[html5] r7997 - [giow] (3) Block enumeration of cross-origin objects, and clean up the language [...]
whatwg at whatwg.org
whatwg at whatwg.org
Mon Jun 24 13:28:48 PDT 2013
Author: ianh
Date: 2013-06-24 13:28:46 -0700 (Mon, 24 Jun 2013)
New Revision: 7997
Modified:
complete.html
index
source
Log:
[giow] (3) Block enumeration of cross-origin objects, and clean up the language around those objects to be more consistent so that differences can more easily be seen.
Fixing https://www.w3.org/Bugs/Public/show_bug.cgi?id=22102
Affected topics: DOM APIs, Security
Modified: complete.html
===================================================================
--- complete.html 2013-06-24 18:36:35 UTC (rev 7996)
+++ complete.html 2013-06-24 20:28:46 UTC (rev 7997)
@@ -252,7 +252,7 @@
}
}, false);
- </script><script async defer src="//survey.g.doubleclick.net/async_survey?site=5kr27scvp3mng"></script><body onload=init()>
+ </script><script async defer src="//survey.g.doubleclick.net/async_survey?site=52xlbs7js527m"></script><body onload=init()>
<header class=head id=head><p><a class=logo href=http://www.whatwg.org/><img alt=WHATWG height=101 src=/images/logo width=101></a></p>
<hgroup><h1 class=allcaps>HTML</h1>
@@ -8395,9 +8395,15 @@
<h4 id=security-document><span class=secno>3.1.2 </span>Security</h4>
<p id=security>User agents must throw a <code><a href=#securityerror>SecurityError</a></code> exception whenever any
- properties of a <code><a href=#document>Document</a></code> object are accessed by scripts whose <a href=#effective-script-origin>effective script
- origin</a> is not the <a href=#same-origin title="same origin">same</a> as the <code><a href=#document>Document</a></code>'s
- <a href=#effective-script-origin>effective script origin</a>.</p>
+ properties of a <code><a href=#document>Document</a></code> object are accessed when the <a href=#incumbent-script>incumbent script</a>
+ has an <a href=#effective-script-origin>effective script origin</a> that is not the <a href=#same-origin title="same origin">same</a>
+ as the <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script origin</a>.</p>
+
+ <p>When the <a href=#incumbent-script>incumbent script</a>'s <a href=#effective-script-origin>effective script origin</a> is different than
+ a <code><a href=#document>Document</a></code> object's <a href=#effective-script-origin>effective script origin</a>, the user agent must act as
+ if <!--(redundant since you can't access any anyway) any changes to that <code>Document</code>
+ object's properties, getters, setters, etc, were not present, and as if--> all the properties of
+ that <code><a href=#document>Document</a></code> object had their [[Enumerable]] attribute set to false.</p>
<!--REMOVE-TOPIC:Security-->
@@ -65353,9 +65359,10 @@
<h4 id=security-window><span class=secno>6.2.1 </span>Security</h4>
<p id=security-2>User agents must throw a <code><a href=#securityerror>SecurityError</a></code> exception whenever any
- properties of a <code><a href=#window>Window</a></code> object are accessed by scripts whose <a href=#effective-script-origin>effective script
- origin</a> is not the <a href=#same-origin title="same origin">same</a> as the <code><a href=#window>Window</a></code> object's
- <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script origin</a>, with the following exceptions:</p>
+ properties of a <code><a href=#window>Window</a></code> object are accessed when the <a href=#incumbent-script>incumbent script</a> has
+ an <a href=#effective-script-origin>effective script origin</a> that is not the <a href=#same-origin title="same origin">same</a> as
+ the <code><a href=#window>Window</a></code> object's <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script origin</a>,
+ with the following exceptions:</p>
<ul><li>The <code title=dom-location><a href=#dom-location>location</a></code> attribute
@@ -65383,11 +65390,11 @@
<li>The <a href=#dynamic-nested-browsing-context-properties>dynamic nested browsing context properties</a>
- </ul><p>When a script whose <a href=#effective-script-origin>effective script origin</a> is not the same as the
- <code><a href=#window>Window</a></code> object's <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script origin</a> attempts
- to access that <code><a href=#window>Window</a></code> object's methods or attributes, the user agent must act as if
- any changes to the <code><a href=#window>Window</a></code> object's properties, getters, setters, etc, were not
- present.</p>
+ </ul><p>When the <a href=#incumbent-script>incumbent script</a>'s <a href=#effective-script-origin>effective script origin</a> is different than
+ a <code><a href=#window>Window</a></code> object's <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script origin</a>, the
