[whatwg] Need to define same-origin policy for WebIDL operations/getters/setters

[Jonas Sicking]

On Jan 9, 2013 11:59 PM, "Adam Barth" <w3c at adambarth.com> wrote:

> To gather this information, I grepped the WebKit IDL files for
> "CheckSecurity".  Here's what I learned:
[snip]

I see no mention of document.domain handling in your description.

How do you handle the case when script from one Window grabs a Node from
another Window and then the document of one of the two Windows change its
document.domain property?

Also, in another email you mentioned that you had managed to implement the
security restrictions on the Window object as a white-list rather than a
black list by marking some interfaces as "needs same-origin checks" and
then listing the functions that don't need it.

Does this mean that you mark all interfaces that are implemented by the
Window and Location objects as "needs security checks"? Including
EventTarget?

/ Jonas