Add TAO destination check for navigation redirect chains

fetch.bs

@@ -2307,10 +2307,19 @@ Unless stated otherwise, it is unset.
 <dfn export for=request id=timing-allow-failed>timing allow failed flag</dfn>. Unless stated
 otherwise, it is unset.
 
+<p>A <a for=/>request</a> has an associated
+<dfn for=request>navigation timing allow check list</dfn> (a <a for=/>list</a> of
+<a for=/>lists</a> of <a for=/>strings</a>). Unless stated otherwise, it is « ».
+
+<p class=note>Each <a for=list>item</a> in the <a for=request>navigation timing allow check list</a>
+holds the `<code>Timing-Allow-Origin</code>` values of one redirect <a for=/>response</a> in a
+navigation's redirect chain.
+
 <p class=note>A <a for=/>request</a>'s <a for=request>URL list</a>, <a for=request>current URL</a>,
 <a for=request>redirect count</a>, <a for=request>response tainting</a>,
-<a for=request>done flag</a>, and <a for=request>timing allow failed flag</a> are used as
-bookkeeping details by the <a for=/>fetch</a> algorithm.
+<a for=request>done flag</a>, <a for=request>timing allow failed flag</a>, and
+<a for=request>navigation timing allow check list</a> are used as bookkeeping details by the
+<a for=/>fetch</a> algorithm.
 
 <p>A <a for=/>request</a> has an associated
 <dfn export for=request id=concept-webdriver-id>WebDriver id</dfn>
@@ -2608,6 +2617,15 @@ allowed on the resource fetched by looking at the flag of the response returned.
 the response of a redirect has to be set if it was set for previous responses in the redirect chain,
 this is also tracked internally using the request's <a for=request>timing allow failed flag</a>.
 
+<p>A <a for=/>response</a> has an associated
+<dfn export for=response>navigation timing allow check list</dfn> (a <a for=/>list</a> of
+<a for=/>lists</a> of <a for=/>strings</a>). Unless stated otherwise, it is « ».
+
+<p class=note>This holds the `<code>Timing-Allow-Origin</code>` values of each redirect
+<a for=/>response</a> in a navigation's redirect chain. It is used so that callers can determine,
+once the navigation's destination origin is known, whether that origin is allowed by every redirect
+in the redirect chain.
+
 <p>A <a for=/>response</a> has an associated
 <dfn export for=response id=concept-response-body-info>body info</dfn>
 (a <a for=/>response body info</a>). Unless stated otherwise, it is a new
@@ -5104,6 +5122,11 @@ steps:
  <li><p>Set <var>internalResponse</var>'s <a for=response>redirect taint</a> to <var>request</var>'s
  <a for=request>redirect-taint</a>.
 
+ <li><p>If <var>request</var> is a <a>navigation request</a>, then set
+ <var>internalResponse</var>'s <a for=response>navigation timing allow check list</a> to a
+ <a for=list>clone</a> of <var>request</var>'s
+ <a for=request>navigation timing allow check list</a>.
+
  <li><p>If <var>request</var>'s <a for=request>timing allow failed flag</a> is unset, then set
  <var>internalResponse</var>'s <a for=response>timing allow passed flag</a>.
 
@@ -5884,6 +5907,10 @@ these steps:
   <p>If <var>internalResponse</var>'s <a for=response>status</a> is a <a>redirect status</a>:
 
   <ol>
+   <li><p>If <var>request</var> is a <a>navigation request</a>, then
+   <a>append to a request's navigation timing allow check list</a> given <var>request</var> and
+   <var>internalResponse</var>.
+
    <li>
     <p>If <var>internalResponse</var>'s <a for=response>status</a> is not 303, <var>request</var>'s
     <a for=request>body</a> is non-null, and the <a>connection</a> uses HTTP/2, then user agents
@@ -7311,6 +7338,49 @@ agent's <a>CORS-preflight cache</a> for which there is a <a>cache entry match</a
 </ol>
 </div>
 
+<div algorithm>
+<p>To <dfn>append to a request's navigation timing allow check list</dfn>, given a
+<a for=/>request</a> <var>request</var> and a <a for=/>response</a> <var>response</var>, run these
+steps:
+
+<ol>
+ <li><p><a for=/>Assert</a>: <var>request</var> is a <a>navigation request</a>.
+
+ <li><p>Let <var>taoValues</var> be the result of
+ <a for="header list">getting, decoding, and splitting</a> `<code>Timing-Allow-Origin</code>` from
+ <var>response</var>'s <a for=response>header list</a>.
+
+ <li><p>If <var>taoValues</var> is null, then set <var>taoValues</var> to « ».
+
+ <li><p><a for=list>Append</a> <var>taoValues</var> to <var>request</var>'s
+ <a for=request>navigation timing allow check list</a>.
+</ol>
+</div>
+
+<div algorithm>
+<p>To perform a <dfn export id=concept-navigation-tao-check>navigation TAO check</dfn> for a
+<a for=/>response</a> <var>response</var> and an <a for=/>origin</a>
+<var>destinationOrigin</var>, run these steps:
+
+<ol>
+ <li>
+  <p><a for=list>For each</a> <var>taoValues</var> of <var>response</var>'s
+  <a for=response>navigation timing allow check list</a>:
+
+  <ol>
+   <li><p>If <var>taoValues</var> <a for=list>contains</a> "<code>*</code>", then
+   <a for=iteration>continue</a>.
+
+   <li><p>If <var>taoValues</var> <a for=list>contains</a> <var>destinationOrigin</var>,
+   <a lt="ASCII serialization of an origin">serialized</a>, then <a for=iteration>continue</a>.
+
+   <li><p>Return failure.
+  </ol>
+
+ <li><p>Return success.
+</ol>
+</div>
+
 <h3 id=deferred-fetch>Deferred fetching</h3>
 
 <p>Deferred fetching allows callers to request that a fetch is invoked at the latest possible