Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters from Boris Zbarsky on 2013-01-09 (public-whatwg-archive@w3.org from January 2013)

From: Boris Zbarsky <bzbarsky@MIT.EDU>
Date: Wed, 09 Jan 2013 17:18:28 -0500
To: Adam Barth <w3c@adambarth.com>
Cc: whatwg <whatwg@lists.whatwg.org>, Ian Hickson <ian@hixie.ch>
Message-ID: <50EDECB4.8040002@mit.edu>

On 1/9/13 4:33 PM, Adam Barth wrote:
> For what it's worth, that doesn't appear to be necessary for web
> compatibility.  Any time WebKit would return a Document to a script in
> another origin, WebKit returns null instead.

The HTML spec requires that property access on documents use effective 
script origin for checks.

Effective script origins are mutable.

It is in fact possible to get your hands on a document in a different 
effective script origin in WebKit (thanks, document.domain).

Just saying,
Boris

Received on Wednesday, 9 January 2013 22:18:52 UTC