mirror of
https://github.com/servo/servo.git
synced 2025-08-04 13:10:20 +01:00
The expression `crossOriginIframe.contentWindow.location.href = "new href"` takes the following steps: (1) Get the setter for `href` by invoking `[[GetOwnProperty]]` on `crossOriginIframe.contentWindow. location`. (2) Call the setter, passing `crossOriginIframe. contentWindow` and `"new href"`. Since the target `Location` is cross origin, getting the setter succeeds only if the `CrossOriginWritable` extended attribute is present on the `href` attribute, and it's present. However, instead of `CrossOriginWritable`, `CrossOriginReadable` was checked mistakenly. Since `Location#href` has `CrossOriginWritable` but not `CrossOriginReadable`, this bug rendered `Location#href` inaccessible from a cross-origin document. |
||
---|---|---|
.. | ||
allocator | ||
atoms | ||
background_hang_monitor | ||
bluetooth | ||
bluetooth_traits | ||
canvas | ||
canvas_traits | ||
compositing | ||
config | ||
config_plugins | ||
constellation | ||
deny_public_fields | ||
derive_common | ||
devtools | ||
devtools_traits | ||
dom_struct | ||
domobject_derive | ||
embedder_traits | ||
fallible | ||
geometry | ||
gfx | ||
gfx_traits | ||
hashglobe | ||
jstraceable_derive | ||
layout | ||
layout_2020 | ||
layout_thread | ||
layout_thread_2020 | ||
layout_traits | ||
malloc_size_of | ||
media | ||
metrics | ||
msg | ||
net | ||
net_traits | ||
pixels | ||
profile | ||
profile_traits | ||
rand | ||
range | ||
remutex | ||
script | ||
script_layout_interface | ||
script_plugins | ||
script_traits | ||
selectors | ||
servo | ||
servo_arc | ||
size_of_test | ||
std_test_override | ||
style | ||
style_derive | ||
style_traits | ||
to_shmem | ||
to_shmem_derive | ||
url | ||
webdriver_server | ||
webgpu | ||
webrender_surfman | ||
webrender_traits |