New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 794433 link

Starred by 2 users

Issue metadata

Status: Fixed
Owner:
Closed: Dec 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Android , Windows , Chrome , Mac
Pri: 2
Type: Bug



Sign in to add a comment

Replacing document.all must not be allowed

Reported by bhagirat...@samsung.com, Dec 13 2017

Issue description

UserAgent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0

Steps to reproduce the problem:
1. Replacing document.all must not be allowed.
2. 
3. 

What is the expected behavior?
Replacing document.all must not be allowed

What went wrong?
document.all must not be overwritten with something else.

Did this work before? No 

Does this work in other browsers? Yes

Chrome version: <Copy from: 'about:version'>  Channel: n/a
OS Version: 
Flash Version: Shockwave Flash 10.1 r999.<br>Gnash 0.8.11dev, the GNU SWF Player.   Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011   <a href="http://www.fsf.org">Free   Software Foundation</a>, Inc. <br>   Gnash comes with NO WARRANTY, to the extent permitted by law.   You may redistribute copies of Gnash under the terms of the   <a href="http://www.gnu.org/licenses/gpl.html">GNU General Public   License</a>. For more information about Gnash, see <a   href="http://www.gnu.org/software/gnash/">   http://www.gnu.org/software/gnash</a>.   <br>  Compatible Shockwave Flash 10.1 r999.
 
I am working on this isue.
Labels: Needs-Milestone
Components: Blink>DOM

Comment 4 by kochi@chromium.org, Dec 19 2017

Cc: bhagirat...@samsung.com kochi@chromium.org
Components: Blink>Bindings
Owner: yukishiino@chromium.org
Status: Started (was: Unconfirmed)
document.all is a DOM API, but the implementation-wise it's area of
Blink's bindings generator?

https://chromium-review.googlesource.com/c/823513/
It looks like bhagirathi cannot be an owner for this, tentatively
setting yukishiino@ (already reviewing his patch) as a tentative owner.

Comment 5 by phistuck@gmail.com, Dec 19 2017

Labels: OS-Android OS-Chrome OS-Mac OS-Windows
In Firefox 55.0.3 -
document.all = {} // Does not work -
document.all // HTMLAllCollection
Object.defineProperty(document, 'all', {}) // Works -
document.all // undefined

Just make sure everyone is aligned on how it should work.
Project Member

Comment 6 by bugdroid1@chromium.org, Dec 19 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/74c78412e6d3839adb217ce05556f4f3c681dbf3

commit 74c78412e6d3839adb217ce05556f4f3c681dbf3
Author: Bhagirathi Satpathy <bhagirathi.s@samsung.com>
Date: Tue Dec 19 16:54:07 2017

document.all must not be replaced as per specification

document.all must not be overwritten with something else.
E.g., below javascript should not set 'document.all' to '1' instead
it should be always [object HTMLAllCollection].
<script>
document.all = 1;
</script>

Specification:
https://html.spec.whatwg.org/multipage/obsolete.html#other-elements,-attributes-and-apis
https://html.spec.whatwg.org/multipage/obsolete.html#dom-document-all

Bug:  794433 
Change-Id: I40122d7107206fe2fb680fa221cf0ae003379ea9
Reviewed-on: https://chromium-review.googlesource.com/823513
Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Reviewed-by: Philip Jägenstedt <foolip@chromium.org>
Reviewed-by: Yuki Shiino <yukishiino@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Bhagirathi Satpathy <bhagirathi.s@samsung.com>
Cr-Commit-Position: refs/heads/master@{#525058}
[modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/extensions/renderer/resources/platform_app.js
[modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/third_party/WebKit/LayoutTests/external/wpt/html/dom/interfaces-expected.txt
[modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/third_party/WebKit/LayoutTests/fast/dom/undetectable-document-all-expected.txt
[modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/third_party/WebKit/LayoutTests/fast/dom/undetectable-document-all.html
[modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt
[modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt
[modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/third_party/WebKit/Source/core/dom/Document.idl

Labels: M-65
AFAICS, Gecko still declares all as

    readonly attribute HTMLAllCollection all;

while WebKit has somewhat-recently made it a readonly attribute (but a [Replaceable] one) in https://bugs.webkit.org/show_bug.cgi?id=173444. I also checked Edge 16, but 'document.all' always returns undefined in my tests, even though "'all' in document" returns true.

It'd be good to try to reproduce Phistuck's tests on Blink, I guess the different effects are due to WebIDL's rules that I keep forgetting.

In any case, it's probably a good idea to add a chromestatus.com entry about this change so that people aren't caught off-guard.
Hi Raphael, with this patch now |document.all| behavior is same as Gecko to match the specification. I do not have permission to add an entry in chromestatus.com about this change. I had requested "edit" access in the past but still not approved yet. Can anyone please add an entry in chromestatus.com for this change.
Thanks!
Status: Fixed (was: Started)

Sign in to add a comment