A.6 Web Browser Model
A.6.3 Web Browser Relation R webbrowser
We now define the relation Rwebbrowser of a standard HTTP browser. To this end, we first
introduce functions that are used for defining the browser main algorithm. We then define the browser relation.
Helper Functions
In the following description of the web browser relation Rwebbrowser we use the helper functions
Subwindows, Docs, Clean, CookieMerge and AddCookie.
Given a browser state s, Subwindows(s) denotes the set of all pointers2 to windows in the window list s.windows, their active documents, and (recursively) the subwindows of these documents. We exclude subwindows of inactive documents and their subwindows. With Docs(s) we denote the set of pointers to all active documents in the set of windows referenced by Subwindows(s).
Definition 44. For a browser state s we denote by Subwindows(s) the minimal set of pointers that satisfies the following conditions: (1) For all windows w ∈hi s.windows there is a p ∈ Subwindows(s) such that s.p = w. (2) For all p ∈ Subwindows(s), the active document d of the window s.p and every subwindow w of d there is a pointer p0 ∈ Subwindows(s) such that
s.p0 = w.
Given a browser state s, the set Docs(s) of pointers to active documents is the minimal set such that for every p ∈ Subwindows(s), there is a pointer p0 ∈ Docs(s) with s.p0 =
s.p.activedocument.
By Subwindows+(s) and Docs+(s) we denote the respective sets that also include the inactive documents and their subwindows.
The function Clean will be used to determine which information about windows and documents the script running in the document d has access to.
Definition 45. Let s be a browser state and d a document. By Clean(s, d) we denote the term that equals s.windows but with (1) all inactive documents removed (including their subwindows etc.), (2) all subterms that represent non-same-origin documents w.r.t. d replaced by a restricted document d0 with the same nonce and the same subwindow list, and (3) the values of the subterms headers for all documents set to hi. (Non-same-origin documents on all levels are replaced by their corresponding restricted document.)
The function CookieMerge merges two sequences of cookies together: When used in the browser, oldcookies is the sequence of existing cookies for some origin, newcookies is a sequence of new cookies that was output by some script. The sequences are merged into a set of cookies using an algorithm that is based on the Storage Mechanism algorithm described in [RFC6265].
Definition 46. For a sequence of cookies (with pairwise different names) oldcookies and a se- quence of cookies newcookies, the set CookieMerge(oldcookies, newcookies) is defined by the following algorithm: From newcookies remove all cookies c that have c.content.httpOnly ≡ >. For any c, c0 ∈hinewcookies, c.name ≡ c0.name, remove the cookie that appears left of the other in newcookies. Let m be the set of cookies that have a name that either appears in oldcookies or in newcookies, but not in both. For all pairs of cookies (cold, cnew) with cold ∈hi oldcookies,
cnew ∈hi newcookies, cold.name ≡ cnew.name, add cnew to m if cold.content.httpOnly ≡ ⊥ and
add cold to m otherwise. The result of CookieMerge(oldcookies, newcookies) is m.
The function AddCookie adds a cookie c received in an HTTP response to the sequence of cookies contained in the sequence oldcookies. It is again based on the algorithm described in [RFC6265] but simplified for the use in the browser model.
Definition 47. For a sequence of cookies (with pairwise different names) oldcookies and a cookie c, the sequence AddCookie(oldcookies, c) is defined by the following algorithm: Let m := oldcookies. Remove any c0 from m that has c.name ≡ c0.name. Append c to m and return m.
The function NavigableWindows returns a set of windows that a document is allowed to navigate. We closely follow [Ber+17], Section 5.1.4 for this definition.
