[whatwg/webidl] Invoking a callback interface on a cross-origin Location or WindowProxy enters the other origin's realm (Issue #1640)

shannonbooth created an issue (whatwg/webidl#1640)

### What is the issue with the Web IDL Standard?

Given:

`frame.html`

```html
<!doctype html>
<p id="marker">frame-document</p>
```

And `test.html` (which loads frame.html cross origin)

```html
<!doctype html>
<meta charset="utf-8">
<pre id="out"></pre>
<iframe src="http://127.0.0.1:8799/frame.html"></iframe>
<script>
function probe(label, obj) {
  let line;
  try {
    document.createNodeIterator(document, NodeFilter.SHOW_ALL, obj).nextNode();
    line = `${label}: no exception`;
  } catch (e) {
    // e.constructor.constructor is %Function% of whichever realm created e.
    let realm;
    try {
      realm = e.constructor.constructor("return document.getElementById('marker')?.textContent ?? 'this-document'")();
    } catch (n) {
      realm = `${n.name}`;
    }
    line = `${label}: ${e.name}, instanceof TypeError=${e instanceof TypeError}, realm=${realm}\n  ${e.message}`;
  }
  document.getElementById("out").textContent += line + "\n";
}
onload = () => {
  probe("Location", frames[0].location);
  probe("WindowProxy", frames[0]);
  probe("Proxy(Location)", new Proxy(frames[0].location, {}));
};
</script>
```

When a callback interface value is a cross-origin Window, WindowProxy or Location, "call a user object's operation" enters that object's realm (step 7) before looking up the operation (step 10). The lookup then passes IsPlatformObjectSameOrigin, and the TypeError from step 10.4 is created in the other origin's realm and thrown to the caller. Callback functions are unaffected, since every cross-origin callable is created in the caller's realm.

Behaviour table of engines:

| Engine | Location | WindowProxy | Proxy around Location |
|---|---|---|---|
| Spec as written | TypeError created in the frame's realm, thrown to the caller | Same, or the frame's own `acceptNode` global is called if one exists | TypeError created in the frame's realm, thrown to the caller |
| Chrome 152 | SecurityError, "invocation of the provided callback failed due to cross origin access" | same | SecurityError from the blocked `acceptNode` read |
| Safari 26.5 | SecurityError, "Blocked a frame ... from accessing a cross-origin frame" | same | same |
| Firefox 156 | SecurityError, "Permission denied to access property acceptNode" | NotSupportedError, "Refusing to execute function from window whose document is no longer active" | SecurityError, as for Location |



-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/webidl/issues/1640
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/webidl/issues/1640@github.com>