[whatwg] Navigation and history traversal issues

[Justin Lebar]

>> > I've also made back()/forward()/go() not work during the document's
>> > unload handler, since that could be used for griefing. I'm tempted to
>> > disable it entirely for all docs a la alert(), but I've no idea if
>> > that's Web- compatible and I suspect not.
>>
>> I don't know what you mean by the last sentence here.  In my tests, IE
>> and Opera do not support cross-origin back/forward/go, if that's what
>> you mean.  I don't see any good reason for us to support that in
>> Firefox, either, if we could get away with removing it.
>
> I meant blocking all scripted back/forward session history traversal while
> any page is running the unload algorithms.

Ah, I see.  I don't have any idea if that's a good idea or not, so, okay.  :)

> As far as cross-origin back/forward, there are 404 pages on the Web that
> have javascript:history.back() links; these would break for cross-origin
> links if we blocked cross-origin history traversal. I don't really see
> much point. What's the security risk?

The issue isn't a history.back() which crosses origins -- that seems
fine -- but rather calling history.back() on a cross-origin window.
(Sorry that wasn't clear.)

It's not clear that this poses a security risk (otherwise, I'm sure
we'd have removed it by now), aside from making it easier to tickle
Firefox into buggy states like this bug [1].  But it's also not clear
to me what benefit there is to being able to call back() on an
arbitrary window.

I guess I can navigate a window, so I might as well be able to make it
go back?  But those aren't quite the same thing.

-Justin

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=737307