Definition 48. The set NavigableWindows(w, s0) is the set W ⊆ Subwindows(s0) of pointers to windows that the active document in w is allowed to navigate. The set W is defined to be the minimal set such that for every w0 ∈ Subwindows(s0) the following is true:
– If s0.w0.activedocument.origin ≡ s0.w.activedocument.origin (i.e., the active docu- ments in w and w0 are same-origin), then w0 ∈ W , and
– If s0.w childof ∗
−−−−−→ s0.w0 ∧ @ w00 ∈ Subwindows(s0) with s0.w0 childof ∗
−−−−−→ s0.w00 (w0 is a top-level window and w is an ancestor window of w0), then w0 ∈ W , and
– If ∃ p ∈ Subwindows(s0) such that s0.w0 childof + −−−−−→ s0.p
∧ s0.p.activedocument.origin = s0.w.activedocument.origin (w0 is not a top-level win- dow but there is an ancestor window p of w0 with an active document that has the same
origin as the active document in w), then w0 ∈ W , and
– If ∃ p ∈ Subwindows(s0) such that s0.w0.opener = s0.p.nonce ∧ p ∈ W (w0 is a top-level
window—it has an opener—and w is allowed to navigate the opener window of w0, p),
then w0 ∈ W .
Functions
In the description of the following functions, we use a, f , m, and s as read-only global input variables. All other variables are local variables or arguments.
In several places throughout the algorithms we use placeholders to generate “fresh” nonces (Definition 6). TableA.1shows a list of all placeholders used.
Placeholder Usage
ν1 AlgorithmA.11, window nonces
ν2 AlgorithmA.11, HTTP request nonce
ν3 AlgorithmA.11, lookup key for pending HTTP requests entry
ν4 AlgorithmA.8, HTTP request nonce (multiple lines)
ν5 AlgorithmA.8, subwindow nonce
ν6 AlgorithmA.10, HTTP request nonce
ν7 AlgorithmA.10, document nonce
ν8 AlgorithmA.4, lookup key for pending DNS entry
ν9 AlgorithmA.1, window nonce
ν10 AlgorithmA.7, window nonce
ν11 AlgorithmA.7, HTTP request nonce
ν12 AlgorithmA.8, WebRTC connection nonce
ν13, . . . AlgorithmA.8, replacement for placeholders in script output
Table A.1. List of placeholders used in browser algorithms.
The function GETNAVIGABLEWINDOW (AlgorithmA.1) is called by the browser to determine the window that is actually navigated when a script in the window s0.w provides a window reference for navigation (e.g., for opening a link). When it is given a window reference (nonce) window , this function returns a pointer to a selected window term in s0:
– If window is the string BLANK, a new window is created and a pointer to that window is returned.
– If window is a nonce (reference) and there is a window term with a reference of that value in the windows in s0, a pointer w0 to that window term is returned, as long as the window is navigable by the current window’s document (as defined by NavigableWindows above).
Algorithm A.1 Web Browser Model: Determine window for navigation.
1: function GETNAVIGABLEWINDOW(w, window , noreferrer , s0)
2: if window ≡ BLANK then → Open a new window when BLANK is used 3: if noreferrer ≡ > then
4: let w0 := hν9, hi, ⊥i
5: else
6: let w0 := hν9, hi, s0.w.noncei
7: let s0.windows := s0.windows +hi w0 and let w0 be a pointer to this new element in s0
8: return w0
9: let w0 ← NavigableWindows(w, s0) such that s0.w0.nonce ≡ window if possible; otherwise
return w
10: return w0
In all other cases, w is returned instead (the script navigates its own window).
The function GETWINDOW (Algorithm A.2) takes a window reference as input and returns a pointer to a window as above, but it checks only that the active documents in both windows are same-origin. It creates no new windows.
Algorithm A.2 Web Browser Model: Determine same-origin window.
1: function GETWINDOW(w, window , s0)
2: let w0 ← Subwindows(s0) such that s0.w0
.nonce ≡ window if possible; otherwise return w
3: if s0.w0.activedocument.origin ≡ s0.w.activedocument.origin then
4: return w0
5: return w
The function CANCELNAV (AlgorithmA.3) is used to stop any pending requests for a specific window. From the pending requests and pending DNS requests it removes any requests with the given window reference n.
Algorithm A.3 Web Browser Model: Cancel pending requests for given window.
