Still behind a flag, just updating the checks to look for both `\n` and
`<` rather than just the former. This is in line with the patches up at
whatwg/url#284 and
whatwg/fetch#519.

Intent to Remove: https://groups.google.com/a/chromium.org/d/msg/blink-dev/KaA_YNOlTPk/VmmoV88xBgAJ.

Bug: 680970
Change-Id: Ifda61a0afe1f0e97620acef7dc54b005c6f74840
Reviewed-on: https://chromium-review.googlesource.com/514024
Commit-Queue: Mike West <[email protected]>
Cr-Commit-Position: refs/heads/master@{#474249}
WPT-Export-Revision: 34b8d6ab689b1ecedef332baa2a155b543f50fa7

Still behind a flag, just updating the checks to look for both `\n` and
`<` rather than just the former. This is in line with the patches up at
whatwg/url#284 and
whatwg/fetch#519.

Intent to Remove: https://groups.google.com/a/chromium.org/d/msg/blink-dev/KaA_YNOlTPk/VmmoV88xBgAJ.

Bug: 680970
Change-Id: Ifda61a0afe1f0e97620acef7dc54b005c6f74840
Reviewed-on: https://chromium-review.googlesource.com/514024
Reviewed-by: Jochen Eisinger <[email protected]>
Cr-Commit-Position: refs/heads/master@{#474268}
WPT-Export-Revision: 76847294b106c9c50e921ac523722675102d452e

Still behind a flag, just updating the checks to look for both `\n` and
`<` rather than just the former. This is in line with the patches up at
whatwg/url#284 and
whatwg/fetch#519.

Intent to Remove: https://groups.google.com/a/chromium.org/d/msg/blink-dev/KaA_YNOlTPk/VmmoV88xBgAJ.

Bug: 680970
Change-Id: Ifda61a0afe1f0e97620acef7dc54b005c6f74840
Reviewed-on: https://chromium-review.googlesource.com/514024
Commit-Queue: Mike West <[email protected]>
Reviewed-by: Jochen Eisinger <[email protected]>
Cr-Commit-Position: refs/heads/master@{#474290}
WPT-Export-Revision: 9545e01418eb8738e5646b86527b986b3f2047a1

Still behind a flag, just updating the checks to look for both `\n` and
`<` rather than just the former. This is in line with the patches up at
whatwg/url#284 and
whatwg/fetch#519.

Intent to Remove: https://groups.google.com/a/chromium.org/d/msg/blink-dev/KaA_YNOlTPk/VmmoV88xBgAJ.

Bug: 680970
Change-Id: Ifda61a0afe1f0e97620acef7dc54b005c6f74840
Reviewed-on: https://chromium-review.googlesource.com/514024
Commit-Queue: Mike West <[email protected]>
Reviewed-by: Jochen Eisinger <[email protected]>
Cr-Commit-Position: refs/heads/master@{#474292}
WPT-Export-Revision: 8f0c33883ba9ad137a9ed9fe8a758022230f3e06

Still behind a flag, just updating the checks to look for both `\n` and
`<` rather than just the former. This is in line with the patches up at
whatwg/url#284 and
whatwg/fetch#519.

Intent to Remove: https://groups.google.com/a/chromium.org/d/msg/blink-dev/KaA_YNOlTPk/VmmoV88xBgAJ.

Bug: 680970
Change-Id: Ifda61a0afe1f0e97620acef7dc54b005c6f74840
Reviewed-on: https://chromium-review.googlesource.com/514024
Commit-Queue: Mike West <[email protected]>
Reviewed-by: Jochen Eisinger <[email protected]>
Cr-Commit-Position: refs/heads/master@{#474341}

Still behind a flag, just updating the checks to look for both `\n` and
`<` rather than just the former. This is in line with the patches up at
whatwg/url#284 and
whatwg/fetch#519.

Intent to Remove: https://groups.google.com/a/chromium.org/d/msg/blink-dev/KaA_YNOlTPk/VmmoV88xBgAJ.