+ user agent must act as if any changes to that <code><a href=#window>Window</a></code> object's properties, getters,
+ setters, etc, were not present, and as if all the properties of that <code><a href=#window>Window</a></code> object
+ had their [[Enumerable]] attribute set to false.</p>
<p>For members that return objects (including function objects), each distinct <a href=#effective-script-origin>effective
script origin</a> that is not the same as the <code><a href=#window>Window</a></code> object's
@@ -67438,8 +67445,8 @@
<h5 id=security-location><span class=secno>6.5.3.1 </span>Security</h5>
<p id=security-3>User agents must throw a <code><a href=#securityerror>SecurityError</a></code> exception whenever any
- properties of a <code><a href=#location>Location</a></code> object are accessed when the <a href=#entry-script>entry script</a>'s
- <a href=#effective-script-origin>effective script origin</a> is not the <a href=#same-origin title="same origin">same</a> as the
+ properties of a <code><a href=#location>Location</a></code> object are accessed when the <a href=#entry-script>entry script</a> has an
+ <a href=#effective-script-origin>effective script origin</a> that is not the <a href=#same-origin title="same origin">same</a> as the
<code><a href=#location>Location</a></code> object's associated <code><a href=#document>Document</a></code>'s <a href=#browsing-context>browsing context</a>'s
<a href=#active-document>active document</a>'s <a href=#effective-script-origin>effective script origin</a>, with the following
exceptions:</p>
@@ -67457,11 +67464,11 @@
origin</a> is the <a href=#same-origin>same origin</a> as the <code><a href=#location>Location</a></code> object's associated
<code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script origin</a>
- </ul><p>When the <a href=#entry-script>entry script</a>'s <a href=#effective-script-origin>effective script origin</a> is not the <a href=#same-origin>same
- origin</a> as the <code><a href=#location>Location</a></code> object's associated <code><a href=#document>Document</a></code>'s
- <a href=#effective-script-origin>effective script origin</a>, attempts to access that <code><a href=#location>Location</a></code> object's
- methods or attributes must cause the user agent to act as if any changes to the
- <code><a href=#location>Location</a></code> object's properties, getters, setters, etc, were not present.</p>
+ </ul><p>When the <a href=#entry-script>entry script</a>'s <a href=#effective-script-origin>effective script origin</a> is different than a
+ <code><a href=#location>Location</a></code> object's associated <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script
+ origin</a>, the user agent must act as if any changes to that <code><a href=#location>Location</a></code> object's
+ properties, getters, setters, etc, were not present, and as if all the properties of that
+ <code><a href=#location>Location</a></code> object had their [[Enumerable]] attribute set to false.</p>
<p>For members that return objects (including function objects), each distinct <a href=#effective-script-origin>effective
script origin</a> that is not the <a href=#same-origin>same origin</a> as the <code><a href=#location>Location</a></code> object's
@@ -83732,12 +83739,25 @@
<!--ADD-TOPIC:Security-->
<h5 id=security-localStorage><span class=secno>11.2.3.1 </span>Security</h5>
+ <p>For the purposes of this section, a <code><a href=#storage-0>Storage</a></code> object originally returned by a <code title=dom-localStorage><a href=#dom-localstorage>localStorage</a></code> attribute is a <dfn id=protected-storage-object>protected <code>Storage</code>
+ object</dfn>.</p>
+
+ <p>For the purposes of this section, the <dfn id=original-origin>original origin</dfn> of a <a href=#protected-storage-object>protected
+ <code>Storage</code> object</a> is the <a href=#origin>origin</a> of the <code><a href=#document>Document</a></code> of the
+ <code><a href=#window>Window</a></code> object on which the <code title=dom-localStorage><a href=#dom-localstorage>localStorage</a></code>
+ attribute that returned the <code><a href=#storage-0>Storage</a></code> object was accessed.</p>
+
<p>User agents must throw a <code><a href=#securityerror>SecurityError</a></code> exception whenever any properties of a
- <code><a href=#storage-0>Storage</a></code> object originally returned by the <code title=dom-localStorage><a href=#dom-localstorage>localStorage</a></code> attribute are accessed by scripts whose
- <a href=#effective-script-origin>effective script origin</a> is not the <a href=#same-origin title="same origin">same</a> as the
