New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 605203 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Apr 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug



Sign in to add a comment

document.implementation.createHTMLDocuments incorrectly throw origin errors

Project Member Reported by esprehn@chromium.org, Apr 20 2016

Issue description

var doc = document.implementation.createHTMLDocument("");

doc.open();

Uncaught SecurityError: Failed to execute 'open' on 'Document': Can only call open() on same-origin documents.(anonymous function) @ domparser.html:26

doc.write(el);

Uncaught SecurityError: Failed to execute 'write' on 'Document': Can only call write() on same-origin documents.(anonymous function) @ domparser.html:27

This worked in M49 and was broken in M50 which is pretty bad. This is high priority since it's not clear to me the breakage is not much deeper and bad origin checks might also be causing badness in other things placed in an DOMImplementation created document.

 

Comment 1 by dcheng@chromium.org, Apr 20 2016

Status: Started (was: Assigned)
Err. We don't have any tests that cover this? =(

Comment 2 by dcheng@chromium.org, Apr 20 2016

Ah, it looks like this only fails for things with unique origins...

Sigh.

Comment 3 by dcheng@chromium.org, Apr 21 2016

Cc: dcheng@chromium.org
Owner: jochen@chromium.org
This is a regression from:

commit 5ff185ee69963f7e749130dce11205021b9f1671
Author: jochen <jochen@chromium.org>
Date:   Fri Jan 29 03:29:07 2016 -0800

    Require the entry document to have the same origin as the open()d document
    
    This implements step 3) of https://html.spec.whatwg.org/#dom-document-open
    
    BUG= 579493 
    R=philipj@opera.com,mkwst@chromium.org
    
    Review URL: https://codereview.chromium.org/1611523002
    
    Cr-Commit-Position: refs/heads/master@{#372330}

It's unclear (to me) how to fix it: since we make a copy of the original SecurityOrigin, the canAccess() check will always fail =/

I've attached a simple test case as well. In Firefox, this works, but I didn't check if it implemented step 3 of the document.open algorithm in the spec.
unique-origin-document-open.html
223 bytes View Download

Comment 4 by jochen@chromium.org, Apr 21 2016

they do implement the spec, looking

Comment 5 by jochen@chromium.org, Apr 21 2016

I wonder why we copy the security origin. the spec doesn't require that.

Comment 6 by jochen@chromium.org, Apr 21 2016

so  issue 282415  changed createHTMLDocument to create its own origin, saying that IE does this (while FF doesn't).

The WhatWG spec says to use FF's behavior. I'd claim we should do the same (which would trivially fix this bug).

Comment 7 by jochen@chromium.org, Apr 21 2016

Status: Fixed (was: Started)

Comment 9 by jochen@chromium.org, Apr 22 2016

Labels: Merge-Request-51

Comment 10 by tin...@google.com, Apr 22 2016

Labels: -Merge-Request-51 Merge-Approved-51 Hotlist-Merge-Approved
Your change meets the bar and is auto-approved for M51 (branch: 2704)

Comment 12 by tkent@chromium.org, Jun 23 2016

Components: -Blink>Architecture Blink>Internals
Renaming Blink>Architecture to Blink>Internals

Sign in to add a comment