319077 - Reduce use of allAccess to improve same origin access compatibility with MSIE

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[Bob Clary [:bc] (inactive)]

I think this is a moving target, but it appears that in some ways a fully patched MSIE 6/winxpsp2 is more restrictive than us in terms of allowing access cross domain. I don't have IE7 beta, but can only surmize they might make this even tighter in the future. We may want to tighten this up as well.

bz says "The complete list of things we have that are allAccess is:"
                                 
Object                                            MSIE6 Access Cross Domain
==============================                    =========================
Exception objects (some props)                    not tested
window.frames.length                              yes
window.Components                                 undefined, yes
                                                  user defined, no
window.blur                                       yes
window.close                                      yes
window.closed                                     yes
window.document                                   no
window.document.close                             no
window.document.location.hash (set only)          no
window.document.location.href (set only)          no
window.document.location.reload                   no
window.document.location.replace                  no
window.document.open                              no   
window.focus                                      yes
window.frames                                     yes
window.history                                    no
window.history.back                               no
window.history.forward                            no
window.history.go                                 no
window.location (set only)                        yes
window.location.hash (set only)                   no
window.location.href (set only)                   yes
window.location.reload                            no
window.location.replace                           yes
window.navigator.preference                       undefined, but navigator no.
window.opener                                     yes
window.parent                                     yes
window.self                                       yes   
window.top                                        yes
window.window                                     no

marking security sensitive due to paranoia.

Comment 1

[Boris Zbarsky [:bzbarsky]]

So if IE doesn't allow access to window.document cross-domain, then we shouldn't either.  I know we've had issues with getting hold of a DOMNode cross-domain before, and that this was the reason we couldn't usefully prevent it....

Comment 2

[Daniel Veditz [:dveditz]]

Is this bug still valid? Has the HTML(5) spec process and/or the Firefox 4 access-control rewrite fixed this?

Comment 3

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.