Re: WebIDL and prototype chains

On Jul 16, 2009, at 3:08 PM, Jonas Sicking wrote:

>
> I definitely agree you definitely don't want the inner windows
> prototype values if it's a cross-origin window. What you should get is
> less clear to me.
>
> If you should get the outer windows prototype or some sort of blank
> prototype. Personally it'd make the most sense to me if you got a
> blank prototype since that seems like the most consistent behavior.
>

Window itself is even more of a special case. What I had in mind is  
objects hanging off of Window that are accessible to a limited extent  
cross-origin, such as History, or Location, or the postMessage  
function. I don't think it would work to give those a blank prototype.  
And you can't just give them the prototype chain from their home  
window because that would be an XSS violation.

Regards,
Maciej