- <a href=#origin>origin</a> of the <code><a href=#document>Document</a></code> of the <code><a href=#window>Window</a></code> object on which the
- <code title=dom-localStorage><a href=#dom-localstorage>localStorage</a></code> attribute was accessed.</p>
+ <a href=#protected-storage-object>protected <code>Storage</code> object</a> are accessed when the <a href=#incumbent-script>incumbent
+ script</a> has an <a href=#effective-script-origin>effective script origin</a> that is not the <a href=#same-origin title="same
+ origin">same</a> as the <a href=#original-origin>original origin</a> of that <code><a href=#storage-0>Storage</a></code> object.</p>
+ <p>When the <a href=#incumbent-script>incumbent script</a>'s <a href=#effective-script-origin>effective script origin</a> is different than
+ a <a href=#protected-storage-object>protected <code>Storage</code> object</a>'s <a href=#original-origin>original origin</a>, the user
+ agent must act as if any changes to that <code><a href=#storage-0>Storage</a></code> object's properties, getters,
+ setters, etc, were not present, and as if all the properties of that <code><a href=#storage-0>Storage</a></code> object
+ had their [[Enumerable]] attribute set to false.</p>
+
<p class=note>This means <code><a href=#storage-0>Storage</a></code> objects are neutered
when the <code title=dom-document-domain><a href=#dom-document-domain>document.domain</a></code>
attribute is used.</p>
Modified: index
===================================================================
--- index 2013-06-24 18:36:35 UTC (rev 7996)
+++ index 2013-06-24 20:28:46 UTC (rev 7997)
@@ -252,7 +252,7 @@
}
}, false);
- </script><script async defer src="//survey.g.doubleclick.net/async_survey?site=5kr27scvp3mng"></script><body onload=init()>
+ </script><script async defer src="//survey.g.doubleclick.net/async_survey?site=52xlbs7js527m"></script><body onload=init()>
<header class=head id=head><p><a class=logo href=http://www.whatwg.org/><img alt=WHATWG height=101 src=/images/logo width=101></a></p>
<hgroup><h1 class=allcaps>HTML</h1>
@@ -8395,9 +8395,15 @@
<h4 id=security-document><span class=secno>3.1.2 </span>Security</h4>
<p id=security>User agents must throw a <code><a href=#securityerror>SecurityError</a></code> exception whenever any
- properties of a <code><a href=#document>Document</a></code> object are accessed by scripts whose <a href=#effective-script-origin>effective script
- origin</a> is not the <a href=#same-origin title="same origin">same</a> as the <code><a href=#document>Document</a></code>'s
- <a href=#effective-script-origin>effective script origin</a>.</p>
+ properties of a <code><a href=#document>Document</a></code> object are accessed when the <a href=#incumbent-script>incumbent script</a>
+ has an <a href=#effective-script-origin>effective script origin</a> that is not the <a href=#same-origin title="same origin">same</a>
+ as the <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script origin</a>.</p>
+
+ <p>When the <a href=#incumbent-script>incumbent script</a>'s <a href=#effective-script-origin>effective script origin</a> is different than
+ a <code><a href=#document>Document</a></code> object's <a href=#effective-script-origin>effective script origin</a>, the user agent must act as
+ if <!--(redundant since you can't access any anyway) any changes to that <code>Document</code>
+ object's properties, getters, setters, etc, were not present, and as if--> all the properties of
+ that <code><a href=#document>Document</a></code> object had their [[Enumerable]] attribute set to false.</p>
<!--REMOVE-TOPIC:Security-->
@@ -65353,9 +65359,10 @@
<h4 id=security-window><span class=secno>6.2.1 </span>Security</h4>
<p id=security-2>User agents must throw a <code><a href=#securityerror>SecurityError</a></code> exception whenever any
- properties of a <code><a href=#window>Window</a></code> object are accessed by scripts whose <a href=#effective-script-origin>effective script
- origin</a> is not the <a href=#same-origin title="same origin">same</a> as the <code><a href=#window>Window</a></code> object's
- <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script origin</a>, with the following exceptions:</p>
+ properties of a <code><a href=#window>Window</a></code> object are accessed when the <a href=#incumbent-script>incumbent script</a> has
+ an <a href=#effective-script-origin>effective script origin</a> that is not the <a href=#same-origin title="same origin">same</a> as
+ the <code><a href=#window>Window</a></code> object's <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script origin</a>,
+ with the following exceptions:</p>
<ul><li>The <code title=dom-location><a href=#dom-location>location</a></code> attribute
@@ -65383,11 +65390,11 @@
