mirror of
https://github.com/servo/servo.git
synced 2025-07-25 08:10:21 +01:00
c25355704d
The expression `crossOriginIframe.contentWindow.location.href = "new href"` takes the following steps: (1) Get the setter for `href` by invoking `[[GetOwnProperty]]` on `crossOriginIframe.contentWindow. location`. (2) Call the setter, passing `crossOriginIframe. contentWindow` and `"new href"`. Since the target `Location` is cross origin, getting the setter succeeds only if the `CrossOriginWritable` extended attribute is present on the `href` attribute, and it's present. However, instead of `CrossOriginWritable`, `CrossOriginReadable` was checked mistakenly. Since `Location#href` has `CrossOriginWritable` but not `CrossOriginReadable`, this bug rendered `Location#href` inaccessible from a cross-origin document. |
||
|---|---|---|
| .. | ||
| codegen | ||
| callback.rs | ||
| cell.rs | ||
| constant.rs | ||
| conversions.rs | ||
| error.rs | ||
| guard.rs | ||
| htmlconstructor.rs | ||
| inheritance.rs | ||
| interface.rs | ||
| iterable.rs | ||
| mod.rs | ||
| namespace.rs | ||
| num.rs | ||
| principals.rs | ||
| proxyhandler.rs | ||
| record.rs | ||
| refcounted.rs | ||
| reflector.rs | ||
| root.rs | ||
| serializable.rs | ||
| settings_stack.rs | ||
| str.rs | ||
| structuredclone.rs | ||
| trace.rs | ||
| transferable.rs | ||
| utils.rs | ||
| weakref.rs | ||
| xmlname.rs | ||