true, then return.

4. If instance’s fenced frame reporter is null, then return.

5. Let document be this's relevant global object's associated Document.

6. Let request initiator be this's relevant settings object's origin.

7. Let initiator referrer policy be document’s policy container's referrer policy.

8. If event is a DOMString:

   1. If this's relevant settings object's origin and instance’s mapped url's origin are not same origin, then return.

   2. Run report a private aggregation event using instance’s fenced frame reporter with event.

9. If event is a FenceEvent:

   1. If event’s eventType starts with "reserved.", then return.

   2. If all of the following conditions are true:

      • this's relevant settings object's origin and instance’s mapped url's origin are not same origin;

      • either event’s crossOriginExposed is false or instance’s cross-origin reporting allowed is false;

      then return.

   3. If event has a destinationURL:

      1. If event has a destination or a eventType or a eventData:

         1. Throw a TypeError.

      2. Let destinationURL be the result of running the URL parser on destinationURL.

      3. Throw a TypeError if any of the following conditions hold:

         • destinationURL is failure;

         • destinationURL scheme is not "https";

      4. Run report an event using instance’s fenced frame reporter with buyer, request initiator, initiator referrer policy and a destination URL event that is event’s destinationURL.

   4. Otherwise:

      1. If event does not have a destination or event does not have a eventType:

         1. Throw a TypeError.

      2. Let attributionReportingEnabled be the result of determining whether document is allowed to use the "attribution-reporting" feature.

      3. Let attributionReportingContextOrigin be document’s context origin.

      4. For each destination of event’s destination:

         1. Run report an event using instance’s fenced frame reporter with destination, request initiator, initiator referrer policy, and a destination enum event with the following items:

            type

            event’s eventType

            data

            event’s eventData (or the empty string if it is not defined).

         attributionReportingEnabled

         attributionReportingEnabled

         attributionReportingContextOrigin

         attributionReportingContextOrigin

1. If event does not have a destination or event does not have a eventType:

   1. Throw a TypeError.

2. If event’s eventType does not match one of the automatic beacon event type values, return.

3. Let instance be this's relevant global object's browsing context's fenced frame config instance.

4. If instance is null, then return.

5. If this's relevant settings object's origin and instance’s mapped url's origin are not same origin, then return.

6. If instance’s fenced frame reporter is null, then return.

7. Set this's relevant global object's associated Document's automatic beacon data map[event’s eventType] to an automatic beacon data with the following items:

   eventData

   event’s eventData if defined and instance’s is ad component is false, otherwise empty string.

   destination

   event’s destination

   once

   event’s once

   crossOriginExposed

   event’s crossOriginExposed

1. Let instance be this's relevant global object's browsing context's fenced frame config instance.

2. If instance is null, then return.

3. If this's relevant settings object's origin and instance’s mapped url's origin are not same origin, then return.

4. If instance’s nested configs is null, then return.

5. Let results be an empty list of FencedFrameConfigs.

6. For each urn → config of instance’s nested configs:

   1. Let newConfig be a new FencedFrameConfig object created in this's relevant realm, with the following:

      urn

      urn

      sharedStorageContext

      config’s embedder shared storage context

   2. Append newConfig to results.

7. Return results.

1. If this's Document is not fully active, then return.

2. Let navigable be this's relevant global object's navigable.

3. If any of the following conditions are met, then throw a SecurityError DOMException:

   • navigable is not a fenced navigable;

   • event’s isTrusted is false;

   • event’s dispatch flag is unset;

   • event’s type is not "click"

4. If this's relevant global object does not have transient activation, then return.

5. Consume user activation for this's relevant global object.

6. Let parentNavigable be navigable’s unfenced parent.

7. Queue a global task on the DOM manipulation task source given parentNavigable’s active window to run these steps:

   1. Perform the activation notification steps.

   2. Fire an event named "fencedtreeclick" at navigable’s fenced navigable container. Initialize the event’s bubbles and cancelable attributes to true. When running the inner event creation steps, set the time to an implementation-defined value that is consistent across all invocations of this method.

1. Let p be a new promise.

2. Let instance be this's relevant global object's browsing context's fenced frame config instance.

3. If the relevant settings object's origin and instance’s mapped url's origin are not same origin, then reject p with a TypeError.