1: function CANCELNAV(reference, s0)
2: remove all hhREQ, referencei, req, key, f i from s0.pendingRequests for any req, key, f
3: remove all hx, hhREQ, referencei, message, url ii from s0.pendingDNS
,→ for any x , message, url
4: return s0
The function HTTP SEND (AlgorithmA.4) takes an HTTP request message as input, adds Cookie and Origin headers to the message, creates a DNS request for the hostname given in the request and stores the request in s0.pendingDNS until the DNS resolution finishes. For normal HTTP requests, reference is a window reference. For XMLHttpRequests, reference is a value of the form hdocument , noncei where document is a document reference and nonce is some nonce that was chosen by the script that initiated the request. url contains the full URL of the request (this is mainly used to retrieve the protocol that should be used for this message, and to store the fragment identifier for use after the document was loaded). origin is the Origin header value that is to be added to the HTTP request.
Algorithm A.4 Web Browser Model: Prepare headers, do DNS resolution, save message.
1: function HTTP SEND(reference, message, url , origin, referrer , referrerPolicy, s0)
2: if message.host ∈his0.sts then
3: let url .protocol := S
4: let cookies := h{hc.name, c.content.valuei|c ∈his0.cookies [message.host]
,→ ∧ (c.content.secure =⇒ (url .protocol = S))}i
5: let message.headers[Cookie] := cookies
6: if origin 6≡ ⊥ then
7: let message.headers[Origin] := origin
8: if referrerPolicy ≡ noreferrer then
9: let referrer := ⊥
10: if referrer 6≡ ⊥ then
11: if referrerPolicy ≡ origin then → Reduce Referer to origin. 12: let referrer := hURL, referrer .protocol, referrer .host, /, hi, ⊥i
13: let referrer .fragment := ⊥ → Browsers do not send fragment ids in the Referer header. 14: let message.headers[Referer] := referrer
15: let s0.pendingDNS[ν
8] := hreference, message, url i
16: stop hhs0.DNSaddress, a, hDNSResolve, message.host, ν8iii, s0
The functions NAVBACK (Algorithm A.5) and NAVFORWARD (Algorithm A.6), navigate a window forward or backward. More precisely, they deactivate one document and activate that document’s succeeding document or preceding document, respectively. If no such succes- sor/predecessor exists, the functions do not change the state.
Algorithm A.5 Web Browser Model: Navigate a window backward.
1: function NAVBACK(w0, s0)
2: if ∃ j ∈ N, j > 1 such that s0.w0.documents.j.active ≡ > then
3: let s0.w0.documents.j.active := ⊥
4: let s0.w0.documents.(j − 1).active := >
5: let s0 := CANCELNAV(s0.w0.nonce, s0)
Algorithm A.6 Web Browser Model: Navigate a window forward.
1: function NAVFORWARD(w0, s0)
2: if ∃ j ∈ N such that s0.w0.documents.j.active ≡ >
,→ ∧ s0.w0.documents.(j + 1) ∈ Documents then
3: let s0.w0.documents.j.active := ⊥
4: let s0.w0.documents.(j + 1).active := >
The function RTC CHECK REMOTE IA (AlgorithmA.7) starts the check of identity assertion presented by a remote server. To this end, the function opens an IdP proxy window. The script in the proxy window has access to the identity assertion via the command RTC GET CHECK IA INFO and can issue the command RTC CHECKED IA when it has successfully checked the IA.
Algorithm A.7 Web Browser Model: Check remote server’s WebRTC identity assertion.
1: function RTC CHECK REMOTE IA(nonce, s0)
2: let idp := s0.rtcConnections[nonce].remoteDescription.idp
3: if idp 6≡ ⊥ then
4: let windownonce := ν10
5: let w0 := hwindownonce, hi, ⊥i
6: let s0.windows := s0.windows +hi w0
7: let path := .wk/idp-proxy
8: let url := hURL, S, idp, path, hi, hii
9: let req := hHTTPReq, ν11, GET, idp, path, hi, hi, hii
10: let s0.rtcConnections[nonce].windownonce := windownonce
11: call HTTP SEND(hREQ, windownoncei, req, url , ⊥, ⊥, ⊥, s0)
The function RUNSCRIPT (Algorithm A.8) performs a script execution step of the script in the document s0.d (which is part of the window s0.w). A new script and document state is chosen according to the relation defined by the script and the new script and document state is saved. Afterwards, the command that the script issued is interpreted.
