Replacing document.all must not be allowed
Reported by
bhagirat...@samsung.com,
Dec 13 2017
|
|||||||
Issue descriptionUserAgent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0 Steps to reproduce the problem: 1. Replacing document.all must not be allowed. 2. 3. What is the expected behavior? Replacing document.all must not be allowed What went wrong? document.all must not be overwritten with something else. Did this work before? No Does this work in other browsers? Yes Chrome version: <Copy from: 'about:version'> Channel: n/a OS Version: Flash Version: Shockwave Flash 10.1 r999.<br>Gnash 0.8.11dev, the GNU SWF Player. Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 <a href="http://www.fsf.org">Free Software Foundation</a>, Inc. <br> Gnash comes with NO WARRANTY, to the extent permitted by law. You may redistribute copies of Gnash under the terms of the <a href="http://www.gnu.org/licenses/gpl.html">GNU General Public License</a>. For more information about Gnash, see <a href="http://www.gnu.org/software/gnash/"> http://www.gnu.org/software/gnash</a>. <br> Compatible Shockwave Flash 10.1 r999.
,
Dec 17 2017
,
Dec 18 2017
,
Dec 19 2017
document.all is a DOM API, but the implementation-wise it's area of Blink's bindings generator? https://chromium-review.googlesource.com/c/823513/ It looks like bhagirathi cannot be an owner for this, tentatively setting yukishiino@ (already reviewing his patch) as a tentative owner.
,
Dec 19 2017
In Firefox 55.0.3 -
document.all = {} // Does not work -
document.all // HTMLAllCollection
Object.defineProperty(document, 'all', {}) // Works -
document.all // undefined
Just make sure everyone is aligned on how it should work.
,
Dec 19 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/74c78412e6d3839adb217ce05556f4f3c681dbf3 commit 74c78412e6d3839adb217ce05556f4f3c681dbf3 Author: Bhagirathi Satpathy <bhagirathi.s@samsung.com> Date: Tue Dec 19 16:54:07 2017 document.all must not be replaced as per specification document.all must not be overwritten with something else. E.g., below javascript should not set 'document.all' to '1' instead it should be always [object HTMLAllCollection]. <script> document.all = 1; </script> Specification: https://html.spec.whatwg.org/multipage/obsolete.html#other-elements,-attributes-and-apis https://html.spec.whatwg.org/multipage/obsolete.html#dom-document-all Bug: 794433 Change-Id: I40122d7107206fe2fb680fa221cf0ae003379ea9 Reviewed-on: https://chromium-review.googlesource.com/823513 Reviewed-by: Devlin <rdevlin.cronin@chromium.org> Reviewed-by: Philip Jägenstedt <foolip@chromium.org> Reviewed-by: Yuki Shiino <yukishiino@chromium.org> Reviewed-by: Kentaro Hara <haraken@chromium.org> Commit-Queue: Bhagirathi Satpathy <bhagirathi.s@samsung.com> Cr-Commit-Position: refs/heads/master@{#525058} [modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/extensions/renderer/resources/platform_app.js [modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/third_party/WebKit/LayoutTests/external/wpt/html/dom/interfaces-expected.txt [modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/third_party/WebKit/LayoutTests/fast/dom/undetectable-document-all-expected.txt [modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/third_party/WebKit/LayoutTests/fast/dom/undetectable-document-all.html [modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/third_party/WebKit/LayoutTests/virtual/stable/webexposed/global-interface-listing-expected.txt [modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/third_party/WebKit/LayoutTests/webexposed/global-interface-listing-expected.txt [modify] https://crrev.com/74c78412e6d3839adb217ce05556f4f3c681dbf3/third_party/WebKit/Source/core/dom/Document.idl
,
Dec 19 2017
,
Dec 19 2017
AFAICS, Gecko still declares all as
readonly attribute HTMLAllCollection all;
while WebKit has somewhat-recently made it a readonly attribute (but a [Replaceable] one) in https://bugs.webkit.org/show_bug.cgi?id=173444. I also checked Edge 16, but 'document.all' always returns undefined in my tests, even though "'all' in document" returns true.
It'd be good to try to reproduce Phistuck's tests on Blink, I guess the different effects are due to WebIDL's rules that I keep forgetting.
In any case, it's probably a good idea to add a chromestatus.com entry about this change so that people aren't caught off-guard.
,
Dec 20 2017
Hi Raphael, with this patch now |document.all| behavior is same as Gecko to match the specification. I do not have permission to add an entry in chromestatus.com about this change. I had requested "edit" access in the past but still not approved yet. Can anyone please add an entry in chromestatus.com for this change. Thanks!
,
Dec 20 2017
Filed an entry at: https://www.chromestatus.com/feature/5072231356956672
,
Dec 20 2017
|
|||||||
►
Sign in to add a comment |
|||||||
Comment 1 by bhagirat...@samsung.com
, Dec 13 2017