4. If this's relevant global object's navigable's traversable navigable is not a fenced navigable, then resolve p with undefined and return p.

5. Let global be this's relevant global object.

6. Run the following steps in parallel:

   1. Let fencedFrameNonce be instance’s partition nonce.

   2. Let credentiallessNonce be

   the page credentialless nonce (WICG/fenced-frame#191)

   1. Invoke revoke network for a partition nonce on fencedFrameNonce.

   2. Invoke revoke network for a partition nonce on credentiallessNonce.

   3. Set instance’s has disabled untrusted network to true.

   4. Wait on all nested fenced frames to disable network too.

   Spec this waiting more formally. (WICG/fenced-frame#151)

   1. Queue a global task on the DOM manipulation task source given global, to resolve p with undefined.

7. Return p.

1. Append nonce to the user agent’s network revocation nonce set.

2. Terminate this's relevant settings object's fetch group.

1. If the user agent’s network revocation exemption map[nonce] exists, and if requestURL exists in it, return allowed.

2. If the user agent’s network revocation nonce set contains nonce, return blocked.

3. Return allowed.

If should request be blocked due to a bad port, should fetching request be blocked as mixed content, or should request be blocked by Content Security Policy returns blocked, then set response to a network error.

Add "must be blocked due to a revoked partition nonce" to the conditions after "should request be blocked by Content Security Policy".

A user agent should set value to the first matching statement, if any, switching on request’s destination:

Add "fencedframe" to the switch cases alongside "document", "frame", and "iframe".

1. If targetDocument’s node navigable's traversable navigable is not a top-level traversable, abort these steps.

2. If sourceSnapshotParams’s has transient activation is set to false, abort these steps.

3. Let config be sourceSnapshotParams’s initiator fenced frame config instance.

4. If config is null, abort these steps.

   Note: Since this algorithm is called unconditionally for all navigations, this is used to catch cases where a navigation to a top-level traversable does not originate from a fencedframe.

5. Let request initiator be sourceOrigin if config’s is ad component is false, and sourceSnapshotParams’s initiator ancestor root origin otherwise.

6. Let initiator referrer policy be sourceSnapshotParams’s source policy container's referrer policy if config’s is ad component is false, and sourceSnapshotParams’s initiator ancestor root referrer policy otherwise.

7. Let beacon data be sourceSnapshotParams’s automatic beacon data map[eventType].

8. Let has header opt in be sourceSnapshotParams’s automatic beacons allowed.

9. If beacon data is null and has header opt in is false, abort these steps.

10. Let is cross origin be true if sourceOrigin is not same origin with config’s mapped url's origin, false otherwise.

11. If is cross origin is true and has header opt in is false, abort these steps.

12. Let should send beacon with data be true if beacon data is not null and either is cross origin is false or beacon data’s crossOriginExposed is true, false otherwise.

13. For each destination of config’s fenced frame reporter's fenced frame reporting metadata reference's fenced frame reporting map's keys:

    1. Run report an event using config’s fenced frame reporter with destination, request initiator, initiator referrer policy, and an automatic beacon event with the following items:

       type

       eventType

       data

       beacon data’s eventData if should send beacon with data is true, beacon data’s destinations contains destination, and config’s is ad component is false, the empty string otherwise.

       attributionReportingEnabled

       sourceSnapshotParams’s attribution reporting enabled

       attributionReportingContextOrigin

       sourceSnapshotParams’s attribution reporting context origin

14. If beacon data’s once is true, set sourceSnapshotParams’s automatic beacon data map[eventType] to null.

5. Attempt to send an automatic beacon given sourceSnapshotParams, initiatorOriginSnapshot, navigable’s associated Document, and reserved.top_navigation_start.

6. If failure is false, then:

   1. Attempt to send an automatic beacon given sourceSnapshotParams, entry’s document state's initiator origin, document, and reserved.top_navigation_commit.

   2. Attempt to send an automatic beacon given sourceSnapshotParams, entry’s document state's initiator origin, document, and reserved.top_navigation.

