Re: [whatwg/webidl] Elaborate on Exposed=* advice (Issue #1119)

@bathos 

> Currently there doesn’t seem to be a way for such Web IDL operations to be coherent for a ShadowRealm global object. Has this already been addressed somewhere (assuming these are intended to be included)? It seems like this would need new spec text to become possible, but I didn’t find anything.

Ok, I understand now. Few notes thought:

* About the `undefined` behavior/case, I don't think that should be a problem in practice, maybe the spec side of things are more complicated. At the end of the day, the callable boundary saves us from all those troubles since you can't really grab another global object from within the ShadowRealm.
* If the Web IDL operation installed on a shadow realm can only be invoked with the global object associated to the shadow realm instance, or undefined, the HOST can get the settings object from that by looking at the root realm associated to it.
* As for the various bugs in Chrome (I'm assuming that they are bugs because other browsers do not behave that way) that are using the receiver's brand to construct objects from the realm associated to the receiver, I don't see why those can't be fixed. (e.g.: `$0.contentWindow.eval("fetch.apply(top, ['test.js'])") instanceof Promise` yields `true` in chrome, and `false` everywhere else). In any case, in the ShadowRealm spec we are very clear about this by restricting host APIs to leak objects from another Realm.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/webidl/issues/1119#issuecomment-1353226633

You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/webidl/issues/1119/1353226633@github.com>