[html5] r6296 - [e] (0) Block access to all properties when going cross-origin, not just defined [...]

whatwg at whatwg.org whatwg at whatwg.org
Thu Jul 14 15:29:34 PDT 2011


Author: ianh
Date: 2011-07-14 15:29:32 -0700 (Thu, 14 Jul 2011)
New Revision: 6296

Modified:
   complete.html
   index
   source
Log:
[e] (0) Block access to all properties when going cross-origin, not just defined members.
Fixing http://www.w3.org/Bugs/Public/show_bug.cgi?id=12440

Modified: complete.html
===================================================================
--- complete.html	2011-07-14 03:13:10 UTC (rev 6295)
+++ complete.html	2011-07-14 22:29:32 UTC (rev 6296)
@@ -239,7 +239,7 @@
 
   <header class=head id=head><p><a class=logo href=http://www.whatwg.org/><img alt=WHATWG height=101 src=/images/logo width=101></a></p>
    <hgroup><h1>Web Applications 1.0</h1>
-    <h2 class="no-num no-toc">Living Standard — Last Updated 13 July 2011</h2>
+    <h2 class="no-num no-toc">Living Standard — Last Updated 14 July 2011</h2>
    </hgroup><dl><dt>Multiple-page version:</dt>
     <dd><a href=http://www.whatwg.org/specs/web-apps/current-work/complete/>http://www.whatwg.org/specs/web-apps/current-work/complete/</a></dd>
     <dt>One-page version:</dt>
@@ -9284,8 +9284,8 @@
   <h4 id=security-document><span class=secno>3.1.2 </span>Security</h4>
 
   <p id=security>User agents <span class=impl>must</span> raise a
-  <code><a href=#security_err>SECURITY_ERR</a></code> exception whenever any of the members of
-  an <code><a href=#htmldocument>HTMLDocument</a></code> object are accessed by scripts whose
+  <code><a href=#security_err>SECURITY_ERR</a></code> exception whenever any properties of a
+  <code><a href=#document>Document</a></code> object are accessed by scripts whose
   <a href=#effective-script-origin>effective script origin</a> is not the <a href=#same-origin title="same
   origin">same</a> as the <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective
   script origin</a>.</p>
@@ -61925,13 +61925,13 @@
   <h4 id=security-window><span class=secno>6.2.1 </span>Security</h4>
 
   <p id=security-2>User agents must raise a
-  <code><a href=#security_err>SECURITY_ERR</a></code> exception whenever any of the members of a
+  <code><a href=#security_err>SECURITY_ERR</a></code> exception whenever any properties of a
   <code><a href=#window>Window</a></code> object are accessed by scripts whose
   <a href=#effective-script-origin>effective script origin</a> is not the same as the
   <code><a href=#window>Window</a></code> object's <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective
   script origin</a>, with the following exceptions:</p>
 
-  <ul><li>The <code title=dom-location><a href=#dom-location>location</a></code> object
+  <ul><li>The <code title=dom-location><a href=#dom-location>location</a></code> attribute
 
    <li>The <code title=dom-window-postMessage><a href=#dom-window-postmessage>postMessage()</a></code> method
 

Modified: index
===================================================================
--- index	2011-07-14 03:13:10 UTC (rev 6295)
+++ index	2011-07-14 22:29:32 UTC (rev 6296)
@@ -243,7 +243,7 @@
 
   <header class=head id=head><p><a class=logo href=http://www.whatwg.org/><img alt=WHATWG height=101 src=/images/logo width=101></a></p>
    <hgroup><h1 class=allcaps>HTML</h1>
-    <h2 class="no-num no-toc">Living Standard — Last Updated 13 July 2011</h2>
+    <h2 class="no-num no-toc">Living Standard — Last Updated 14 July 2011</h2>
    </hgroup><dl><dt><strong>Web developer edition</strong></dt>
     <dd><strong><a href=http://developers.whatwg.org/>http://developers.whatwg.org/</a></strong></dd>
     <dt>Multiple-page version:</dt>
@@ -9153,8 +9153,8 @@
   <h4 id=security-document><span class=secno>3.1.2 </span>Security</h4>
 
   <p id=security>User agents <span class=impl>must</span> raise a
-  <code><a href=#security_err>SECURITY_ERR</a></code> exception whenever any of the members of
-  an <code><a href=#htmldocument>HTMLDocument</a></code> object are accessed by scripts whose
+  <code><a href=#security_err>SECURITY_ERR</a></code> exception whenever any properties of a
+  <code><a href=#document>Document</a></code> object are accessed by scripts whose
   <a href=#effective-script-origin>effective script origin</a> is not the <a href=#same-origin title="same
   origin">same</a> as the <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective
   script origin</a>.</p>
@@ -61797,13 +61797,13 @@
   <h4 id=security-window><span class=secno>6.2.1 </span>Security</h4>
 
   <p id=security-2>User agents must raise a
-  <code><a href=#security_err>SECURITY_ERR</a></code> exception whenever any of the members of a
+  <code><a href=#security_err>SECURITY_ERR</a></code> exception whenever any properties of a
   <code><a href=#window>Window</a></code> object are accessed by scripts whose
   <a href=#effective-script-origin>effective script origin</a> is not the same as the
   <code><a href=#window>Window</a></code> object's <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective
   script origin</a>, with the following exceptions:</p>
 
-  <ul><li>The <code title=dom-location><a href=#dom-location>location</a></code> object
+  <ul><li>The <code title=dom-location><a href=#dom-location>location</a></code> attribute
 
    <li>The <code title=dom-window-postMessage><a href=#dom-window-postmessage>postMessage()</a></code> method
 

Modified: source
===================================================================
--- source	2011-07-14 03:13:10 UTC (rev 6295)
+++ source	2011-07-14 22:29:32 UTC (rev 6296)
@@ -9330,8 +9330,8 @@
   <h4 id="security-document">Security</h4>
 
   <p id="security">User agents <span class="impl">must</span> raise a
-  <code>SECURITY_ERR</code> exception whenever any of the members of
-  an <code>HTMLDocument</code> object are accessed by scripts whose
+  <code>SECURITY_ERR</code> exception whenever any properties of a
+  <code>Document</code> object are accessed by scripts whose
   <span>effective script origin</span> is not the <span title="same
   origin">same</span> as the <code>Document</code>'s <span>effective
   script origin</span>.</p>
@@ -70392,7 +70392,7 @@
   <h4 id="security-window">Security</h4>
 
   <p id="security-2">User agents must raise a
-  <code>SECURITY_ERR</code> exception whenever any of the members of a
+  <code>SECURITY_ERR</code> exception whenever any properties of a
   <code>Window</code> object are accessed by scripts whose
   <span>effective script origin</span> is not the same as the
   <code>Window</code> object's <code>Document</code>'s <span>effective
@@ -70400,7 +70400,7 @@
 
   <ul>
 
-   <li>The <code title="dom-location">location</code> object
+   <li>The <code title="dom-location">location</code> attribute
 
    <li>The <code title="dom-window-postMessage">postMessage()</code> method
 




More information about the Commit-Watchers mailing list