1. If this's browsing context's fenced frame config instance is not null, then return this's fence.

2. Return null.

• If creator is non-null, then:

to instead use the tighter condition:

• If creator is non-null and embedder is not a fencedframe element, then:

Note: This is because we need to ensure that we do not leak creator’s referrer, origin, document base url, policy container, across the fenced frame boundary.

Add a substep to step 4 of this algorithm (that was modified above) that reads:

4. Set browsingContext’s fenced frame config instance to creator’s browsing context's fenced frame config instance.

Rewrite step 3 to read:

3. If responseURL is local, initiatorPolicyContainer is not null, and fenced false, then return a clone of initiatorPolicyContainer.

Note: We do not need to modify the case where responseURL is about:srcdoc, because navigations to about:srcdoc are not supported in fenced frames.

23. Let fenced be true if navigable is a fenced navigable, false otherwise.

    Note: This ensures fenced is true regardless of whether the initiator Document is navigable’s active document or its unfenced parent.

Rewrite step 23 (now step 24) to read:

24. Let resultPolicyContainer be the result of determining navigation params policy container given response’s URL, entry’s document state's history policy container, sourceSnapshotParams’s source policy container, null, responsePolicyContainer, and fenced.

1. If navigable is a child navigable, return navigable’s parent.

2. Assert: navigable is a fenced navigable.

3. Return navigable’s unfenced parent.

Note: This algorithm is different from the traversable navigable's unfenced parent getter in that this algorithm first tries to get the navigable's normal parent if navigable is a normal child navigable.

1. Let parentNavigable be navigable’s unfenced parent.

2. Return parentNavigable’s active document.

1. Initialize the navigable traversable given documentState.

2. Set traversable’s unfenced parent to parent.

1. Let group be a new browsing context group.

Note: There doesn’t seem to be a reason to append group to the user agent’s browsing context group set like create a new browsing context group and document does.

1. Let document be the second return value of creating a new browsing context and document given element node document, element, and group.

2. Let documentState be a new document state, whose document is document.

3. Let traversable be a new traversable navigable.

4. Let parentNavigable be element’s node navigable.

5. Initialize the nested traversable traversable given documentState and parentNavigable.

6. Set element’s fenced navigable to traversable.

7. Let initialHistoryEntry be traversable’s active session history entry.

8. Set initialHistoryEntry’s step to 0.

9. Append initialHistoryEntry to traversable’s session history entries.

10. Return traversable.

1. Let navigable be inputNavigable.

2. While:

   1. If navigable’s parent and unfenced parent are both null, then break.

   2. Set navigable to navigable’s parent or unfenced parent, whichever is non-null.

      Note: Exactly one of navigable’s parent or unfenced parent will be non-null here.

3. Return navigable.

Further rewrite step 2 of this algorithm to:

2. Extend navigables with document’s descendant navigables with unfenced set to unfenced.

1. Let navigables be a new list.

2. Let navigableContainers be a list of all shadow-including descendants of document that are navigable containers (or fenced navigable containers, if unfenced is true), in shadow-including tree order.

3. For each navigableContainer of navigableContainers:

   1. If navigableContainer’s content navigable and fenced navigable are both null, then continue.

   2. Let descendantNavigable be either navigableContainer’s content navigable or fenced navigable, whichever is non-null.

   3. Extend navigables with descendantNavigable’s active document's inclusive descendant navigables with unfenced set to unfenced.

4. Return navigables.

1. Let navigable be document’s node navigable's parent.

2. If navigable is null and unfenced is true, set navigable to document’s node navigable's traversable navigable's unfenced parent.

3. Let ancestors be an empty list.

4. While navigable is not null:

   1. Prepend navigable to ancestors.

   2. Set navigable to navigable’s parent.

   3. If navigable is null and unfenced is true, set navigable to navigable’s traversable navigable's unfenced parent.

5. Return ancestors.

Add a new step after step 3 of the algorithm (that changes new focus target) that reads:

3. If new focus target is a fenced navigable container with non-null fenced navigable, then set new focus target to the fenced navigable's active document.

Add a new step after the step that defines the new chain variable, that reads:

9. If unfenced is false, new chain contains a Document document whose node navigable's traversable navigable is a fenced navigable, and old chain does not also contain document, then return.

   Note: This is how we bail-out early just before calling the focus update steps, in the case where focus is trying to cross the fence.