<li>The <a href=#dynamic-nested-browsing-context-properties>dynamic nested browsing context properties</a>
- </ul><p>When a script whose <a href=#effective-script-origin>effective script origin</a> is not the same as the
- <code><a href=#window>Window</a></code> object's <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script origin</a> attempts
- to access that <code><a href=#window>Window</a></code> object's methods or attributes, the user agent must act as if
- any changes to the <code><a href=#window>Window</a></code> object's properties, getters, setters, etc, were not
- present.</p>
+ </ul><p>When the <a href=#incumbent-script>incumbent script</a>'s <a href=#effective-script-origin>effective script origin</a> is different than
+ a <code><a href=#window>Window</a></code> object's <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script origin</a>, the
+ user agent must act as if any changes to that <code><a href=#window>Window</a></code> object's properties, getters,
+ setters, etc, were not present, and as if all the properties of that <code><a href=#window>Window</a></code> object
+ had their [[Enumerable]] attribute set to false.</p>
<p>For members that return objects (including function objects), each distinct <a href=#effective-script-origin>effective
script origin</a> that is not the same as the <code><a href=#window>Window</a></code> object's
@@ -67438,8 +67445,8 @@
<h5 id=security-location><span class=secno>6.5.3.1 </span>Security</h5>
<p id=security-3>User agents must throw a <code><a href=#securityerror>SecurityError</a></code> exception whenever any
- properties of a <code><a href=#location>Location</a></code> object are accessed when the <a href=#entry-script>entry script</a>'s
- <a href=#effective-script-origin>effective script origin</a> is not the <a href=#same-origin title="same origin">same</a> as the
+ properties of a <code><a href=#location>Location</a></code> object are accessed when the <a href=#entry-script>entry script</a> has an
+ <a href=#effective-script-origin>effective script origin</a> that is not the <a href=#same-origin title="same origin">same</a> as the
<code><a href=#location>Location</a></code> object's associated <code><a href=#document>Document</a></code>'s <a href=#browsing-context>browsing context</a>'s
<a href=#active-document>active document</a>'s <a href=#effective-script-origin>effective script origin</a>, with the following
exceptions:</p>
@@ -67457,11 +67464,11 @@
origin</a> is the <a href=#same-origin>same origin</a> as the <code><a href=#location>Location</a></code> object's associated
<code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script origin</a>
- </ul><p>When the <a href=#entry-script>entry script</a>'s <a href=#effective-script-origin>effective script origin</a> is not the <a href=#same-origin>same
- origin</a> as the <code><a href=#location>Location</a></code> object's associated <code><a href=#document>Document</a></code>'s
- <a href=#effective-script-origin>effective script origin</a>, attempts to access that <code><a href=#location>Location</a></code> object's
- methods or attributes must cause the user agent to act as if any changes to the
- <code><a href=#location>Location</a></code> object's properties, getters, setters, etc, were not present.</p>
+ </ul><p>When the <a href=#entry-script>entry script</a>'s <a href=#effective-script-origin>effective script origin</a> is different than a
+ <code><a href=#location>Location</a></code> object's associated <code><a href=#document>Document</a></code>'s <a href=#effective-script-origin>effective script
+ origin</a>, the user agent must act as if any changes to that <code><a href=#location>Location</a></code> object's
+ properties, getters, setters, etc, were not present, and as if all the properties of that
+ <code><a href=#location>Location</a></code> object had their [[Enumerable]] attribute set to false.</p>
<p>For members that return objects (including function objects), each distinct <a href=#effective-script-origin>effective
script origin</a> that is not the <a href=#same-origin>same origin</a> as the <code><a href=#location>Location</a></code> object's
@@ -83732,12 +83739,25 @@
<!--ADD-TOPIC:Security-->
<h5 id=security-localStorage><span class=secno>11.2.3.1 </span>Security</h5>
+ <p>For the purposes of this section, a <code><a href=#storage-0>Storage</a></code> object originally returned by a <code title=dom-localStorage><a href=#dom-localstorage>localStorage</a></code> attribute is a <dfn id=protected-storage-object>protected <code>Storage</code>
+ object</dfn>.</p>
+
+ <p>For the purposes of this section, the <dfn id=original-origin>original origin</dfn> of a <a href=#protected-storage-object>protected