Bug: 680970
Change-Id: Ifda61a0afe1f0e97620acef7dc54b005c6f74840
Reviewed-on: https://chromium-review.googlesource.com/514024
Commit-Queue: Mike West <[email protected]>
Reviewed-by: Jochen Eisinger <[email protected]>
Cr-Commit-Position: refs/heads/master@{#474341}

Still behind a flag, just updating the checks to look for both `\n` and
`<` rather than just the former. This is in line with the patches up at
whatwg/url#284 and
whatwg/fetch#519.

Intent to Remove: https://groups.google.com/a/chromium.org/d/msg/blink-dev/KaA_YNOlTPk/VmmoV88xBgAJ.

Bug: 680970
Change-Id: Ifda61a0afe1f0e97620acef7dc54b005c6f74840
Reviewed-on: https://chromium-review.googlesource.com/514024
Commit-Queue: Mike West <[email protected]>
Reviewed-by: Jochen Eisinger <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#474341}
Cr-Mirrored-From: https://chromium.googlesource.com/chromium/src
Cr-Mirrored-Commit: 9e5ae901660de47ef1b844c6113eae91b5ae8e9e

There is an old Fetch Standard PR up for review that blocks resource
requests whose URL contains potentially dangling markup [1]. This is
for security purposes, see [2] and [3]. While non-standard yet, Chromium
has shipped this behavior, and we intend to do the same for fenced
frames. This CL implements potentially dangling markup
restrictions on all embedder-provided URLs for fenced frame
navigations.

When a URL with dangling markup is passed to SharedStorage's `selectURL()` method, it is parsed and partially sanitized, therefore the resulting urn:uuid can be successfully navigated to. When crbug.com/1318970 is fixed, SharedStorage will reject these URLs as inputs.

[1]: whatwg/fetch#519
[2]: https://bugs.chromium.org/p/chromium/issues/detail?id=1039885
[3]: https://bugs.chromium.org/p/chromium/issues/detail?id=1301333

Bug: 1301333, 1318970
Change-Id: I1ada9de23b05795499408988529fa3a49486aea3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3702854
Reviewed-by: Garrett Tanzer <[email protected]>
Reviewed-by: Alex Moshchuk <[email protected]>
Commit-Queue: Dominic Farolino <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1014928}

This reverts commit fe04c06.

Reason for revert: Suspecting that this CL caused https://crbug.com/1337025

Original change's description:
> Fenced frames: Disallow URLs with potentially dangling markup
>
> There is an old Fetch Standard PR up for review that blocks resource
> requests whose URL contains potentially dangling markup [1]. This is
> for security purposes, see [2] and [3]. While non-standard yet, Chromium
> has shipped this behavior, and we intend to do the same for fenced
> frames. This CL implements potentially dangling markup
> restrictions on all embedder-provided URLs for fenced frame
> navigations.
>
> When a URL with dangling markup is passed to SharedStorage's `selectURL()` method, it is parsed and partially sanitized, therefore the resulting urn:uuid can be successfully navigated to. When crbug.com/1318970 is fixed, SharedStorage will reject these URLs as inputs.
>
> [1]: whatwg/fetch#519
> [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=1039885
> [3]: https://bugs.chromium.org/p/chromium/issues/detail?id=1301333
>
> Bug: 1301333, 1318970
> Change-Id: I1ada9de23b05795499408988529fa3a49486aea3
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3702854
> Reviewed-by: Garrett Tanzer <[email protected]>
> Reviewed-by: Alex Moshchuk <[email protected]>
> Commit-Queue: Dominic Farolino <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1014928}

Bug: 1301333, 1318970
Change-Id: If4884825408c38882f439d8c5e47ba0271dc67a1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3710059
Owners-Override: Łukasz Anforowicz <[email protected]>
Reviewed-by: Sebastien Lalancette <[email protected]>
Bot-Commit: Rubber Stamper <[email protected]>
Auto-Submit: Łukasz Anforowicz <[email protected]>
Reviewed-by: Łukasz Anforowicz <[email protected]>
Commit-Queue: Sebastien Lalancette <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1015011}