Modify the user agent sentence after the algorithm steps in focusing steps to read:

User agents must immediately run the focusing steps for a focusable area or navigable candidate with unfenced set to true whenever the user attempts to move the focus to candidate.

1. Run the focusing steps for the element with unfenced set to true.

2. Fire a click event at the element.

When a user activates a click focusable focusable area, the user agent must run the focusing steps on the focusable area with focus trigger set to "click" and unfenced set to true.

10. If previouslyFocusedElement is not null, then:

    1. Set element’s previously focused element to null.

    2. If focusPreviousElement is true, then run the focusing steps for previouslyFocusedElement with unfenced set to true; the viewport should not be scrolled by doing this step.

Note: Although dismissing a popover manually is a user-initiated gesture, the focusing steps will be called with unfenced set to false regardless of whether this was called from user gesture or via a script call.

• User agents may focus one of those elements in the process, by running the focusing steps for that element, and may change the scrolling position of the document, or perform some other action that brings the element to the user’s attention. If these steps were invoked by user gesture, focusing steps can be called with unfenced set to true. For elements that are form-associated custom elements, user agents should use their face validation anchor instead, for the purposes of these actions.

3. If the focused area of candidate is a fenced navigable container with a non-null fenced navigable, then set candidate to the active document of that fenced navigable container's fenced navigable.

3. If currentObject is a focusable area, then set currentObject to currentObject’s DOM anchor's node document.

   Otherwise, if currentObject is a Document whose node navigable's parent is non-null, then set currentObject to currentObject’s node navigable's parent.

   Otherwise, if currentObject is a Document whose node navigable is a traversable navigable whose unfenced parent is non-null, then set currentObject to currentObject’s node navigable's unfenced parent.

   Otherwise, break.

If focus target is a fenced navigable container with a non-null fenced navigable

Return the fenced navigable container's fenced navigable's active document.

Note: This algorithm can unconditionally "jump the fence" boundary because its return value always feeds into an algorithm that does carefully consider the fence boundary.

3. While candidate’s focused area is either a navigable container with a non-null content navigable or a fenced navigable container with a non-null fenced navigable: set candidate to the active document of either that navigable container's content navigable or that fenced navigable container's fenced navigable, whichever is non-null.

6. If candidate is not null, then run the focusing steps for candidate with unfenced set to true and return.

Modify step 9 of the sequential focus navigation algorithm to read:

9. Otherwise, starting point is a focusable area whose node document's node navigable is a child navigable or fenced navigable. Set starting point to that node navigable's unfenced parent and return to the step labeled loop.

2. If candidate is a navigable container with a non-null content navigable, then let new candidate be the result of running the sequential navigation search algorithm with candidate’s content navigable as the first argument, direction as the second, and sequential as the third.

   If candidate is a fenced navigable container with a non-null fenced navigable, then let new candidate be the result of running the sequential navigation search algorithm with candidate’s fenced navigable as the first argument, direction as the second, and sequential as the third.

   If new candidate is null, then let starting point be candidate, and return to the top of this algorithm. Otherwise, let candidate be new candidate.

8. Otherwise, if all of the following conditions are true:

   • navigationParams’s navigable's traversable navigable is a fenced navigable;

   • navigationParams’s response's URL's scheme is "https"; and

   • the result of getting the supported loading modes for navigationParams’s response does not contain `fenced-frame`

   then set failure to true.

• navigable’s container document

with:

• navigable’s unfenced container document

1. If response is not a network error, navigable is a child navigable or fenced navigable, and the result of performing a cross-origin resource policy check with navigable’s unfenced container document's origin, navigable’s unfenced container document's relevant settings object, request’s destination, response, and true is blocked, then set response to a network error and break.

   Note: Here we’re running the cross-origin resource policy check against the unfenced parent navigable rather than navigable itself. This is because we care about the same-originness of the embedded content against the embedder’s context (ignoring the "fence"), not the navigation source.

initiator fenced frame config instance

a fenced frame config instance or null, initially null.

initiator ancestor root origin

an origin or null, initially null.

initiator ancestor root referrer policy

an referrer policy or null, initially null.

target fenced frame config

a fenced frame config or null, initially null.

