Bug 216530 - MerchantValidationEvent's validationURL should resolve against doc base URL
Summary: MerchantValidationEvent's validationURL should resolve against doc base URL
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: Safari Technology Preview
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar, WPTImpact
Depends on:
Blocks:
 
Reported: 2020-09-14 23:42 PDT by Marcos Caceres
Modified: 2024-01-28 09:18 PST (History)
6 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcos Caceres 2020-09-14 23:42:06 PDT
The MerchantValidationEvent's validationURL is currently resolving against the window's location, rather than the base URL of the document. 

Steps to reproduce:

 1. See failing tests at https://w3c-test.org/payment-request/MerchantValidationEvent/constructor.https.html
Comment 1 Radar WebKit Bug Importer 2020-09-16 16:41:59 PDT
<rdar://problem/69023893>
Comment 2 Ahmad Saleem 2023-11-25 14:22:07 PST
https://searchfox.org/wubkat/rev/78224352916760e6e360c3e1ad5e981f77aaec7d/Source/WebCore/Modules/paymentrequest/MerchantValidationEvent.cpp#46

Should it be?

URL validationURL { document.url(), eventInit.validationURL };

> URL validationURL { document.baseURL(), eventInit.validationURL };

It could be wrong solution but just trying to fix.

Tagging 'Abrar' and 'Anne' in CC and adding 'WPTImpact' keyword.
Comment 3 Ahmad Saleem 2023-11-25 14:31:49 PST
Local build with proposed change in Comment 02 fixes this test and running via 'run-safari --release', all 11 tests passes now.
Comment 4 Ahmad Saleem 2023-11-25 14:42:33 PST
I am hesitant to do PR because it is removed from spec:

https://github.com/w3c/payment-request/commit/8337fee

https://w3c.github.io/payment-request/#changelog

>> Remove merchant validation (#929)
Comment 5 Anne van Kesteren 2023-11-26 02:55:06 PST
It seems it was moved to https://w3c.github.io/merchant-validation/ which still has that requirement.

Instead of using the URL constructor we probably want to use Document's completeURL (and force UTF-8), which should automatically pick up the correct base URL.

We should probably make this change as it'll make our code more consistent and if this ends up in a standard we'd have a very hard time arguing it should be anything else.
Comment 6 Abrar Rahman Protyasha 2023-11-26 23:33:52 PST
(In reply to Anne van Kesteren from comment #5)
> It seems it was moved to https://w3c.github.io/merchant-validation/ which
> still has that requirement.
> 
> Instead of using the URL constructor we probably want to use Document's
> completeURL (and force UTF-8), which should automatically pick up the
> correct base URL.
> 
> We should probably make this change as it'll make our code more consistent
> and if this ends up in a standard we'd have a very hard time arguing it
> should be anything else.

+1 to Anne's assessment here
Comment 7 Marcos Caceres 2023-11-27 20:06:52 PST
Same. Basically everything Anne said. 

Ahmad, no need for hesitation :) Just send a fix along with the Web Platform Test I pointed to initially. 

If you need any guidance, just ping here or in a pull request.
Comment 8 EWS 2024-01-28 09:18:47 PST
Committed 273626@main (2c886037b306): <https://commits.webkit.org/273626@main>

Reviewed commits have been landed. Closing PR #23370 and removing active labels.