Conversation
fix speced#5468 - src/w3c/headers.js: new exported pure function isOffTR(specStatus, href) returns true when specStatus is one of the formal /TR/-track statuses (trStatus — Notes, Rec-track, Registry-track) but href isn't under https://www.w3.org/TR/ (or the w3.org alias). A wrapper, validateRenderingLocation, calls this with document.location.href and raises a pill error (via showError) unless: the current frame isn't the top-level browsing context (so test harnesses and embedded preview panes are unaffected), or specStatus was itself overridden via a ?specStatus= query parameter (the existing local-preview mechanism from core/override-configuration.js). - Statuses like ED, unofficial, base, CG/BG reports, etc. are unaffected — only the statuses that actually generate a w3.org/TR "this version" URL are checked, matching the bug the issue described (a broken "This version" link when e.g. specStatus: WD is deployed on GitHub Pages). - Added tests/unit/w3c/headers-spec.js with unit tests directly exercising isOffTR (fast path, no DOM/iframe needed, since the integration harness always runs inside an iframe where the new check intentionally no-ops). - Verified: pnpm lint clean, full unit suite (93 tests) and integration suite (1160 tests) pass with zero failures, and confirmed no example/headless fixtures use a status that would trip the new check.
| if (!trStatus.includes(specStatus)) { | ||
| return false; | ||
| } | ||
| let url; |
Contributor
There was a problem hiding this comment.
Can probably use URL.canParse(href) to cut down the five lines...
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The validation has bypass and status-coverage gaps, and its user-visible path is untested.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds validation to prevent formal W3C publication statuses from being rendered outside the /TR/ publication space.
Changes:
- Adds publication-location validation with preview and iframe exemptions.
- Adds a reusable URL/status helper.
- Adds unit tests for the helper.
File summaries
| File | Description |
|---|---|
| tests/unit/w3c/headers-spec.js | Tests status and publication URL combinations. |
| src/w3c/headers.js | Validates formal status rendering locations. |
Review details
Suppressed comments (2)
src/w3c/headers.js:707
- The suggested URL is invalid when the page already has query parameters: appending
?specStatus=...after an existing?foo=...does not create aspecStatusparameter. Describe it as adding a query parameter so users can use the appropriate?or&delimiter.
const hint = docLink`W3C documents with a status of \`"${specStatus}"\` must be published under \`https://www.w3.org/TR/\`. Set ${"[specStatus]"} to \`"ED"\` for the Editor's Draft, or append \`?specStatus=${specStatus}\` to the URL to preview this status locally without changing the source.`;
tests/unit/w3c/headers-spec.js:7
- Both newly added loops use
for...of, contrary to this repository's stated preference for functional iteration. UseforEachfor both status lists.
for (const specStatus of ["ED", "unofficial", "base", "CG-DRAFT", "MO"]) {
- Files reviewed: 2/2 changed files
- Comments generated: 3
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| * @param {string} href window.location.href of the document being rendered | ||
| */ | ||
| export function isOffTR(specStatus, href) { | ||
| if (!trStatus.includes(specStatus)) { |
Comment on lines
+700
to
+702
| const specStatusOverridden = new URLSearchParams( | ||
| document.location.search | ||
| ).has("specStatus"); |
Comment on lines
+696
to
+703
| function validateRenderingLocation(specStatus) { | ||
| if (window.parent !== window.self) { | ||
| return; | ||
| } | ||
| const specStatusOverridden = new URLSearchParams( | ||
| document.location.search | ||
| ).has("specStatus"); | ||
| if (specStatusOverridden || !isOffTR(specStatus, document.location.href)) { |
| } catch { | ||
| return false; | ||
| } | ||
| const isOnTR = |
Contributor
There was a problem hiding this comment.
This check seems a bit un-elegant to be honest... my (limited) testing seems to suggest that it always redirects to https://www.w3.org/TR/, so maybe always just checks that it startsWith()? Or is there cases where https://w3.org/TR/ can occur?
| * @param {string} specStatus | ||
| * @param {string} href window.location.href of the document being rendered | ||
| */ | ||
| export function isOffTR(specStatus, href) { |
Contributor
There was a problem hiding this comment.
exporting this just to test it doesn't seem great, to be honest... what would be better is just create any document (like the rest of the tests do)... they all run on localhost and will violate this policy.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix #5468
src/w3c/headers.js: new exported pure function isOffTR(specStatus, href) returns true when specStatus is one of the formal /TR/-track statuses (trStatus — Notes, Rec-track, Registry-track) but href isn't under https://www.w3.org/TR/ (or the w3.org alias). A wrapper, validateRenderingLocation, calls this with document.location.href and raises a pill error (via showError) unless: the current frame isn't the top-level browsing context (so test harnesses and embedded preview panes are unaffected), or specStatus was itself overridden via a ?specStatus= query parameter (the existing local-preview mechanism from core/override-configuration.js).
Statuses like ED, unofficial, base, CG/BG reports, etc. are unaffected — only the statuses that actually generate a w3.org/TR "this version" URL are checked, matching the bug the issue described (a broken "This version" link when e.g. specStatus: WD is deployed on GitHub Pages).
Added tests/unit/w3c/headers-spec.js with unit tests directly exercising isOffTR (fast path, no DOM/iframe needed, since the integration harness always runs inside an iframe where the new check intentionally no-ops).
Verified: pnpm lint clean, full unit suite (93 tests) and integration suite (1160 tests) pass with zero failures, and confirmed no example/headless fixtures use a status that would trip the new check.