From 5690b99b52e7de89137bcedc2af79780283e735a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Beaufort?= <beaufort.francois@gmail.com>
Date: Tue, 11 Aug 2026 05:27:43 +0200
Subject: [PATCH] Validate `exposedTo` before registering `AbortSignal`
 algorithm

Move the validation of `options.exposedTo` origins before attaching the
unregister algorithm to `options.signal` in `registerTool()`.

Previously, the abort algorithm was attached to the signal before origin
validation. If `exposedTo` contained an invalid or untrustworthy origin,
the promise was rejected with a `SecurityError`, but the abort algorithm
remained attached to the signal and could inadvertently unregister a
subsequently registered tool of the same name upon aborting.

Also reorder `ModelContextRegisterToolOptions` dictionary members and
domintro definitions to match the processing order of options.
---
 index.bs | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/index.bs b/index.bs
index 4274a31..266ed04 100644
--- a/index.bs
+++ b/index.bs
@@ -407,6 +407,20 @@ The <dfn method for=ModelContext>registerTool(<var>tool</var>, <var>options</var
      </ol>
    </div>
 
+1. Let |exposed origins| be an empty [=list=] of [=origins=].
+
+1. If |options|'s {{ModelContextRegisterToolOptions/exposedTo}} [=map/exists=], then:
+
+     1. [=list/For each=] |origin| of |options|'s {{ModelContextRegisterToolOptions/exposedTo}}:
+
+          1. Let |parsedURL| be the result of running the [=URL parser=] on |origin|.
+
+          1. If |parsedURL| is failure or its [=url/origin=] is not [$is origin potentially
+             trustworthy?|potentially trustworthy$], then return [=a promise rejected with=] a
+             "{{SecurityError}}" {{DOMException}}.
+
+          1. [=list/Append=] |parsedURL|'s [=url/origin=] to |exposed origins|.
+
 1. Let |promise| be [=a new promise=] created in [=this=]'s [=relevant realm=].
 
 1. If |options|'s {{ModelContextRegisterToolOptions/signal}} [=map/exists=], then:
@@ -422,20 +436,6 @@ The <dfn method for=ModelContext>registerTool(<var>tool</var>, <var>options</var
 
         1. [=Reject=] |promise| with |signal|'s [=AbortSignal/abort reason=].
 
-1. Let |exposed origins| be an empty [=list=] of [=origins=].
-
-1. If |options|'s {{ModelContextRegisterToolOptions/exposedTo}} [=map/exists=], then:
-
-     1. [=list/For each=] |origin| of |options|'s {{ModelContextRegisterToolOptions/exposedTo}}:
-
-          1. Let |parsedURL| be the result of running the [=URL parser=] on |origin|.
-
-          1. If |parsedURL| is failure or its [=url/origin=] is not [$is origin potentially
-             trustworthy?|potentially trustworthy$], then return [=a promise rejected with=] a
-             "{{SecurityError}}" {{DOMException}}.
-
-          1. [=list/Append=] |parsedURL|'s [=url/origin=] to |exposed origins|.
-
 1. Let |tool definition| be a new [=tool definition=], with the following [=struct/items=]:
 
    : [=tool definition/name=]
@@ -669,17 +669,17 @@ definition itself.
 
 <xmp class="idl">
 dictionary ModelContextRegisterToolOptions {
-  AbortSignal signal;
   sequence<USVString> exposedTo;
+  AbortSignal signal;
 };
 </xmp>
 
 <dl class="domintro">
+  : <code><var ignore>options</var>["{{ModelContextRegisterToolOptions/exposedTo}}"]</code>
+  :: An array of origins that control which documents this tool is exposed to, in the current document's tree.
+
   : <code><var ignore>options</var>["{{ModelContextRegisterToolOptions/signal}}"]</code>
   :: An {{AbortSignal}} that unregisters the tool when aborted.
-
-  : <code><var ignore>options</var>["{{ModelContextRegisterToolOptions/exposedTo}}"]</code>
-  :: <p>An array of origins that control which documents this tool is exposed to, in the current document's tree.
 </dl>
 
 <h4 id="model-context-get-tool-options">ModelContextGetToolOptions Dictionary</h4>