Re: [w3c/browser-payment-api] Security hole in payment API when a constructor from a no longer active document is invoked (#361)

@rsolomakhin I can volunteer to work on test cases and pull request for this and related issues.

@bzbarsky would it not fail at step 5 for WebIDL security checks that we have in place in general? At least Gecko and Chromium throw for `alert` and `WebSocket`:

http://software.hixie.ch/utilities/js/live-dom-viewer/saved/4719
http://software.hixie.ch/utilities/js/live-dom-viewer/saved/4720

https://heycam.github.io/webidl/#dfn-perform-a-security-check
https://html.spec.whatwg.org/#integration-with-idl step 2

However I can't find where in WebIDL it says to "perform a security check" for constructors, it seems it only applies to operations and attributes. Is each constructor algorithm expected to do a security check, or is this a bug in WebIDL (or am I missing something)?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/browser-payment-api/issues/361#issuecomment-265719019