Algorithm A.8 Web Browser Model: Execute a script.
1: function RUNSCRIPT(w, d, s0)
2: let tree := Clean(s0, s0.d)
3: let cookies := h{hc.name, c.content.valuei|c ∈his0.cookiess0.d.origin.host
,→ ∧ c.content.httpOnly = ⊥
,→ ∧ c.content.secure =⇒ s0.d.origin.protocol ≡ S}i
4: let tlw ← s0.windows such that tlw is the top-level window containing d
5: let sessionStorage := s0.sessionStoragehs0.d.origin, tlw .noncei
6: let localStorage := s0.localStorages0.d.origin
7: let secrets := s0.secretss0.d.origin
8: let R ← script−1(s0.d.script)
9: let in := htree, s0.d.nonce, s0.d.scriptstate, s0.d.scriptinputs, cookies,
,→ localStorage, sessionStorage, s0.ids, secretsi
10: let state0 ←TN(V ), cookies0 ← Cookiesν, localStorage0←TN(V ), sessionStorage0←TN(V ),
,→ command ←TN(V ), outλ:= hstate0, cookies0, localStorage0, sessionStorage0, command i
,→ such that (in, outλ) ∈ R
11: let out := outλ[ν
13/λ1, ν14/λ2, . . . ]
12: let s0.cookiess0.d.origin.host := hCookieMerge(s0.cookiess0.d.origin.host, cookies0)i
13: let s0.localStorages0.d.origin := localStorage0
14: let s0.sessionStoragehs0.d.origin, tlw .noncei := sessionStorage0
15: let s0.d.scriptstate := state0
16: let referrer := s0.d.location
17: let referrerPolicy := s0.d.headers[ReferrerPolicy]
19: switch command do
20: case hHREF, url , hrefwindow , noreferrer i
21: let w0 := GETNAVIGABLEWINDOW(w, hrefwindow , noreferrer , s0)
22: let req := hHTTPReq, ν4, GET, url .host, url .path, url .parameters, hi, hii
23: if noreferrer ≡ > then
24: let referrerPolicy := noreferrer
25: let s0 := CANCELNAV(s0.w0.nonce, s0)
26: call HTTP SEND(hREQ, s0.w0.noncei, req, url , ⊥, referrer , referrerPolicy, s0)
27: case hIFRAME, url , window i
28: let w0 := GETWINDOW(w, window , s0)
29: let req := hHTTPReq, ν4, GET, url .host, url .path, url .parameters, hi, hii
30: let w0 := hν5, hi, ⊥i
31: let s0.w0.activedocument.subwindows := s0.w0.activedocument.subwindows +hiw0
32: call HTTP SEND(hREQ, ν5i, req, url , ⊥, referrer , referrerPolicy, s0)
33: case hFORM, url , method , data, hrefwindow i
34: if method 6∈ {GET, POST} then
35: stop
36: let w0 := GETNAVIGABLEWINDOW(w, hrefwindow , ⊥, s0)
37: if method = GET then
38: let body := hi
39: let parameters := data
40: let origin := ⊥
41: else
42: let body := data
43: let parameters := url .parameters
44: let origin := docorigin
45: let req := hHTTPReq, ν4, method , url .host, url .path, parameters, hi, bodyi
46: let s0 := CANCELNAV(s0.w0.nonce, s0)
47: call HTTP SEND(hREQ, s0.w0.noncei, req, url , origin, referrer , referrerPolicy, s0)
48: case hSETSCRIPT, window , script i
49: let w0 := GETWINDOW(w, window , s0)
50: let s0.w0.activedocument.script := script
51: stop hi, s0
