1240096 - Why does nsLocation use the subject principal, not the incumbent, for the triggering principal?

Status: NEW

(Core :: DOM: Core & HTML, defect)

Description

[Boris Zbarsky [:bzbarsky]]

This really only matters much in cases where document.domain is involved, I think.  But while we have an incumbent global there anyway, why not use it?

Comment 1

[Tanvi Vyas[:tanvi]]

https://mxr.mozilla.org/mozilla-central/source/dom/base/nsLocation.cpp#175

Comment 2

[Bobby Holley (:bholley)]

I'm pretty sure it's historical, but I'm also pretty sure it should never make an observable difference, modulo consumers that extract a URI from the principal. That is to say, the incumbent should always be same-origin with the subject, since that's how the web works, and also because we enforce it here: http://hg.mozilla.org/mozilla-central/file/tip/dom/base/ScriptSettings.cpp#l151

Comment 3

[Boris Zbarsky [:bzbarsky]]

> modulo consumers that extract a URI from the principal

Right.  The thing that extracts URIs here is content policies.

I think using the incumbent makes a lot more sense here, honestly, for the consumers who do care about the URI.

Comment 4

[Bobby Holley (:bholley)]

(In reply to Boris Zbarsky [:bz] from comment #3)
> > modulo consumers that extract a URI from the principal
> 
> Right.  The thing that extracts URIs here is content policies.
> 
> I think using the incumbent makes a lot more sense here, honestly, for the
> consumers who do care about the URI.

That is fine with me, sure. Though I really wish we tracked URI and origin separately...