Bug 27887 - Worker URL resolution uses wrong scope
Summary: Worker URL resolution uses wrong scope
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore JavaScript (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Nobody
Depends on:
Reported: 2009-07-31 09:39 PDT by Andrew Wilson
Modified: 2021-06-04 10:29 PDT (History)
1 user (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Wilson 2009-07-31 09:39:16 PDT
Section 4.8.2 of the Web Workers spec reads:

When the Worker(scriptURL) constructor is invoked, the user agent must run the following steps:

Resolve the scriptURL argument relative to the first script's base URL, when the method is invoked.

If this fails, throw a SYNTAX_ERR exception.

If the origin of the resulting absolute URL is not the same as the origin of the script that invoked the constructor, then throw a security exception.

"first script's base URL" == the base URL of the dynamic global object
"origin of the script that invoked the constructor" == "origin of the lexical global object"

Currently we are using the lexical global object for both. The fail case is somewhat subtle (you end up having to grab constructors cross-frame, while changing your origin via document.domain.