52: case hSETSCRIPTSTATE, window , scriptstatei
53: let w0 := GETWINDOW(w, window , s0)
54: let s0.w0.activedocument.scriptstate := scriptstate
55: stop hi, s0
56: case hXMLHTTPREQUEST, url , method , data, xhrreferencei
57: if method ∈ {CONNECT, TRACE, TRACK} ∧ xhrreference 6∈ {N, ⊥} then
58: stop
59: if url .host 6≡ docorigin.host ∨ url 6≡ docorigin.protocol then
60: stop
61: if method ∈ {GET, HEAD} then
62: let data := hi
63: let origin := ⊥
64: else
65: let origin := docorigin
66: let req := hHTTPReq, ν4, method , url .host, url .path, url .parameters, hi, datai
67: let reference := hXHR, s0.d.nonce, xhrreferencei
69: case hBACK, window i
70: let w0 := GETNAVIGABLEWINDOW(w, window , ⊥, s0)
71: NAVBACK(w0, s0)
72: stop hi, s0
73: case hFORWARD, window i
74: let w0 := GETNAVIGABLEWINDOW(w, window , ⊥, s0)
75: NAVFORWARD(w0, s0)
76: stop hi, s0
77: case hCLOSE, window i
78: let w0 := GETNAVIGABLEWINDOW(w, window , ⊥, s0)
79: remove s0.w0 from the sequence containing it
80: stop hi, s0
81: case hPOSTMESSAGE, window , message, origini
82: let w0 ← Subwindows(s0) such that s0.w0.nonce ≡ window
83: if ∃j ∈ N such that s0.w0.documents.j.active ≡ > ∧
,→ (origin 6≡ ⊥ =⇒ s0.w0.documents.j.origin ≡ origin) then
84: let s0.w0.documents.j.scriptinputs := s0.w0.documents.j.scriptinputs
,→ +hihPOSTMESSAGE, s0.w.nonce, docorigin, messagei
85: stop hi, s0
86: case hWS OPEN, url , wsreferencei
87: let headers := hhUpgrade, websocketii
88: let req := hHTTPReq, ν4, GET, url .host, url .path, url .parameters, headers, hii
89: let reference := hWS, s0.d.nonce, wsreferencei
90: call HTTP SEND(reference, req, url , docorigin, referrer , referrerPolicy, s0)
91: case hWS SEND, wsreference, datai
92: let reference := hWS, s0.d.nonce, wsreferencei
93: let nonce, key, f such that hreference, nonce, key, f i ∈his0.wsConnections
,→ if possible; otherwise stop
94: let msg := hWS MSG, nonce, datai
95: if key 6≡ ⊥ then
96: let msg := encs(msg, key)
97: stop hhf, a, msgii, s0
98: case hRTC CREATE PEERCONNECTION, idp, privkeyi → idp contains only the domain of the IdP. 99: let s0.d.scriptinputs := s0.d.scriptinputs +hi hRTC PEERCONNECTION, ν12i
100: if idp 6≡ ⊥ then → If IdP is used, create new window for IdP proxy script. 101: let windownonce := ν5
102: let w0 := hwindownonce, hi, ⊥i
103: let s0.windows := s0.windows +hiw0
104: let path := .wk/idp-proxy
105: let url := hURL, S, idp, path, hi, hii → Not implemented: subprotocol. 106: let req := hHTTPReq, ν4, GET, idp, path, hi, hi, hii
107: else
108: let windownonce := ν5
109: let record := hs0.d.nonce, privkey, idp, ⊥, windownonce, ⊥, ⊥, ⊥, ⊥, ⊥i
110: let s0.rtcConnections[ν12] := record → Create/store new WebRTC Connection Record.
