W3C home > Mailing lists > Public > whatwg@whatwg.org > January 2013

Re: [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

From: Adam Barth <w3c@adambarth.com>
Date: Mon, 14 Jan 2013 17:42:00 -0800
Message-ID: <CAJE5ia-PiuwpuM5C9MEWRFy5aZv0GYsrupor9StapbhRbE0s3w@mail.gmail.com>
To: Jonas Sicking <jonas@sicking.cc>
Cc: whatwg <whatwg@lists.whatwg.org>, Boris Zbarsky <bzbarsky@mit.edu>, Ian Hickson <ian@hixie.ch>
On Mon, Jan 14, 2013 at 5:34 PM, Jonas Sicking <jonas@sicking.cc> wrote:
> On Jan 9, 2013 11:59 PM, "Adam Barth" <w3c@adambarth.com> wrote:
>> To gather this information, I grepped the WebKit IDL files for
>> "CheckSecurity".  Here's what I learned:
> [snip]
>
> I see no mention of document.domain handling in your description.

Yeah, document.domain is no fun.  :)

> How do you handle the case when script from one Window grabs a Node from
> another Window and then the document of one of the two Windows change its
> document.domain property?

There isn't any code in WebKit that does anything special in this
situation.  Because there are no access checks for Node, the script
can continue to use the Node interface as before.

> Also, in another email you mentioned that you had managed to implement the
> security restrictions on the Window object as a white-list rather than a
> black list by marking some interfaces as "needs same-origin checks" and then
> listing the functions that don't need it.

Correct.

> Does this mean that you mark all interfaces that are implemented by the
> Window and Location objects as "needs security checks"? Including
> EventTarget?

In WebKit, neither Location nor Window implement any other interfaces.

Adam
Received on Tuesday, 15 January 2013 01:43:04 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Wednesday, 30 January 2013 18:48:12 GMT