Bug 216530 – MerchantValidationEvent's validationURL should resolve against doc base URL

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Marcos Caceres]

The MerchantValidationEvent's validationURL is currently resolving against the window's location, rather than the base URL of the document. 

Steps to reproduce:

 1. See failing tests at https://w3c-test.org/payment-request/MerchantValidationEvent/constructor.https.html

[Radar WebKit Bug Importer]

<rdar://problem/69023893>

[Ahmad Saleem]

https://searchfox.org/wubkat/rev/78224352916760e6e360c3e1ad5e981f77aaec7d/Source/WebCore/Modules/paymentrequest/MerchantValidationEvent.cpp#46

Should it be?

URL validationURL { document.url(), eventInit.validationURL };

> URL validationURL { document.baseURL(), eventInit.validationURL };

It could be wrong solution but just trying to fix.

Tagging 'Abrar' and 'Anne' in CC and adding 'WPTImpact' keyword.

[Ahmad Saleem]

Local build with proposed change in Comment 02 fixes this test and running via 'run-safari --release', all 11 tests passes now.

[Ahmad Saleem]

I am hesitant to do PR because it is removed from spec:

https://github.com/w3c/payment-request/commit/8337fee

https://w3c.github.io/payment-request/#changelog

>> Remove merchant validation (#929)

[Anne van Kesteren]

It seems it was moved to https://w3c.github.io/merchant-validation/ which still has that requirement.

Instead of using the URL constructor we probably want to use Document's completeURL (and force UTF-8), which should automatically pick up the correct base URL.

We should probably make this change as it'll make our code more consistent and if this ends up in a standard we'd have a very hard time arguing it should be anything else.

[Abrar Rahman Protyasha]

(In reply to Anne van Kesteren from comment #5)
> It seems it was moved to https://w3c.github.io/merchant-validation/ which
> still has that requirement.
> 
> Instead of using the URL constructor we probably want to use Document's
> completeURL (and force UTF-8), which should automatically pick up the
> correct base URL.
> 
> We should probably make this change as it'll make our code more consistent
> and if this ends up in a standard we'd have a very hard time arguing it
> should be anything else.

+1 to Anne's assessment here

[Marcos Caceres]

Same. Basically everything Anne said. 

Ahmad, no need for hesitation :) Just send a fix along with the Web Platform Test I pointed to initially. 

If you need any guidance, just ping here or in a pull request.

[EWS]

Committed 273626@main (2c886037b306): <https://commits.webkit.org/273626@main>

Reviewed commits have been landed. Closing PR #23370 and removing active labels.