Note: The initiator fenced frame config instance is the fenced frame config instance that’s loaded into a navigation initiator’s browsing context, if any exists. The initiator ancestor root origin, for component ads, is the origin of the top-level ad container, if any exists. The initiator ancestor root referrer policy, for component ads, is the referrer policy of the top-level ad container, if any exists. They are used by the attempt to send an automatic beacon algorithm to compare origins and determine which FenceReportingDestinations to send beacons and with what information, if the fencedframe-initiated navigation succeeds. The target fenced frame config on the other hand, is the non-instantiated fenced frame config that will be loaded into a fencedframe element for navigations targeting fenced frames. These fields do not interact together in any meaningful way.

attribution reporting enabled

a boolean.

attribution reporting context origin

an origin.

automatic beacons allowed

an boolean.

automatic beacon data map

a map whose keys are automatic beacon event types and whose values are null or an automatic beacon data

1. Assert these steps are running on sourceDocument’s event loop.

2. Let automatic beacon data map be a new empty automatic beacon data map.

3. Let current navigable be sourceDocument’s node navigable.

4. While current navigable is not null:

   1. For each type → data of current navigable’s active document's automatic beacon data map:

      1. If automatic beacon data map[type] does not exist, set automatic beacon data map[type] to data.

      Note: This guarantees that the first ancestor that contains automatic beacon data for a specific type will be usable by the document initiating the navigation. This will also prevent an ancestor blocking a document from using data set in a higher ancestor.

   2. Set current navigable to current navigable’s parent.

5. Return automatic beacon data map.

Note: The returned map is meant to hold references to the original Document's automatic beacon data maps that were used to build automatic beacon data map. These are later modified in attempt to send an automatic beacon to clear out any beacon data with once set to true.

1. Let navigable be sourceDocument’s node navigable.

2. While navigable is not null and navigable is not a fenced navigable:

   1. Set navigable to navigable’s parent.

3. If navigable is null, return null.

4. Assert: navigable is a fenced navigable.

5. Set navigable to navigable’s unfenced parent.

6. While navigable is not null and navigable is not a fenced navigable:

   1. Set navigable to navigable’s parent.

7. Return navigable.

Main frame (origin A)
  <fencedframe> (origin B)
    <iframe> (origin C)
      <fencedframe> (origin D)
        <iframe> (origin E)
          <fencedframe> (origin F)

initiator fenced frame config instance

sourceDocument’s browsing context's fenced frame config instance

initiator ancestor root origin

null if the result of running get the initiator’s fenced grand-ancestor’s navigable on sourceDocument is null. Otherwise, sourceDocument’s initiator’s fenced grand-ancestor’s navigable's active document's origin.

initiator ancestor root referrer policy

null if the result of running get the initiator’s fenced grand-ancestor’s navigable on sourceDocument is null. Otherwise, sourceDocument’s initiator’s fenced grand-ancestor’s navigable's active document's policy container's referrer policy.

attribution reporting enabled

The result of determining whether sourceDocument is allowed to use the "attribution-reporting" feature

attribution reporting context origin

sourceDocument’s context origin

automatic beacons allowed

sourceDocument’s automatic beacons allowed

automatic beacon data map

The result of running get the automatic beacon data mapping to use on sourceDocument.

• document’s relevant global object's navigable is a fenced navigable;

  Note: This ensures that all navigations inside of a fencedframe are made with the "replace" mode, regardless of the initiator.

Modify step 13 of [HTML]'s navigate algorithm ("If all of the following are true:") to include the following condition:

• sourceDocument’s node navigable is not a fenced navigable container while at the same time navigable is a fenced navigable.

  Note: This ensures that embedder-initiated navigations can never trigger a fragment navigation inside of a fencedframe.

Insert these steps immediately after step 22, the step that goes in parallel, so that what follows are the first steps that run in parallel in the patched algorithm:

1. If url is a urn uuid and navigable is a fenced navigable:

   The above condition is not as tight as it needs to be. For example, if a fencedframe generates a FencedFrameConfig using a config-generating API, and then correctly guesses the config’s urn:uuid, it can theoretically navigate itself to that config by passing the guessed urn into the navigate algorithm as a URL, via something like the location API. This is bad, because the purpose of a FencedFrameConfig is to ensure that only an embedder can navigate a fencedframe to the resource represented by the config, by using the config object directly. See #194 for thoughts on fixing this.

