[whatwg] Location object identity and navigation behavior

[Ian Hickson]

On Mon, 19 Nov 2012, Boris Zbarsky wrote:
> On 11/19/12 8:38 PM, Ian Hickson wrote:
> > For now I've tightened up the spec so it should be implementable, 
> > secure, and Web-compatible
> 
> I don't believe it's secure as currently written, actually.  Filed 
> https://www.w3.org/Bugs/Public/show_bug.cgi?id=20012

Could you elaborate in the bug? I've no idea what you think is wrong.


> > I'm also curious as to why figuring out the "entry script"'s 
> > characteristics needs to use the stack introspection rather than just 
> > having an event-loop global "first script" variable
> 
> You can maintain a stack of entry scripts.  You can't use a global, 
> because you need to push and pop entry scripts as various things happen 
> (e.g. invoking event listeners sets the entry script to the event 
> listener function's script for the duration of the event listener 
> invocation).

The way the spec does it, the stack is implemented as the actual call 
stack, with nested calls to "jump to a code entry-point" storing the old 
value, updating the global, running the script, then restoring the global 
to the stored old value.


> There is no such stack of entry scripts in Gecko yet, but we're working 
> on changing that.
>
> The thing that _really_ requires stack introspection is when you need to 
> look at the caller script instead of the entry script.  Which is what 
> you need to do when performing Location security checks (or indeed, any 
> security checks).

Can you show an example of when that is needed?

As far as I can tell, the entry script always has the same origin as the 
running script. I guess this isn't necessarily true of the effective 
origin, which is what we're using for the Location object security? Is 
that the problem here?

If so, why don't we just make it be an origin check of the entry script 
instead of an effective origin check? If that would make it simpler for 
Gecko, that's fine by me. I don't really see why it would matter in this 
case anyway; if you have both calling each other then you can almost 
certainly trick the script into doing what you want either way.

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'