Closed Bug 1498720 Opened Last year Closed Last year

Ensure that we revoke a subframe's storage access when it is removed from the DOM

Categories

(Core :: DOM: Core & HTML, defect, P2)

defect

Tracking

()

RESOLVED FIXED
mozilla64
Tracking Status
firefox64 --- fixed

People

(Reporter: ehsan, Assigned: ehsan)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

From https://github.com/whatwg/html/issues/3338:

Access Removal

Storage access is granted for the life of the document and as long as the document's frame is attached to the DOM. This means:

    Access is removed when the sub frame is detached from the DOM.
I tried hard to write a test for this case, but didn't really succeed.  The reason why this is hard is that once the iframe moves in the DOM it's impossible to communicate with it any longer due to the fact that the wrappers for it get replaced with the dead object wrapper in the parent page's compartment.  I couldn't find a way to get the test to work, so I will submit the patch here without a test.

It is hopefully trivial to see how we don't have any code path that currently does this, and how this patch fixes the bug.
Pushed by eakhgari@mozilla.com:
https://hg.mozilla.org/integration/autoland/rev/bb057b527690
Ensure that we revoke a subframe's storage access when it is removed from the DOM r=baku
Priority: -- → P2
https://hg.mozilla.org/mozilla-central/rev/bb057b527690
Status: NEW → RESOLVED
Closed: Last year
Resolution: --- → FIXED
Target Milestone: --- → mozilla64
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.