   1. Let config be the result of finding a config in sourceDocument’s node navigable's traversable navigable's fenced frame config mapping.

      Note: This might "wait" for an arbitrary period of time for the config associated with the urn uuid url to be "finalized" in the fenced frame config mapping. This is why this step runs in parallel. This navigation will be canceled by any subsequent embedder-initiated navigations, should they occur, by the usual mechanism that tracks the ongoing navigation.

   2. Set config’s embedder shared storage context to sharedStorageContext.

   3. Assert: sourceSnapshotParams’s target fenced frame config is null.

   4. Set sourceSnapshotParams’s target fenced frame config to config.

   5. Assert config’s mapped url's value is a URL whose scheme is "https".

   6. Set url to config’s mapped url's value.

   7. Run steps in config’s on navigate callback.

2. If navigable is a fenced navigable and sourceDocument’s node navigable is in navigable’s active document's ancestor navigables with unfenced set to true:

   1. Let config be a new fenced frame config with the following items:

      mapped url

      a struct with the following items:

      value

      url

      visibility

      transparent

      effective sandboxing flags

      a struct with the following items:

      value

      The default fenced frame effective sandboxing flags.

      visibility

      opaque

      effective enabled permissions

      null

   2. Assert: sourceSnapshotParams’s target fenced frame config is null.

   3. Set sourceSnapshotParams’s target fenced frame config to config.

Rewrite the step starting with "Let unloadPromptCanceled be the result of" to:

1. Let unloadPromptCanceled be false if navigable is a fenced navigable, or the result of checking if unloading is user-canceled for navigable’s active document's inclusive descendant navigables otherwise.

Add a step after step 22.8.2 (Let finalSandboxFlags be the union...) that reads:

3. If sourceSnapshotParams’s target fenced frame config is not null, and if sourceSnapshotParams’s target fenced frame config's effective sandboxing flags is not null, then set finalSandboxFlags to the union of finalSandboxFlags and sourceSnapshotParams’s target fenced frame config's effective sandboxing flags' value.

   Note: This ensures that the finalSandboxFlags are at least as restrictive as the effective sandboxing flags defined in the target fenced frame config. A separate check in the blocked by sandboxing flags? algorithm will make sure that finalSandboxFlags is not more restrictive than the effective sandboxing flags.

fenced frame config instance

A fenced frame config instance or null, initially null.

Note: This is only set for embedder-initiated fencedframe navigations, and if a new Document is created as a result of such a navigation, this member is transferred to the new fenced navigable's active browsing context's fenced frame config instance member.

fenced frame config instance

If sourceSnapshotParams’s target fenced frame config is null, then null; otherwise, the result of instantiating sourceSnapshotParams’s target fenced frame config.

3. If navigationParams’s fenced frame config instance is not null:

   1. Assert: browsingContext does not equal navigationParams’s navigable's active browsing context.

      Note: This is because embedder-initiated navigations (indicated by navigationParams’s fenced frame config instance being non-null) always cause a § 3.8.6 Browsing context group swap.

   2. Set navigationParams’s fenced frame config instance's cross-origin reporting allowed to the result of running get a structured field value on navigationParams’s response's header list given `Allow-Cross-Origin-Event-Reporting` and "item".

   3. Set browsingContext’s fenced frame config instance to navigationParams’s fenced frame config instance.

Add a new step after step 9 that reads:

10. Let automaticBeaconsAllowed be the result of running get a structured field value on navigationParams’s response's header list given `Allow-Fenced-Frame-Automatic-Beacons` and "item".

Further rewrite step 10 (now step 12) to return a new Document with an additional parameter:

automatic beacons allowed

automaticBeaconsAllowed.

6. If all of the following conditions are true:

   • navigable is a fenced navigable;

   • sourceSnapshotParams’s fetch client is not navigable’s active document's relevant settings object;

   • navigationParams is non-null

   then set navigationParams’s COOP enforcement result's needs a browsing context group switch boolean to true.

