968003 - Window.frameElement getter should do return null if the caller does not subsumes the origin of the frameElement

Status: RESOLVED FIXED

(Core :: DOM: Core & HTML, defect)

Description

[Bobby Holley (:bholley)]

Currently, we rely on security wrappers to give us an opaque object in this case. But the spec says to return null. We should fix that at some point.

The spec currently has this as a document.domain-considering check, so we should make sure to do the right thing if this lands after bug 956382.

Comment 1

[Boris Zbarsky [:bzbarsky]]

This is fairly trivial to fix, but let's just get bug 956382 landed first and then do this.

For the record, all that's needed is to change this line of nsGlobalWindow::GetFrameElement:

  return GetRealFrameElement(aError);

to be:

  Element* element = GetRealFrameElement(aError);
  if (aError.Failed() || !element) {
    return nullptr;
  }
  if (!nsContentUtils::GetSubjectPrincipal()->
        SubsumesConsideringDomain(element->NodePrincipal())) {
    return nullptr;
  }
  return element;

or so.

Comment 2

[Bobby Holley (:bholley)]

https://tbpl.mozilla.org/?tree=Try&rev=792aea58ea4e

Comment 3

[Bobby Holley (:bholley)]

Attachment: Return null for frameElement with a cross-origin parent. v1

Comment 4

[Boris Zbarsky [:bzbarsky]]

Comment on attachment 8376397 [details] [diff] [review]
Return null for frameElement with a cross-origin parent. v1

r=I-believe-the-code-I-suggested?  ;)

Comment 5

[Bobby Holley (:bholley)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/da8ce1721f25

Comment 6

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/da8ce1721f25