+ <code>Storage</code> object</a> is the <a href=#origin>origin</a> of the <code><a href=#document>Document</a></code> of the
+ <code><a href=#window>Window</a></code> object on which the <code title=dom-localStorage><a href=#dom-localstorage>localStorage</a></code>
+ attribute that returned the <code><a href=#storage-0>Storage</a></code> object was accessed.</p>
+
<p>User agents must throw a <code><a href=#securityerror>SecurityError</a></code> exception whenever any properties of a
- <code><a href=#storage-0>Storage</a></code> object originally returned by the <code title=dom-localStorage><a href=#dom-localstorage>localStorage</a></code> attribute are accessed by scripts whose
- <a href=#effective-script-origin>effective script origin</a> is not the <a href=#same-origin title="same origin">same</a> as the
- <a href=#origin>origin</a> of the <code><a href=#document>Document</a></code> of the <code><a href=#window>Window</a></code> object on which the
- <code title=dom-localStorage><a href=#dom-localstorage>localStorage</a></code> attribute was accessed.</p>
+ <a href=#protected-storage-object>protected <code>Storage</code> object</a> are accessed when the <a href=#incumbent-script>incumbent
+ script</a> has an <a href=#effective-script-origin>effective script origin</a> that is not the <a href=#same-origin title="same
+ origin">same</a> as the <a href=#original-origin>original origin</a> of that <code><a href=#storage-0>Storage</a></code> object.</p>
+ <p>When the <a href=#incumbent-script>incumbent script</a>'s <a href=#effective-script-origin>effective script origin</a> is different than
+ a <a href=#protected-storage-object>protected <code>Storage</code> object</a>'s <a href=#original-origin>original origin</a>, the user
+ agent must act as if any changes to that <code><a href=#storage-0>Storage</a></code> object's properties, getters,
+ setters, etc, were not present, and as if all the properties of that <code><a href=#storage-0>Storage</a></code> object
+ had their [[Enumerable]] attribute set to false.</p>
+
<p class=note>This means <code><a href=#storage-0>Storage</a></code> objects are neutered
when the <code title=dom-document-domain><a href=#dom-document-domain>document.domain</a></code>
attribute is used.</p>
Modified: source
===================================================================
--- source 2013-06-24 18:36:35 UTC (rev 7996)
+++ source 2013-06-24 20:28:46 UTC (rev 7997)
@@ -8083,9 +8083,15 @@
<h4 id="security-document">Security</h4>
<p id="security">User agents must throw a <code>SecurityError</code> exception whenever any
- properties of a <code>Document</code> object are accessed by scripts whose <span>effective script
- origin</span> is not the <span title="same origin">same</span> as the <code>Document</code>'s
- <span>effective script origin</span>.</p>
+ properties of a <code>Document</code> object are accessed when the <span>incumbent script</span>
+ has an <span>effective script origin</span> that is not the <span title="same origin">same</span>
+ as the <code>Document</code>'s <span>effective script origin</span>.</p>
+
+ <p>When the <span>incumbent script</span>'s <span>effective script origin</span> is different than
+ a <code>Document</code> object's <span>effective script origin</span>, the user agent must act as
+ if <!--(redundant since you can't access any anyway) any changes to that <code>Document</code>
+ object's properties, getters, setters, etc, were not present, and as if--> all the properties of
+ that <code>Document</code> object had their [[Enumerable]] attribute set to false.</p>
<!--REMOVE-TOPIC:Security-->
@@ -72865,9 +72871,10 @@
<h4 id="security-window">Security</h4>
<p id="security-2">User agents must throw a <code>SecurityError</code> exception whenever any
- properties of a <code>Window</code> object are accessed by scripts whose <span>effective script
- origin</span> is not the <span title="same origin">same</span> as the <code>Window</code> object's
- <code>Document</code>'s <span>effective script origin</span>, with the following exceptions:</p>
+ properties of a <code>Window</code> object are accessed when the <span>incumbent script</span> has
+ an <span>effective script origin</span> that is not the <span title="same origin">same</span> as
+ the <code>Window</code> object's <code>Document</code>'s <span>effective script origin</span>,
+ with the following exceptions:</p>
<ul>
@@ -72899,11 +72906,11 @@
</ul>
- <p>When a script whose <span>effective script origin</span> is not the same as the
- <code>Window</code> object's <code>Document</code>'s <span>effective script origin</span> attempts
- to access that <code>Window</code> object's methods or attributes, the user agent must act as if