   This indeed works, but we should consider using a separate mechanism to carry this out, instead of piggybacking off of the COOP mechanism which was designed without fenced frames in mind, and could evolve in ways that give this specification unwanted side-effects.

3. If request’s destination is "fencedframe", and this directive’s value does not contain either "https:", "https://*:*", or "*", return "Blocked".

3. If request destination is "fencedframe", and this directive’s value does not contain either "https:", "https://*:*", or "*", return "Blocked".

2. If context’s required csp is not null, and request destination is "fencedframe", return "Blocked".

directive-name  = "fenced-frame-src"
directive-value = serialized-source-list

Content-Security-Policy: fenced-frame-src https://example.com/

<fencedframe src="https://example.org/">
</fencedframe>

The Pre-request check and Post-request check will be the same as the frame-src’s check.

Content-Security-Policy: connect-src 'self';
                        ...
                        worker-src 'self'

It will now say:

Content-Security-Policy: connect-src 'self';
                        ...
                        fenced-frame-src 'self';
                        ...
                        worker-src 'self'

"fenced-frame-src"

1. Return << "fenced-frame-src", "frame-src", "child-src", "default-src" >>.

"fencedframe"

1. Return fenced-frame-src.

iframe and fencedframe elements have an respective allow attributes (iframe: allow; fencedframe: allow), which contain an ASCII-serialized policy directive.

The allowlist for the features named in the attribute may be empty; in that case, the default value for the allowlist is "src", which represents the origin of the URL in the iframe’s src attribute, or the fencedframe’s fenced frame config.

When not empty, the iframe's allow or fencedframe's allow attribute will result in adding an allowlist for each supported feature to the iframe or fencedframe's container policy, when it is constructed.

Given null or an element (container), this algorithm returns a new permissions policy.

1. Let inherited policy be a new ordered map.

2. Let effective permissions be an empty list.

3. Let fenced frame config be container’s node document's active browsing context's fenced frame config instance.

4. If fenced frame config is not null, and fenced frame config’s effective enabled permissions are not null, set effective permissions to fenced frame config’s effective enabled permissions.

5. For each feature supported:

   1. If effective permissions contains feature, then set inherited policy[feature] to "Enabled".

      Otherwise, set inherited policy[feature] to "Disabled".

6. Let policy be a new permissions policy, with inherited policy inherited policy and declared policy a new ordered map.

7. Return policy.

Note: While this algorithm doesn’t take the allow attribute into consideration, it will have already been checked by the time this is called because of Should navigation response to navigation request be blocked by Permissions Policy?. Any policy specified in allow that is too restrictive would have cause the fenced frame to not load, and any policy that is more permissive than what is specified in the effective enabled permissions will be ignored.

Given null or an element (container), an origin (origin), and an optional boolean fenced that defaults to false, this algorithm returns a new permissions policy.

Rewrite step 1 to read:

1. Assert: if not null, container is either a navigable container or a fenced navigable container.

Rewrite step 3 to read:

4. For each feature supported:

   1. Let isInherited be the result of running Define an inherited policy for feature in container at origin on feature, container, origin, and fenced.

   2. Set inherited policy[feature] to isInherited.

Given null, a navigable container-or-fenced navigable container (container), an origin (origin), and a response (response), this algorithm returns a new permissions policy.

Rewrite step 1 to read:

1. If container is a fenced navigable container, then let policy be the result of running derive a permissions policy directly from a fenced frame config instance given container.

   Otherwise, Let policy be the result of running Create a Permissions Policy for a navigable given container and origin.

1. If element is not an iframe element or a fencedframe element, then return an empty policy directive.

• The result of should navigation response to navigation request be blocked by Permissions Policy? given navigationParams is "Blocked";

• The result of should navigation response to navigation request be blocked by sandboxing flags? given navigationParams and sourceSnapshotParams is "Blocked";

Note: If any of these algorithms returns "Blocked", the pre-existing Document in the fencedframe does not stick around; an error page will be loaded.

Given a navigation params (navigationParams), this algorithm returns "Blocked" or "Allowed":

1. Let navigable be navigationParams’s navigable.

2. If navigable is not a fenced navigable, then return "Allowed".

3. Let origin be navigationParams’s origin.

4. Let effective permissions be the navigable’s active browsing context's fenced frame config instance's effective enabled permissions.