This is a reland of commit fe04c06

Original change's description:
> Fenced frames: Disallow URLs with potentially dangling markup
>
> There is an old Fetch Standard PR up for review that blocks resource
> requests whose URL contains potentially dangling markup [1]. This is
> for security purposes, see [2] and [3]. While non-standard yet, Chromium
> has shipped this behavior, and we intend to do the same for fenced
> frames. This CL implements potentially dangling markup
> restrictions on all embedder-provided URLs for fenced frame
> navigations.
>
> When a URL with dangling markup is passed to SharedStorage's `selectURL()` method, it is parsed and partially sanitized, therefore the resulting urn:uuid can be successfully navigated to. When crbug.com/1318970 is fixed, SharedStorage will reject these URLs as inputs.
>
> [1]: whatwg/fetch#519
> [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=1039885
> [3]: https://bugs.chromium.org/p/chromium/issues/detail?id=1301333
>
> Bug: 1301333, 1318970
> Change-Id: I1ada9de23b05795499408988529fa3a49486aea3
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3702854
> Reviewed-by: Garrett Tanzer <[email protected]>
> Reviewed-by: Alex Moshchuk <[email protected]>
> Commit-Queue: Dominic Farolino <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1014928}

Bug: 1301333, 1318970, 1337025
Change-Id: I28fb3ed240344b795ceef8c3a65459f16b688524
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3715554
Commit-Queue: Dominic Farolino <[email protected]>
Reviewed-by: Garrett Tanzer <[email protected]>
Reviewed-by: Alex Moshchuk <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1018831}

…g markup""

This reverts commit d168b7e.

Reason for revert:
Witness the following tests in constant failure list (mac/linux) when sheriffing, and this CL is in the list of potential regression culprit.
virtual/fenced-frame-shadow-dom/wpt_internal/fenced_frame/disallowed-navigations.https.html
virtual/fenced-frame-mparch/wpt_internal/fenced_frame/disallowed-navigations.https.html

Original change's description:
> Reland "Fenced frames: Disallow URLs with potentially dangling markup"
>
> This is a reland of commit fe04c06
>
> Original change's description:
> > Fenced frames: Disallow URLs with potentially dangling markup
> >
> > There is an old Fetch Standard PR up for review that blocks resource
> > requests whose URL contains potentially dangling markup [1]. This is
> > for security purposes, see [2] and [3]. While non-standard yet, Chromium
> > has shipped this behavior, and we intend to do the same for fenced
> > frames. This CL implements potentially dangling markup
> > restrictions on all embedder-provided URLs for fenced frame
> > navigations.
> >
> > When a URL with dangling markup is passed to SharedStorage's `selectURL()` method, it is parsed and partially sanitized, therefore the resulting urn:uuid can be successfully navigated to. When crbug.com/1318970 is fixed, SharedStorage will reject these URLs as inputs.
> >
> > [1]: whatwg/fetch#519
> > [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=1039885
> > [3]: https://bugs.chromium.org/p/chromium/issues/detail?id=1301333
> >
> > Bug: 1301333, 1318970
> > Change-Id: I1ada9de23b05795499408988529fa3a49486aea3
> > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3702854
> > Reviewed-by: Garrett Tanzer <[email protected]>
> > Reviewed-by: Alex Moshchuk <[email protected]>
> > Commit-Queue: Dominic Farolino <[email protected]>
> > Cr-Commit-Position: refs/heads/main@{#1014928}
>
> Bug: 1301333, 1318970, 1337025
> Change-Id: I28fb3ed240344b795ceef8c3a65459f16b688524
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3715554
> Commit-Queue: Dominic Farolino <[email protected]>
> Reviewed-by: Garrett Tanzer <[email protected]>
> Reviewed-by: Alex Moshchuk <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1018831}

Bug: 1301333, 1318970, 1337025
Change-Id: I08c09fc7d7d35ccd5a826ce3d7f03e954a860bc0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3734127
Bot-Commit: Rubber Stamper <[email protected]>
Commit-Queue: Huanpo Lin <[email protected]>
Owners-Override: Robert Lin <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1018955}

…g markup""

