1756889 - Checking for the existence of a private field can trigger a SecurityException on cross-origin objects

Status: RESOLVED DUPLICATE of bug 1726039

(Core :: JavaScript Engine, defect, P3)

Description

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: testcase.patch

The attached WPT test checks a cross-domain iframe's Location object for the existence of a private field.

This throws SecurityError: Permission denied to access property #x on cross-origin object".

This violates the weak-map semantics expected of private fields.

Comment 1

[Matthew Gaudet (he/him) [:mgaudet]]

Attachment: Bug 1756889 - Stop attempting to use DOM defined expando for private fields r?peterv

When originally implemented, it seemed like it would make the most sense to
store private fields in the regular expando property DOM proxies already have. However,
they're subject to same-origin checking that doesn't properly map to the weak-map semantics
of private fields, and so this patch simply returns us to using the JS defined
proxy expando for private fields.

Comment 2

[BugBot [:suhaib / :marco]]

There's a r+ patch which didn't land and no activity in this bug for 2 weeks.
:mgaudet, could you have a look please?
If you still have some work to do, you can add an action "Plan Changes" in Phabricator.
For more information, please visit auto_nag documentation.

Comment 3

[Matthew Gaudet (he/him) [:mgaudet]]

This is actually going to get fixed under Bug 1726039; I will mark the rev as plan-changes until then. (and likely resolve this as dupe later)