[Bug 22346] Security: Check origins when invoking a method, getter, or setter on an object using the property descriptor of another

https://www.w3.org/Bugs/Public/show_bug.cgi?id=22346

Bobby Holley (:bholley) <bobbyholley@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|needinfo?(bobbyholley@gmail |
                   |.com)                       |

--- Comment #21 from Bobby Holley (:bholley) <bobbyholley@gmail.com> ---
(In reply to Anne from comment #18)
> I'm not sure what the right behavior is. I wish I was a little more
> confident, but I'm mostly still struggling with the material here.

Yeah it's pretty hard to keep all the bits in your head at once :-(

> For crossOriginProperties it seems problematic since the active document
> changes which means that certain named properties need to change too ("the
> browsing context name of any child browsing context of the active document
> whose name is not the empty string").

Documents can modify this state of affairs all the time by creating and
removing iframes, so that stuff needs to by dynamic in any case. So I think we
can't store it in a slot. Watch out for
https://code.google.com/p/chromium/issues/detail?id=237022 though.

> Not sure about the map.

See below.

(In reply to Boris Zbarsky from comment #19)
> That depends on what the behavior should be across document.open() and
> navigations from initial about:blank to a same-origin document, right?

Precisely. This is the only situation where it matters whether we store
something on the document vs on the window.

> Please talk to bholley about what needs to happen with the map and
> crossOriginProperties on navigation; I don't really have that paged in right
> now.  :(

The map of property descriptors describes the descriptors that have been
returned for the given ES Window and Location objects, which are per-global and
thus per-Window. So this needs to live on the Window, I think.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

Received on Friday, 22 January 2016 22:51:33 UTC