This is a reland of commit d168b7e

Original change's description:
> Reland "Fenced frames: Disallow URLs with potentially dangling markup"
>
> This is a reland of commit fe04c06
>
> Original change's description:
> > Fenced frames: Disallow URLs with potentially dangling markup
> >
> > There is an old Fetch Standard PR up for review that blocks resource
> > requests whose URL contains potentially dangling markup [1]. This is
> > for security purposes, see [2] and [3]. While non-standard yet, Chromium
> > has shipped this behavior, and we intend to do the same for fenced
> > frames. This CL implements potentially dangling markup
> > restrictions on all embedder-provided URLs for fenced frame
> > navigations.
> >
> > When a URL with dangling markup is passed to SharedStorage's `selectURL()` method, it is parsed and partially sanitized, therefore the resulting urn:uuid can be successfully navigated to. When crbug.com/1318970 is fixed, SharedStorage will reject these URLs as inputs.
> >
> > [1]: whatwg/fetch#519
> > [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=1039885
> > [3]: https://bugs.chromium.org/p/chromium/issues/detail?id=1301333
> >
> > Bug: 1301333, 1318970
> > Change-Id: I1ada9de23b05795499408988529fa3a49486aea3
> > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3702854
> > Reviewed-by: Garrett Tanzer <[email protected]>
> > Reviewed-by: Alex Moshchuk <[email protected]>
> > Commit-Queue: Dominic Farolino <[email protected]>
> > Cr-Commit-Position: refs/heads/main@{#1014928}
>
> Bug: 1301333, 1318970, 1337025
> Change-Id: I28fb3ed240344b795ceef8c3a65459f16b688524
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3715554
> Commit-Queue: Dominic Farolino <[email protected]>
> Reviewed-by: Garrett Tanzer <[email protected]>
> Reviewed-by: Alex Moshchuk <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1018831}

Bug: 1301333, 1318970, 1337025
Change-Id: I12c002d7f42d7138a9ad07eaa3b25b6c5b3d5d36
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3781483
Reviewed-by: Nasko Oskov <[email protected]>
Commit-Queue: Dominic Farolino <[email protected]>
Reviewed-by: Garrett Tanzer <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1038987}

There is an old Fetch Standard PR up for review that blocks resource
requests whose URL contains potentially dangling markup [1]. This is
for security purposes, see [2] and [3]. While non-standard yet, Chromium
has shipped this behavior, and we intend to do the same for fenced
frames. This CL implements potentially dangling markup
restrictions on all embedder-provided URLs for fenced frame
navigations.

When a URL with dangling markup is passed to SharedStorage's `selectURL()` method, it is parsed and partially sanitized, therefore the resulting urn:uuid can be successfully navigated to. When crbug.com/1318970 is fixed, SharedStorage will reject these URLs as inputs.

[1]: whatwg/fetch#519
[2]: https://bugs.chromium.org/p/chromium/issues/detail?id=1039885
[3]: https://bugs.chromium.org/p/chromium/issues/detail?id=1301333

Bug: 1301333, 1318970
Change-Id: I1ada9de23b05795499408988529fa3a49486aea3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3702854
Reviewed-by: Garrett Tanzer <[email protected]>
Reviewed-by: Alex Moshchuk <[email protected]>
Commit-Queue: Dominic Farolino <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1014928}
NOKEYCHECK=True
GitOrigin-RevId: fe04c0639254e5d021da539d321f2e3a64a0085c

This reverts commit fe04c0639254e5d021da539d321f2e3a64a0085c.

Reason for revert: Suspecting that this CL caused https://crbug.com/1337025

Original change's description:
> Fenced frames: Disallow URLs with potentially dangling markup
>
> There is an old Fetch Standard PR up for review that blocks resource
> requests whose URL contains potentially dangling markup [1]. This is
> for security purposes, see [2] and [3]. While non-standard yet, Chromium
> has shipped this behavior, and we intend to do the same for fenced
> frames. This CL implements potentially dangling markup
> restrictions on all embedder-provided URLs for fenced frame
> navigations.
>
> When a URL with dangling markup is passed to SharedStorage's `selectURL()` method, it is parsed and partially sanitized, therefore the resulting urn:uuid can be successfully navigated to. When crbug.com/1318970 is fixed, SharedStorage will reject these URLs as inputs.
>
> [1]: whatwg/fetch#519
> [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=1039885
> [3]: https://bugs.chromium.org/p/chromium/issues/detail?id=1301333
>
> Bug: 1301333, 1318970
> Change-Id: I1ada9de23b05795499408988529fa3a49486aea3
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3702854
> Reviewed-by: Garrett Tanzer <[email protected]>
> Reviewed-by: Alex Moshchuk <[email protected]>
> Commit-Queue: Dominic Farolino <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1014928}

