Bug 106641 – window.history shouldn't be exposed across origins

• Status: NEW
• Component: DOM

[Adam Barth]

window.history shouldn't be exposed across origins

[Adam Barth]

Created attachment 182297 [details]
Example patch

[Adam Barth]

There are likely some tests that need to change as well.  We might also want to measure how often window.history is accessed across origins before making this change.

[Eric Seidel (no email)]

Comment on attachment 182297 [details]
Example patch

This is great!  But we need a test.

[Adam Barth]

There are plenty of tests.  I just haven't actually compiled this patch yet.  :)

[Brady Eidson]

Is this in a spec?

[Adam Barth]

> Is this in a spec?

This patch aligns our behavior more closely with the spec:

http://www.whatwg.org/specs/web-apps/current-work/multipage/browsers.html#security-window

There are still a number of differences in what's exposed across origins, which is what the whatwg thread was about.  We'd like the implementation and the spec to converge, but it's not completely obvious to me which things should or shouldn't be exposed across origins.  As a general rule, I think it makes sense to expose as little as possible while still remaining compatible with the web.

[Eric Seidel (no email)]

Mozilla did some investigation of this:
Results: https://bug839867.bugzilla.mozilla.org/attachment.cgi?id=712247
More info: https://bugzilla.mozilla.org/show_bug.cgi?id=839867

Suggesting we're the odd man out here.