Bug 216530

Summary:	MerchantValidationEvent's validationURL should resolve against doc base URL
Product:	WebKit	Reporter:	Marcos Caceres <marcos>
Component:	New Bugs	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	aestes, ahmad.saleem792, annevk, a_protyasha, marcosc, webkit-bug-importer
Priority:	P2	Keywords:	InRadar, WPTImpact
Version:	Safari Technology Preview
Hardware:	Unspecified
OS:	Unspecified

Description Marcos Caceres 2020-09-14 23:42:06 PDT

The MerchantValidationEvent's validationURL is currently resolving against the window's location, rather than the base URL of the document. 

Steps to reproduce:

 1. See failing tests at https://w3c-test.org/payment-request/MerchantValidationEvent/constructor.https.html

Comment 1 Radar WebKit Bug Importer 2020-09-16 16:41:59 PDT

<rdar://problem/69023893>

Comment 2 Ahmad Saleem 2023-11-25 14:22:07 PST

https://searchfox.org/wubkat/rev/78224352916760e6e360c3e1ad5e981f77aaec7d/Source/WebCore/Modules/paymentrequest/MerchantValidationEvent.cpp#46

Should it be?

URL validationURL { document.url(), eventInit.validationURL };

> URL validationURL { document.baseURL(), eventInit.validationURL };

It could be wrong solution but just trying to fix.

Tagging 'Abrar' and 'Anne' in CC and adding 'WPTImpact' keyword.

Comment 3 Ahmad Saleem 2023-11-25 14:31:49 PST

Local build with proposed change in Comment 02 fixes this test and running via 'run-safari --release', all 11 tests passes now.

Comment 4 Ahmad Saleem 2023-11-25 14:42:33 PST

I am hesitant to do PR because it is removed from spec:

https://github.com/w3c/payment-request/commit/8337fee

https://w3c.github.io/payment-request/#changelog

>> Remove merchant validation (#929)

Comment 5 Anne van Kesteren 2023-11-26 02:55:06 PST

It seems it was moved to https://w3c.github.io/merchant-validation/ which still has that requirement.

Instead of using the URL constructor we probably want to use Document's completeURL (and force UTF-8), which should automatically pick up the correct base URL.

We should probably make this change as it'll make our code more consistent and if this ends up in a standard we'd have a very hard time arguing it should be anything else.

Comment 6 Abrar Rahman Protyasha 2023-11-26 23:33:52 PST

(In reply to Anne van Kesteren from comment #5)
> It seems it was moved to https://w3c.github.io/merchant-validation/ which
> still has that requirement.
> 
> Instead of using the URL constructor we probably want to use Document's
> completeURL (and force UTF-8), which should automatically pick up the
> correct base URL.
> 
> We should probably make this change as it'll make our code more consistent
> and if this ends up in a standard we'd have a very hard time arguing it
> should be anything else.

+1 to Anne's assessment here

Comment 7 Marcos Caceres 2023-11-27 20:06:52 PST

Same. Basically everything Anne said. 

Ahmad, no need for hesitation :) Just send a fix along with the Web Platform Test I pointed to initially. 

If you need any guidance, just ping here or in a pull request.

Comment 8 EWS 2024-01-28 09:18:47 PST

Committed 273626@main (2c886037b306): <https://commits.webkit.org/273626@main>

Reviewed commits have been landed. Closing PR #23370 and removing active labels.