Re: [heycam/webidl] What is the expected interaction of [SecureContext] with mixins? (#118)

`[Exposed]` doesn't enforce that either, afaict.

Specifically, this is currently valid IDL, I believe:

    [Exposed=Worker]
    interface Foo {};

    [Exposed=Window]
    interface Bar {
      readonly attribute Foo foo;
    };

or at least I see nothing in https://heycam.github.io/webidl/#Exposed that would prevent it.

That said, at least Gecko's binding generator includes checks not present in the IDL spec.  Given the above input, it fails IDL validation with:

    error: Attribute returns a type that is not exposed everywhere where the attribute is exposed

basically to keep people from doing stupid stuff.  It might make sense to add that sort of check to IDL, of course.

That said, there is no way to prevent this solely via IDL.  Consider this example:

    [Exposed=Worker]
    interface Foo {};

    [Exposed=Window]
    interface Bar {
      readonly attribute object foo;  // Prose says to return a Foo instance
    };

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/heycam/webidl/issues/118#issuecomment-332932171