Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Define getSVGDocument() in terms of content document #5109

Merged
merged 2 commits into from
Dec 13, 2019

Conversation

annevk
Copy link
Member

@annevk annevk commented Nov 25, 2019

Additionally, make content document (also used by contentDocument) perform the same origin-domain comparison on the two documents involved.

Tests: web-platform-tests/wpt#20432.

Fixes #5094.


/browsers.html ( diff )
/embedded-content-other.html ( diff )

Additionally, make content document (also used by contentDocument) perform the same origin-domain comparison on the two documents involved.

Tests: web-platform-tests/wpt#20432.

Fixes #5094.
@annevk annevk requested a review from domenic December 3, 2019 13:25
object</span> are not <span>same origin-domain</span>, then return null.</p></li>
<li><p>If <var>document</var>'s <span>origin</span> and <var>container</var>'s <span>node
document</span>'s <span>origin</span> are not <span>same origin-domain</span>, then return
null.</p></li>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the motivation for this change from checking the current settings object to checking container's node document? Did you mean to check both? Or is there a reason why checking both would be redundant?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It aligns it with getSVGDocument() which is how implementations do it, as far as I can tell.

Copy link
Member

@domenic domenic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM although we'll want to be sure the current vs. container settings object check is tested.

@annevk annevk merged commit 2e317cf into master Dec 13, 2019
@annevk annevk deleted the annevk/getSVGDocument branch December 13, 2019 09:21
annevk added a commit to web-platform-tests/wpt that referenced this pull request Dec 13, 2019
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this pull request Dec 19, 2019
…, a=testonly

Automatic update from web-platform-tests
HTML: getSVGDocument() / contentDocument

For whatwg/html#5094 and whatwg/html#5109.
--

wpt-commits: b5f3eafc45e9e2aa2d502af321d0e8aa704ac5f9
wpt-pr: 20432
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified that referenced this pull request Dec 20, 2019
…, a=testonly

Automatic update from web-platform-tests
HTML: getSVGDocument() / contentDocument

For whatwg/html#5094 and whatwg/html#5109.
--

wpt-commits: b5f3eafc45e9e2aa2d502af321d0e8aa704ac5f9
wpt-pr: 20432

UltraBlame original commit: 9d599fcfcf1f233f299313f4c2b28e2ce31aca43
gecko-dev-updater pushed a commit to marco-c/gecko-dev-comments-removed that referenced this pull request Dec 20, 2019
…, a=testonly

Automatic update from web-platform-tests
HTML: getSVGDocument() / contentDocument

For whatwg/html#5094 and whatwg/html#5109.
--

wpt-commits: b5f3eafc45e9e2aa2d502af321d0e8aa704ac5f9
wpt-pr: 20432

UltraBlame original commit: 9d599fcfcf1f233f299313f4c2b28e2ce31aca43
gecko-dev-updater pushed a commit to marco-c/gecko-dev-wordified-and-comments-removed that referenced this pull request Dec 20, 2019
…, a=testonly

Automatic update from web-platform-tests
HTML: getSVGDocument() / contentDocument

For whatwg/html#5094 and whatwg/html#5109.
--

wpt-commits: b5f3eafc45e9e2aa2d502af321d0e8aa704ac5f9
wpt-pr: 20432

UltraBlame original commit: 9d599fcfcf1f233f299313f4c2b28e2ce31aca43
lissyx pushed a commit to lissyx/mozilla-central that referenced this pull request Dec 20, 2019
…, a=testonly

Automatic update from web-platform-tests
HTML: getSVGDocument() / contentDocument

For whatwg/html#5094 and whatwg/html#5109.
--

wpt-commits: b5f3eafc45e9e2aa2d502af321d0e8aa704ac5f9
wpt-pr: 20432
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

getSVGDocument() and content document use slightly different security checks
2 participants