432586 - Make it impossible for untrusted JS to get access to native anonymous content

Status: NEW

(Core :: DOM: Core & HTML, defect, P5)

Description

[Olli Pettay [:smaug][[e-mail]]]

Currently .originalTarget or .focusElement (IIRC) etc. may point to
native anonymous content and untrusted JS gets a security exception if
it tries to use it. Would be better if untrusted JS couldn't even
see that there is some native anonymous content.

Comment 1

[Olli Pettay [:smaug][[e-mail]]]

also .relatedTarget and boxObject.firstChild / .lastChild /etc.
What else?

Comment 2

[Boris Zbarsky [:bzbarsky]]

The XUL document focusedElement and whatnot stuff?  I think we do some security checks there already...

Comment 3

[Firefox Bug Husbandry Bot]

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046

Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5.

If you have questions, please contact :mdaly.