W3C home > Mailing lists > Public > whatwg@whatwg.org > November 2008

[whatwg] Origin feedback

From: Ian Hickson <ian@hixie.ch>
Date: Sun, 30 Nov 2008 04:00:13 +0000 (UTC)
Message-ID: <Pine.LNX.4.62.0811300359190.17414@hixie.dreamhostps.com>
On Wed, 30 Apr 2008, Jonas Sicking wrote:
> Ian Hickson wrote:
> > On Wed, 30 Apr 2008, Jonas Sicking wrote:
> > > > The aliasing behaviour seems really dodgy. I've specced the copying
> > > > behaviour, which also matches Opera.
> > > The reason you want to use aliasing is in a situation like this (file
> > > loaded from www.example.com) :
> > > 
> > > <html>
> > >   <body>
> > >   <iframe id=f></iframe>
> > >   <script>
> > > onload = function() {
> > >   document.domain = "example.com";
> > >   document.getElementById('f').contentDocument.write("hello world");
> > > }
> > >   </script>
> > >   </body>
> > > </html>
> > > 
> > > the document.domain call changes the outer documents principal. If there
> > > was no aliasing then the .write call would result in a security exception
> > > stating that content from "example.com" doesn't have access to
> > > "www.example.com".
> > 
> > Yes, you want a security exception there. That's what IE does, in fact.
> > (Opera too.)
> 
> Why do you want that? That seems very counter intuitive to me (though 
> unfortunately lots of document.domain behavior is).

You want that behavior to avoid having to define aliasing and such-like. 
This security model is complex enough as it is; we don't want to make it 
worse than absolutely necessary.

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'
Received on Saturday, 29 November 2008 20:00:13 UTC

This archive was generated by hypermail 2.4.0 : Wednesday, 22 January 2020 16:59:07 UTC