- any changes to the <code>Window</code> object's properties, getters, setters, etc, were not
- present.</p>
+ <p>When the <span>incumbent script</span>'s <span>effective script origin</span> is different than
+ a <code>Window</code> object's <code>Document</code>'s <span>effective script origin</span>, the
+ user agent must act as if any changes to that <code>Window</code> object's properties, getters,
+ setters, etc, were not present, and as if all the properties of that <code>Window</code> object
+ had their [[Enumerable]] attribute set to false.</p>
<p>For members that return objects (including function objects), each distinct <span>effective
script origin</span> that is not the same as the <code>Window</code> object's
@@ -75267,8 +75274,8 @@
<h5 id="security-location">Security</h5>
<p id="security-3">User agents must throw a <code>SecurityError</code> exception whenever any
- properties of a <code>Location</code> object are accessed when the <span>entry script</span>'s
- <span>effective script origin</span> is not the <span title="same origin">same</span> as the
+ properties of a <code>Location</code> object are accessed when the <span>entry script</span> has an
+ <span>effective script origin</span> that is not the <span title="same origin">same</span> as the
<code>Location</code> object's associated <code>Document</code>'s <span>browsing context</span>'s
<span>active document</span>'s <span>effective script origin</span>, with the following
exceptions:</p>
@@ -75291,11 +75298,11 @@
</ul>
- <p>When the <span>entry script</span>'s <span>effective script origin</span> is not the <span>same
- origin</span> as the <code>Location</code> object's associated <code>Document</code>'s
- <span>effective script origin</span>, attempts to access that <code>Location</code> object's
- methods or attributes must cause the user agent to act as if any changes to the
- <code>Location</code> object's properties, getters, setters, etc, were not present.</p>
+ <p>When the <span>entry script</span>'s <span>effective script origin</span> is different than a
+ <code>Location</code> object's associated <code>Document</code>'s <span>effective script
+ origin</span>, the user agent must act as if any changes to that <code>Location</code> object's
+ properties, getters, setters, etc, were not present, and as if all the properties of that
+ <code>Location</code> object had their [[Enumerable]] attribute set to false.</p>
<p>For members that return objects (including function objects), each distinct <span>effective
script origin</span> that is not the <span>same origin</span> as the <code>Location</code> object's
@@ -93419,13 +93426,26 @@
<!--ADD-TOPIC:Security-->
<h6 id="security-localStorage">Security</h6>
+ <p>For the purposes of this section, a <code>Storage</code> object originally returned by a <code
+ title="dom-localStorage">localStorage</code> attribute is a <dfn>protected <code>Storage</code>
+ object</dfn>.</p>
+
+ <p>For the purposes of this section, the <dfn>original origin</dfn> of a <span>protected
+ <code>Storage</code> object</span> is the <span>origin</span> of the <code>Document</code> of the
+ <code>Window</code> object on which the <code title="dom-localStorage">localStorage</code>
+ attribute that returned the <code>Storage</code> object was accessed.</p>
+
<p>User agents must throw a <code>SecurityError</code> exception whenever any properties of a
- <code>Storage</code> object originally returned by the <code
- title="dom-localStorage">localStorage</code> attribute are accessed by scripts whose
- <span>effective script origin</span> is not the <span title="same origin">same</span> as the
- <span>origin</span> of the <code>Document</code> of the <code>Window</code> object on which the
- <code title="dom-localStorage">localStorage</code> attribute was accessed.</p>
+ <span>protected <code>Storage</code> object</span> are accessed when the <span>incumbent
+ script</span> has an <span>effective script origin</span> that is not the <span title="same
+ origin">same</span> as the <span>original origin</span> of that <code>Storage</code> object.</p>
+ <p>When the <span>incumbent script</span>'s <span>effective script origin</span> is different than
+ a <span>protected <code>Storage</code> object</span>'s <span>original origin</span>, the user
+ agent must act as if any changes to that <code>Storage</code> object's properties, getters,
+ setters, etc, were not present, and as if all the properties of that <code>Storage</code> object
+ had their [[Enumerable]] attribute set to false.</p>
+
<p class="note">This means <code>Storage</code> objects are neutered
when the <code title="dom-document-domain">document.domain</code>
attribute is used.</p>
More information about the Commit-Watchers
mailing list