Bug: 1301333, 1318970
Change-Id: If4884825408c38882f439d8c5e47ba0271dc67a1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3710059
Owners-Override: Łukasz Anforowicz <[email protected]>
Reviewed-by: Sebastien Lalancette <[email protected]>
Bot-Commit: Rubber Stamper <[email protected]>
Auto-Submit: Łukasz Anforowicz <[email protected]>
Reviewed-by: Łukasz Anforowicz <[email protected]>
Commit-Queue: Sebastien Lalancette <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1015011}
NOKEYCHECK=True
GitOrigin-RevId: 245696bb639221c56332cdea83bd961c99330183

This is a reland of commit fe04c0639254e5d021da539d321f2e3a64a0085c

Original change's description:
> Fenced frames: Disallow URLs with potentially dangling markup
>
> There is an old Fetch Standard PR up for review that blocks resource
> requests whose URL contains potentially dangling markup [1]. This is
> for security purposes, see [2] and [3]. While non-standard yet, Chromium
> has shipped this behavior, and we intend to do the same for fenced
> frames. This CL implements potentially dangling markup
> restrictions on all embedder-provided URLs for fenced frame
> navigations.
>
> When a URL with dangling markup is passed to SharedStorage's `selectURL()` method, it is parsed and partially sanitized, therefore the resulting urn:uuid can be successfully navigated to. When crbug.com/1318970 is fixed, SharedStorage will reject these URLs as inputs.
>
> [1]: whatwg/fetch#519
> [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=1039885
> [3]: https://bugs.chromium.org/p/chromium/issues/detail?id=1301333
>
> Bug: 1301333, 1318970
> Change-Id: I1ada9de23b05795499408988529fa3a49486aea3
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3702854
> Reviewed-by: Garrett Tanzer <[email protected]>
> Reviewed-by: Alex Moshchuk <[email protected]>
> Commit-Queue: Dominic Farolino <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1014928}

Bug: 1301333, 1318970, 1337025
Change-Id: I28fb3ed240344b795ceef8c3a65459f16b688524
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3715554
Commit-Queue: Dominic Farolino <[email protected]>
Reviewed-by: Garrett Tanzer <[email protected]>
Reviewed-by: Alex Moshchuk <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1018831}
NOKEYCHECK=True
GitOrigin-RevId: d168b7e00bbbca61bcdb6078694b3500f74863d5

…g markup""

This reverts commit d168b7e00bbbca61bcdb6078694b3500f74863d5.

Reason for revert:
Witness the following tests in constant failure list (mac/linux) when sheriffing, and this CL is in the list of potential regression culprit.
virtual/fenced-frame-shadow-dom/wpt_internal/fenced_frame/disallowed-navigations.https.html
virtual/fenced-frame-mparch/wpt_internal/fenced_frame/disallowed-navigations.https.html