   Per work omitted in pull request #84, the config instance has not yet been assigned to the browsing context. We should consider storing the instance inside navigationParams and reference it from here instead.

5. Let permissions policy be the result of creating a permissions policy given navigable’s fenced navigable container, origin, and fenced set to true.

   Note: This is almost identical to the permissions policy that will be created when the navigation constructs the ultimate Document for this pending navigation. The difference is that this algorithm, just like when it is called on iframes, will include all of the permissions specified in the allow attribute, even if that permission isn’t specified in the fenced frame config's effective enabled permissions. We create it now and run tests on it since this is the appropriate time to determine if a navigation will fail, and then throw it away. If the navigation succeeds, it will be recreated and unconditionally installed on the Document. However, the recreation will not include any additional enabled permissions that are not included in the effective enabled permissions, effectively locking the enabled permissions to only what is specified in effective enabled permissions.

6. Let inherited policy be permissions policy’s inherited policy.

7. For each effective permission of effective permissions:

   1. If inherited policy[effective permission] is "Disabled", return "Blocked".

8. Return "Allowed."

Given a navigation params (navigationParams) and a source snapshot params (sourceSnapshotParams), this algorithm returns "Blocked" or "Allowed":

1. Let navigable be navigationParams’s navigable.

2. If navigable is not a fenced navigable, then return "Allowed".

3. Let effectiveSandboxingFlags be the sourceSnapshotParams’s target fenced frame config's effective sandboxing flags.

4. If navigationParams’s final sandboxing flag set is not a subset of effectiveSandboxingFlags, then return "Blocked".

   Note: This means that the final sandboxing flag set cannot restrict a feature that isn’t already restricted in the effective sandboxing flags, as the extra restrictions can be used as a communication channel. By this point, the final sandboxing flag set will already have been set to something at least as restrictive as the effective sandboxing flags.

5. Otherwise, return "Allowed".

Given a feature (feature), null or a navigable container (container), an origin for a document in that container (origin), and an optional boolean fenced that defaults to false, this algorithm returns the inherited policy for that feature.

Rewrite step 3 to read:

3. If the result of executing Is feature enabled in document for origin? on feature, container’s node document, origin, and fenced is "Disabled", return "Disabled".

Note: We don’t have to rewrite step 2, which also delegates to the same algorithm, to pass in the fenced boolean because step 2 has to do with checking to see if feature is enabled container’s node document, not the Document hosted inside container.

Rewrite step 7 to read:

7. If fenced is false, feature’s default allowlist is 'self', and origin is same origin with container’s node document's origin, return "Enabled".

Given a feature (feature), a Document object (document), an origin (origin), and an optional boolean fenced that defaults to false, this algorithm returns "Disabled" if feature should be considered disabled, and "Enabled" otherwise.

Rewrite step 3 to read:

3. If feature is present in policy’s declared policy,

   1. If fenced is false, and the allowlist for feature in policy’s declared policy matches origin, then return "Enabled".

   2. Otherwise, if fenced is true, and the allowlist for feature in policy’s declared policy is the special value *, then return "Enabled".

   3. Otherwise, return "Disabled".

Rewrite step 5 to read:

5. If fenced is false, feature’s default allowlist is 'self', and origin is same origin with document’s origin, return "Enabled".

4. If node’s node document's browsing context's fenced frame config instance is not null, then return node’s node document's browsing context's fenced frame config instance's mapped url.

Note: This ensures that the 'src' allowlist that can be set in the allow attribute works when using a fenced frame config to navigate a fencedframe (or a urn that maps to a fenced frame config to navigate an iframe).

14. If scrolling box’s associated Element's associated Document's node navigable's traversable navigable is a fenced navigable, or if scrolling box’s associated viewport's associated Document's node navigable's traversable navigable is a fenced navigable, then let this be the last instance of this algorithm that stops any further recursive instances that would otherwise follow.

Note: This allows scrolling to "bubble up" to a fenced frame boundary, but not cross it.

1. Let navigable be this's relevant global object's navigable.

2. If navigable is not null and navigable’s traversable navigable is a fenced navigable, throw a NotAllowedError DOMException.