Re: DOM traversal ambiguity question

From: Boris Zbarsky <bzbarsky@MIT.EDU> Date: Mon, 18 Aug 2008 08:57:51 -0400 Message-ID: <48A971CF.60302@mit.edu> To: Ory Segal <orysegal@gmail.com> CC: public-html@w3.org · This archive was generated by hypermail 2.2.0+W3C-0.50 : Tuesday, 2 June 2009 18:32:38 GMT

Ory Segal wrote:
> As my previous email mentioned, the child cannot set/get any objects on 
> the parent, but it can still query for their existence, which means that:
> 
> if ( parent.someObject )
> 
> will still return TRUE/FALSE.

As it happens, the child _can_ in fact get a property off the parent 
window if that property is another frame.  At least in some UAs.  That 
seems like a security bug; I wonder whether it can be fixed without 
breaking the web...

-Boris