Original change's description:
> Reland "Fenced frames: Disallow URLs with potentially dangling markup"
>
> This is a reland of commit fe04c0639254e5d021da539d321f2e3a64a0085c
>
> Original change's description:
> > Fenced frames: Disallow URLs with potentially dangling markup
> >
> > There is an old Fetch Standard PR up for review that blocks resource
> > requests whose URL contains potentially dangling markup [1]. This is
> > for security purposes, see [2] and [3]. While non-standard yet, Chromium
> > has shipped this behavior, and we intend to do the same for fenced
> > frames. This CL implements potentially dangling markup
> > restrictions on all embedder-provided URLs for fenced frame
> > navigations.
> >
> > When a URL with dangling markup is passed to SharedStorage's `selectURL()` method, it is parsed and partially sanitized, therefore the resulting urn:uuid can be successfully navigated to. When crbug.com/1318970 is fixed, SharedStorage will reject these URLs as inputs.
> >
> > [1]: whatwg/fetch#519
> > [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=1039885
> > [3]: https://bugs.chromium.org/p/chromium/issues/detail?id=1301333
> >
> > Bug: 1301333, 1318970
> > Change-Id: I1ada9de23b05795499408988529fa3a49486aea3
> > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3702854
> > Reviewed-by: Garrett Tanzer <[email protected]>
> > Reviewed-by: Alex Moshchuk <[email protected]>
> > Commit-Queue: Dominic Farolino <[email protected]>
> > Cr-Commit-Position: refs/heads/main@{#1014928}
>
> Bug: 1301333, 1318970, 1337025
> Change-Id: I28fb3ed240344b795ceef8c3a65459f16b688524
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3715554
> Commit-Queue: Dominic Farolino <[email protected]>
> Reviewed-by: Garrett Tanzer <[email protected]>
> Reviewed-by: Alex Moshchuk <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1018831}

Bug: 1301333, 1318970, 1337025
Change-Id: I08c09fc7d7d35ccd5a826ce3d7f03e954a860bc0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3734127
Bot-Commit: Rubber Stamper <[email protected]>
Commit-Queue: Huanpo Lin <[email protected]>
Owners-Override: Robert Lin <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1018955}
NOKEYCHECK=True
GitOrigin-RevId: 249ad02da9846203ef3357bbc82c5145384b31b0

…g markup""

This is a reland of commit d168b7e00bbbca61bcdb6078694b3500f74863d5

Original change's description:
> Reland "Fenced frames: Disallow URLs with potentially dangling markup"
>
> This is a reland of commit fe04c0639254e5d021da539d321f2e3a64a0085c
>
> Original change's description:
> > Fenced frames: Disallow URLs with potentially dangling markup
> >
> > There is an old Fetch Standard PR up for review that blocks resource
> > requests whose URL contains potentially dangling markup [1]. This is
> > for security purposes, see [2] and [3]. While non-standard yet, Chromium
> > has shipped this behavior, and we intend to do the same for fenced
> > frames. This CL implements potentially dangling markup
> > restrictions on all embedder-provided URLs for fenced frame
> > navigations.
> >
> > When a URL with dangling markup is passed to SharedStorage's `selectURL()` method, it is parsed and partially sanitized, therefore the resulting urn:uuid can be successfully navigated to. When crbug.com/1318970 is fixed, SharedStorage will reject these URLs as inputs.
> >
> > [1]: whatwg/fetch#519
> > [2]: https://bugs.chromium.org/p/chromium/issues/detail?id=1039885
> > [3]: https://bugs.chromium.org/p/chromium/issues/detail?id=1301333
> >
> > Bug: 1301333, 1318970
> > Change-Id: I1ada9de23b05795499408988529fa3a49486aea3
> > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3702854
> > Reviewed-by: Garrett Tanzer <[email protected]>
> > Reviewed-by: Alex Moshchuk <[email protected]>
> > Commit-Queue: Dominic Farolino <[email protected]>
> > Cr-Commit-Position: refs/heads/main@{#1014928}
>
> Bug: 1301333, 1318970, 1337025
> Change-Id: I28fb3ed240344b795ceef8c3a65459f16b688524
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3715554
> Commit-Queue: Dominic Farolino <[email protected]>
> Reviewed-by: Garrett Tanzer <[email protected]>
> Reviewed-by: Alex Moshchuk <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#1018831}

Bug: 1301333, 1318970, 1337025
Change-Id: I12c002d7f42d7138a9ad07eaa3b25b6c5b3d5d36
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3781483
Reviewed-by: Nasko Oskov <[email protected]>
Commit-Queue: Dominic Farolino <[email protected]>
Reviewed-by: Garrett Tanzer <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1038987}
NOKEYCHECK=True
GitOrigin-RevId: fd8569850d538adc8e3012da1c7c8573f16a5356