W3C home > Mailing lists > Public > public-script-coord@w3.org > July to September 2013

[Bug 22346] Security: When invoking a method, getter, or setter on an object using the property descriptor of another, we need to do a security check

From: <bugzilla@jessica.w3.org>
Date: Wed, 24 Jul 2013 04:25:15 +0000
To: public-script-coord@w3.org
Message-ID: <bug-22346-3890-s31vDZPajx@http.www.w3.org/Bugs/Public/>

--- Comment #5 from Boris Zbarsky <bzbarsky@mit.edu> ---
> Is there ever a case when the global doesn't have a corresponding Document?  

Workers?  I suspect in practice in cases when origins can mix the answer is no.
 But it shouldn't matter, because...

> Can I just follow the chain of

No, once you've landed at the browsing context you lose.  In particular, I
should not be able to get my hands on a cross-origin object, then navigate the
browsing context its global is associated with to some page I'm same-origin
with and then access the object!

Luckily, that's not needed: we just need to define the origins of globals and
be done with it.

>            WindowProxy object that is the global [HTML] ->

The global is a Window, not a WindowProxy.

You are receiving this mail because:
You are on the CC list for the bug.
Received on Wednesday, 24 July 2013 04:25:17 UTC

This archive was generated by hypermail 2.4.0 : Friday, 17 January 2020 17:14:17 UTC