111: if idp 6≡ ⊥ then → If using IdP proxy, finish with new HTTP request. 112: call HTTP SEND(hREQ, windownoncei, req, url , ⊥, ⊥, ⊥, s0)
113: case hRTC GET OFFER, noncei
114: if s0.rtcConnections[nonce].docnonce 6≡ s0.d.nonce then
116: let conn := s0.rtcConnections[nonce]
117: let offeranswer := hRTC OFFER, nonce, .idp, conn.ia, pub(conn.privkey), ai
118: let s0.d.scriptinputs := s0.d.scriptinputs +hiofferanswer
119: case hRTC SET REMOTE, nonce, offeranswer i
120: if s0.rtcConnections[nonce].docnonce 6≡ s0.d.nonce then
121: stop
122: let s0.rtcConnections[nonce].remoteDescription := offeranswer
123: call RTC CHECK REMOTE IA(nonce, s0) → Check the remote’s identity assertion. 124: case hRTC GET IA INFOi → Called by IdP proxy to receive data to be signed.
125: let nonce ←N such that s0.rtcConnections[nonce].windownonce ≡ s0.w.nonce
,→ if possible; otherwise stop
126: let iarequest := hRTC IA REQUEST, nonce, pub(s0.rtcConnections[nonce].privkey)i
127: let s0.d.scriptinputs := s0.d.scriptinputs +hiiarequest
128: case hRTC SET IA, iai → Called by IdP proxy to commit the IA.
129: let nonce ←N such that s0.rtcConnections[nonce].windownonce ≡ s0.w.nonce
,→ if possible; otherwise stop
130: let s0.rtcConnections[nonce].ia := ia
131: case hRTC GET CHECK IA INFOi → Called by IdP proxy to receive the IA to check. 132: let nonce ←N such that s0.rtcConnections[nonce].windownonce ≡ s0.w.nonce
,→ if possible; otherwise stop
133: let remote := s0.rtcConnections[nonce].remoteDescription
134: let data := hRTC REMOTE IA, remote.nonce, remote.pubkey, remote.iai
135: let s0.d.scriptinputs := s0.d.scriptinputs +hidata
136: case hRTC CHECKED IA, iai → Called by IdP proxy when the IA was checked successfully. 137: let nonce ←N such that s0.rtcConnections[nonce].windownonce ≡ s0.w.nonce
,→ if possible; otherwise stop
138: if s0.rtcConnections[nonce].remoteDescription.ia 6≡ ia then
139: stop
140: let s0.rtcConnections[nonce].remoteAuthenticated := >
141: case hRTC SEND, nonce, datai
142: if s0.rtcConnections[nonce].docnonce 6≡ s0.d.nonce then
143: stop
144: let remote := s0.rtcConnections[nonce].remoteDescription
145: stop hhremote.addr, a, hRTC MSG, remote.nonce, enca(data, remote.pubkey)iii, s0
146: case else
147: stop
The function DELIVER TO DOC (Algorithm A.9) is a helper function that adds data to the script inputs of a document identified by the document reference. This function is used in the following algorithms to deliver WebSocket, WebRTC, and XMLHttpRequest messages to scripts.
Algorithm A.9 Web Browser Model: Deliver a message to the script in a document.
1: function DELIVER TO DOC(docnonce, data, s0)
2: let w ← Subwindows(s0), d such that s0.d.nonce ≡ docnonce ∧ s0.d = s0.w.activedocument
,→ if possible; otherwise stop
The function PROCESSRESPONSE (Algorithm A.10) is responsible for processing an HTTP response (response) that was received as the response to a request (request ) that was sent earlier. The reference identifies this request, which can either be a normal HTTP connection, an XMLHttpRequest, or a WebSocket connection establishment request.
The function first saves any cookies that were contained in the response to the browser state (using the AddCookie helper function shown above), then checks whether a redirection is requested (Location header). If that is the case, the function prepares and sends a new HTTP request, according to the rules in the HTTP/1.1 [RFC7231] and Fetch [Fetch] standards. If no redirection is requested, the function creates a new document (for normal HTTP requests), delivers the contents of the response to the respective receiver (for XMLHttpRequest responses),