Note: There are a few cases of duplicates in user autocompletion which are being worked on.

window.top should not be replaceable

RESOLVED FIXED in mozilla6

Status

()

Core
DOM
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: Danny Althoff, Assigned: Ms2ger)

Tracking

({dev-doc-complete})

Trunk
mozilla6
dev-doc-complete
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
User-Agent:       Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Build Identifier: Mozilla/5.0 (Windows NT 6.1; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

The attribute "top" from the window-object can be changed to anything i want.

The W3C states that this attribute has to be read-only:
http://www.w3.org/TR/Window/#window-embedding

tested locally and with own webserver ... but should be the same on other systems

Reproducible: Always

Steps to Reproduce:
1. make a page that opens another page via window.open
2. try to change window.open to "hello world" or anything else

Actual Results:  
window.top can be changed to anything i want to (strings, objects, null,...)

Expected Results:  
window.top avoids to be changed by javascript

Tested locally (file:///....) and via own webserver (to wipe out other restrictions)

Tested with current Firefox 4 (4.0.1) in german localization
(Reporter)

Comment 1

6 years ago
Created attachment 529513 [details]
my example-files

If my server is not up, here my testfiles
Component: General → DOM
Product: Firefox → Core
QA Contact: general → general

Comment 2

6 years ago
It's readonly, but replaceable in Gecko (see section B of the link you cite).

What do other browsers do here?

Comment 3

6 years ago
Looks like it's not replaceable in Safari, Chrome, Opera.

jst, how do you feel about changing that in Gecko?
Status: UNCONFIRMED → NEW
Ever confirmed: true
Summary: window.top is NOT readonly and can be set manually → window.top should not be replaceable
OS: Windows 7 → All
Hardware: x86 → All
Version: unspecified → Trunk
(Reporter)

Comment 4

6 years ago
(In reply to comment #3)
> Looks like it's not replaceable in Safari, Chrome, Opera.

I think this is a small flaw of implementation of that spec in gecko. It has its reason why it should not be replaceable ... could be misused in some ways i guess (opening pages in hidden iframes without having affected to be replaced from that iframes by setting the top-attribute to null or anything else than the real top).

i dont have made up a lot of thoughts, just hat do give it a try when it came into my mind ;)

Comment 5

6 years ago
Well, the reason to have properties replaceable is so that this sort of script could work:

  top = document.body.offsetTop;
  top += 5;
  myDiv.style.top = top + "px";

Note that this script will fail in non-Gecko browsers right now, whereas if the first line started with |var| then it will work in all browsers.
(Reporter)

Comment 6

6 years ago
(In reply to comment #5)
> Well, the reason to have properties replaceable is so that this sort of script
> could work:
> 
>   top = document.body.offsetTop;
>   top += 5;
>   myDiv.style.top = top + "px";
> 
> Note that this script will fail in non-Gecko browsers right now, whereas if the
> first line started with |var| then it will work in all browsers.

good example, but due to "all" other browsers are handling "top" as non-replaceable i think gecko is just handling it wrong in replacing special properties. i personally think its bad-practice to use keywords as variable-names, especially without explicit using "var" (got in a lot of trouble already by using other persons code). currently im starting to think if it is possible to change other properties like document or something like that ...
(Assignee)

Updated

6 years ago
Assignee: nobody → Ms2ger
Status: NEW → ASSIGNED
Target Milestone: --- → mozilla6
(Assignee)

Comment 7

6 years ago
Created attachment 530938 [details] [diff] [review]
Patch v1

Expectedly, this caused a test failure. Unexpectedly, it caused only one.
Attachment #530938 - Flags: review?(bzbarsky)

Comment 8

6 years ago
Comment on attachment 530938 [details] [diff] [review]
Patch v1

r=me
Attachment #530938 - Flags: review?(bzbarsky) → review+
(Assignee)

Comment 9

6 years ago
Thanks!

http://hg.mozilla.org/mozilla-central/rev/d75f13dbf81f
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED

Comment 10

6 years ago
Should be probably mentioned on https://developer.mozilla.org/en/window.top
Keywords: dev-doc-needed
Documentation updated:

https://developer.mozilla.org/en/DOM/window.top

Mentioned on Firefox 6 for developers.
Keywords: dev-doc-needed → dev-doc-complete
You need to log in before you can comment on or make changes to this bug.