W3C home > Mailing lists > Public > public-html@w3.org > August 2008

Re: DOM traversal ambiguity question

From: Boris Zbarsky <bzbarsky@MIT.EDU>
Date: Mon, 18 Aug 2008 08:57:51 -0400
Message-ID: <48A971CF.60302@mit.edu>
To: Ory Segal <orysegal@gmail.com>
CC: public-html@w3.org

Ory Segal wrote:
> As my previous email mentioned, the child cannot set/get any objects on 
> the parent, but it can still query for their existence, which means that:
> 
> if ( parent.someObject )
> 
> will still return TRUE/FALSE.

As it happens, the child _can_ in fact get a property off the parent 
window if that property is another frame.  At least in some UAs.  That 
seems like a security bug; I wonder whether it can be fixed without 
breaking the web...

-Boris
Received on Monday, 18 August 2008 12:58:34 UTC

This archive was generated by hypermail 2.3.1 : Monday, 29 September 2014 09:38:57 UTC