916939 - Drop support for named and indexed access on cross-origin windows

Status: RESOLVED WONTFIX

(Core :: XPConnect, defect)

Description

[Bobby Holley (:bholley)]

The web currently allows this, and I recently filed [1] to get the spec updated here. But after discussing it, Boris and I think it's a major problem for security and for the general future of the web (especially for the kind of sandboxing everyone wants to move toward). As such, we're going to experiment with removing it. See [2].

[1] https://www.w3.org/Bugs/Public/show_bug.cgi?id=21674

[2] https://www.w3.org/Bugs/Public/show_bug.cgi?id=23218#c3

Comment 1

[Bobby Holley (:bholley)]

See also bug 916945.

Comment 2

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=b3786df83924

Comment 3

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=5ed182201e41

Comment 4

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=992375b718da

Comment 5

[Bobby Holley (:bholley)]

Attachment: Drop support for named and indexed access on cross-origin windows. v1

This is now green.

Comment 6

[Bobby Holley (:bholley)]

Let's make sure there are no disable-if-linux64 tests that rely on this:

https://tbpl.mozilla.org/?tree=Try&rev=87154b32287f

Comment 7

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 806287 [details] [diff] [review]
Drop support for named and indexed access on cross-origin windows. v1

r=me.  Fingers crossed!

Comment 8

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/86128d3eac88

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/86128d3eac88

Comment 10

[Armin Ronacher]

Just for the record: this patch just broke Google Hangouts.  See Bug 918539.

Comment 11

[Bobby Holley (:bholley)]

(In reply to Armin Ronacher from comment #10)
> Just for the record: this patch just broke Google Hangouts.  See Bug 918539.

Yeah, that doesn't bode well for this patch. I'm going to back it out and declare defeat on this one.

Comment 12

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/db5f948bbb13

Comment 13

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/db5f948bbb13