Issue metadata
Sign in to add a comment
|
Accessing cross-origin stylesheet data should throw exception instead of failing silently
Reported by
quanxunz...@gmail.com,
Sep 27 2016
|
||||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:49.0) Gecko/20100101 Firefox/49.0 Example URL: Steps to reproduce the problem: 1. open the attached test page What is the expected behavior? It should show something like "SecurityError: ..." What went wrong? It doesn't show the error, but show null for cssRules. Does it occur on multiple sites: N/A Is it a problem with a plugin? N/A Did this work before? No Does this work in other browsers? No Edge, Safari Chrome version: 55.0.2872.0 Channel: canary OS Version: OS X 10.10 Flash Version: Shockwave Flash 23.0 r0 Throwing a SecurityError when accessing information from cross-origin stylesheet is the behavior required in CSSOM spec. See https://drafts.csswg.org/cssom/#dom-cssstylesheet-cssrules
,
Sep 27 2016
,
Oct 3 2016
Eddy / Mike: is this style team or security team?
,
Oct 5 2016
Clicky version of above test: https://jsfiddle.net/fkyrcu3r/2/ Chrome 55 and Safari 9.1.3 do not show the SecurityError. Firefox 48.0.1 does. I haven't looked at the code, but I suspect either team could fix this one. Eddy - can we put on the Style team backlog?
,
Oct 6 2016
Added it to the agenda. Thanks Mike!
,
Oct 6 2016
We should probably use count this first, throwing an exception has the potential to break any content that was null checking here.
,
Nov 27 2016
Any update here? If you have a use count data which shows it would likely break too many things, we should fix the spec. Otherwise, fixing this bug as soon as possible would prevent more sites from relying on the wrong behavior.
,
Dec 1 2016
It's still on our backlog, sorry. We have a lot more work than we have people!
,
Feb 13 2017
,
Mar 30 2017
I had a quick look at this to try to add the UseCounter but I'm not confident that I'll get the right code location. mkwst: Do you have a pointer for where this code change should occur? Alternatively, since the Style team has limited bandwidth, is this issue something the Security team would like to take responsibility for?
,
Jun 13 2017
,
Oct 31 2017
|
|||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||
Comment 1 by mitay...@mozilla.com
, Sep 27 2016