304886 - [FIXr]content can still shadow real DOM properties from chrome with <img name="links"> etc.

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect, P1)

Description

[Johnny Stenback (:jst)]

In bug 296967 we made XPCNativeWrapper call into the scriptable helper hooks on
our DOM nodes to make an XPCNativeWrapped DOM look more like an unwrapped one,
but this opens up ways for content code to hide things from chrome again. If a
page contains <img name="links">, document.links will not be the collection of
links that it should be, it'll be the image named links.

Some options that were thrown around on IRC were to not expose things by name on
document and forms etc, or to reorder things in XPCNativeWrapper so that any
time a property that is defined in IDL is accessed we'd return that w/o even
calling the hooks... Both have their ups and downs...

Comment 1

[Brendan Eich [:brendan]]

Let's not regress from 1.0.x here.

/be

Comment 2

[Boris Zbarsky [:bzbarsky]]

Attachment: Testcase

This tests various XPCNativeWrapper stuff, but I added tests for this bug
explicitly -- the typeof() == 'function' ones.

Comment 3

[Boris Zbarsky [:bzbarsky]]

Attachment: Clearer testcase

Comment 4

[Boris Zbarsky [:bzbarsky]]

Attachment: patch

Comment 5

[Boris Zbarsky [:bzbarsky]]

Attachment: Same as diff -w

Comment 6

[Johnny Stenback (:jst)]

Comment on attachment 193028 [details] [diff] [review]
Same as diff -w

Yeah, looks good. r+sr=jst

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 193028 [details] [diff] [review]
Same as diff -w

We need this on branch.  Risk is low, I think, and I've updated the
XPCNativeWrapper documentation accordingly.

Comment 8

[Boris Zbarsky [:bzbarsky]]

Attachment: Updated to tip

Comment 9

[Boris Zbarsky [:bzbarsky]]

Fixed, trunk and branch.

Comment 10

[Jesse Ruderman]

Should this bug be made public now?

Comment 11

[Boris Zbarsky [:bzbarsky]]

I missed a case; filed bug 310069 on that.