From 9b22d034cd5a89cac9e54174d009ef8a256bcf13 Mon Sep 17 00:00:00 2001 From: Anne van Kesteren Date: Wed, 14 Sep 2016 18:50:33 +0200 Subject: [PATCH] Throw for cross-origin [[Delete]] and use "SecurityError" as needed Returning false for [[Delete]] (on Window and Location objects) would only cause its callers to throw in strict mode. Implementations however always throw. We also decided to throw "SecurityError" for [[DefineOwnProperty]] and [[Set]] (the latter through CrossOriginSet). We did not do this for all internal methods: only those where throwing was unique to their cross-origin behavior. Fixes #1726. --- source | 51 +++++++++++++++++++++++++++++---------------------- 1 file changed, 29 insertions(+), 22 deletions(-) diff --git a/source b/source index 30f8a4fea30..f12a231ab33 100644 --- a/source +++ b/source @@ -78365,13 +78365,9 @@ console.assert(iframeWindow.frameElement === null);

  • Assert: desc is not undefined.

  • -

    If IsAccessorDescriptor(desc) is true, then:

    +

    If desc.[[Set]] is present and its value is not undefined, then:

      -

    1. Let setter be desc.[[Set]].

      2. - -

    2. If setter is undefined, return false.

      3. -

    3. Perform ? Call(setter, Receiver, «V»).

      4. @@ -78379,7 +78375,7 @@ console.assert(iframeWindow.frameElement === null);
    • -

  • Return false.

    • +

  • Throw a "SecurityError" DOMException.

    • CrossOriginOwnPropertyKeys ( O )
    @@ -79329,22 +79325,28 @@ callback FrameRequestCallback = void (DOMHighResTimeStamp
      -

    1. If P is an array index property name, return false.

      2. -

    2. Let W be the value of the [[Window]] internal slot of this.

    3. -

      If IsPlatformObjectSameOrigin(W) is true, then return ? - OrdinaryDefineOwnProperty(W, P, Desc).

      +

      If IsPlatformObjectSameOrigin(W) is true, then: -

      This is a willful violation of the JavaScript specification's - invariants of the essential internal methods to maintain compatibility with - existing Web content. See tc39/ecma262 - issue #672 for more information.

      +
        +

      1. If P is an array index property name, return false.

        2. -

      2. Return false.

        3. +
      3. +

        Return ? OrdinaryDefineOwnProperty(W, P, + Desc).

        + +

        This is a willful violation of the JavaScript specification's + invariants of the essential internal methods to maintain compatibility with + existing Web content. See tc39/ecma262 + issue #672 for more information.

        +
        4. +
      + +

    4. Throw a "SecurityError" DOMException.

    [[Get]] ( P, Receiver )

    @@ -79380,16 +79382,21 @@ callback FrameRequestCallback = void (DOMHighResTimeStamp[[Delete]] ( P )
      -

    1. If P is an array index property name, return false.

      2. -

    2. Let W be the value of the [[Window]] internal slot of this.

      3. -

    3. If IsPlatformObjectSameOrigin(W) is true, then return ? - OrdinaryDelete(W, P).

      4. +
    4. +

      If IsPlatformObjectSameOrigin(W) is true, then: -

    5. Return false.

      6. +
        +

      1. If P is an array index property name, then return + false.

        2. + +

      2. Return ? OrdinaryDelete(W, P).

        3. +
      + +

    6. Throw a "SecurityError" DOMException.

    [[OwnPropertyKeys]] ( )

    @@ -81740,7 +81747,7 @@ State: <OUTPUT NAME=I>1</OUTPUT> <INPUT VALUE="Increment" TYPE=BUTTON O -

  • Return false.

    • +

  • Throw a "SecurityError" DOMException.

    • [[Get]] ( P, Receiver )
    @@ -81769,7 +81776,7 @@ State: <OUTPUT NAME=I>1</OUTPUT> <INPUT VALUE="Increment" TYPE=BUTTON O

  • If IsPlatformObjectSameOrigin(this) is true, then return ? OrdinaryDelete(this, P).

    • -

  • Return false.

    • +

  • Throw a "SecurityError" DOMException.

    • [[OwnPropertyKeys]] ( )