Open Bug 931884 Opened 6 years ago Updated 1 year ago

Implement document.origin

Categories

(Core :: DOM: Core & HTML, defect, P3)

defect

Tracking

()

ASSIGNED

People

(Reporter: annevk, Assigned: bzbarsky, NeedInfo)

References

(Blocks 1 open bug)

Details

(Keywords: dev-doc-needed)

Attachments

(3 files, 3 obsolete files)

Keywords: dev-doc-needed
Attached patch Impl (obsolete) — Splinter Review
Not sure where to affix a test so left that out for now.
Attachment #824203 - Flags: review?(bugs)
The best place for a test should be somewhere in imptests where we have the tests for specs,
it is still a bit tricky to submit such tests to github and then get them to be
updated in our tree, so mochitest in content/base/ or dom/tests should be ok.
OS: Mac OS X → All
Hardware: x86 → All
Blocks: 699466
Attached patch Implement document.origin (obsolete) — Splinter Review
Attachment #8530870 - Flags: review?(bugs)
Assignee: nobody → bzbarsky
Status: NEW → ASSIGNED
Comment on attachment 8530870 [details] [diff] [review]
Implement document.origin

>+  void GetOrigin(nsString& retval) const;
Nit, (should fix also other case, but) aRetVal


>+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=931884">Mozilla Bug 931884</a>
>+<p id="display">
>+  <iframe></iframe>
>+  <iframe id="blob-test"></iframe> <!-- will get blob: URI -->
>+  <iframe src="data:text/html,Data"></iframe>
>+  <iframe src="javascript:'javascript'"></iframe>
>+  <iframe src="http://test1.mochi.test:8888/tests/dom/base/test/file_document_origin.html"></iframe>
>+  <iframe src="http://sub1.xn--lt-uia.example.org:8000/tests/dom/base/test/file_document_origin.html"></iframe>

I think we really should have tests for sandboxed stuff and srcdoc too.
Attachment #8530870 - Flags: review?(bugs) → review-
Attached patch Implement document.origin (obsolete) — Splinter Review
Attachment #8531041 - Flags: review?(bugs)
Attachment #8530870 - Attachment is obsolete: true
Attachment #824203 - Attachment is obsolete: true
Attachment #8531041 - Flags: review?(bugs) → review+
what's the status of this?
Flags: needinfo?(bzbarsky)
The status is that people were not happy with the spec for this when I posted an intent to implement, because document.origin is window-only, self.origin is worker-only, and the thing both contexts have is location.origin which is a completely nonsensical thing.  So there was a lot of discussion about moving .origin to somewhere other than document (self?) for the window case... and then nothing happened.

Anne, what's the story here?  Seems like the spec still basically specs the thing which will cause everyone to write code that uses location.origin...
Flags: needinfo?(bzbarsky) → needinfo?(annevk)
Chrome implements document.origin. We could make it self.origin instead I suppose if we can convince Chrome that is worth the churn. Making location.origin magical still seems like a bad solution to me. Trying to get rid of location.origin also seems like something that is unlikely to succeed, but we could try?
Flags: needinfo?(annevk) → needinfo?(mike)
I think we should probably just do self.origin (in both window and worker) _and_ document.origin, give up on location.origin and just steer people away from it, and move on.

The other question is whether we need to make any of these origin attributes on window/document/workerglobalscope unforgeable.
Sounds fine to me. I filed https://www.w3.org/Bugs/Public/show_bug.cgi?id=28801 on adding self.origin to HTML.
No longer blocks: 1168540
I rebased this on top of bug 1306170, because I figure we want that one for sure, but aren't sure about this one.
Attachment #8531041 - Attachment is obsolete: true
Depends on: 1306170
Blink just sent an intent to deprecate: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/CO52Bt15cuc

so going to hold off on this for now.
Priority: -- → P3
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.