This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 20285 - document.open() should probably be ignored on documents that are not the current document in a browsing context
Summary: document.open() should probably be ignored on documents that are not the curr...
Status: RESOLVED FIXED
Alias: None
Product: WHATWG
Classification: Unclassified
Component: HTML (show other bugs)
Version: unspecified
Hardware: Other other
: P3 normal
Target Milestone: Unsorted
Assignee: Ian 'Hixie' Hickson
QA Contact: contributor
URL: http://www.whatwg.org/specs/web-apps/...
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-12-07 07:22 UTC by contributor
Modified: 2012-12-31 05:16 UTC (History)
4 users (show)

See Also:


Attachments

Description contributor 2012-12-07 07:22:23 UTC
Specification: http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html
Multipage: http://www.whatwg.org/C#opening-the-input-stream
Complete: http://www.whatwg.org/c#opening-the-input-stream

Comment:
document.open() should probably be ignored on documents that are not the
current document in a browsing context

Posted from: 173.48.81.109 by bzbarsky@mit.edu
User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:20.0) Gecko/20121203 Firefox/20.0
Comment 1 Boris Zbarsky 2012-12-07 07:24:43 UTC
Gecko certainly ignores open() calls on random documents that have already been unloaded or are the result of a DOMParser parse invocation or whatnot. Not sure what other UAs do.
Comment 2 Ian 'Hixie' Hickson 2012-12-07 22:05:18 UTC
The spec has some efforts at doing this already (e.g. not allowing it during unload); but I'm happy to add more. Do you have any test cases showing this?
Comment 3 Boris Zbarsky 2012-12-07 22:18:59 UTC
  var doc = new DOMParser().parseFromString("<span>", "text/html")
  alert(doc.open());
  alert(doc.querySelector("span"));

Or:

  var ifr = document.createElement("iframe");
  document.documentElement.appendChild(ifr);
  var doc = ifr.contentDocument;
  doc.open();
  doc.write("<span>");
  doc.close();
  ifr.parentNode.removeChild(ifr);
  alert(doc.open());
  alert(doc.querySelector("span"));

Or:

  var ifr = document.createElement("iframe");
  document.documentElement.appendChild(ifr);
  var doc = ifr.contentDocument;
  doc.open();
  doc.write("<span>");
  doc.close();
  setTimeout(function(){
    ifr.onload = function() {
      alert(doc.querySelector("span"));
      alert(doc.open());
      alert(doc.querySelector("span"));
    };
    ifr.contentWindow.location = "http://w3.org";
  }, 100);


Note that for all three of these the current spec makes no sense, since it talks about navigating and whatnot, but that assumes a browsing context. In particular, navigating in the third testcase would be pretty odd.

Note also that UA interop might not be great here.  ;)  In particular, I think Opera throws on the open() in all three cases, Gecko returns null and does nothing, WebKit clears out the DOM but doesn't do any obvious navigating.
Comment 4 Ian 'Hixie' Hickson 2012-12-08 00:22:55 UTC
Yeah, the spec makes no sense here. It assumes the doc is active.

Looking at tests: Wow, there's just no interop here.

e.g. http://software.hixie.ch/utilities/js/live-dom-viewer/saved/2006
 Opera: replaces the currently rendered page with the new text (!)
 WebKit: nukes the doc, writes to it off-screen
 Gecko: does nothing (ignores .open and .write calls)

Should I just abort if the doc is not the active document of its browsing context, or if it has no browsing context? Or just wrap the stuff that only makes sense for active docs with a check that the doc is active?

I should probably test IE before deciding, based on the total lack of interop I've seen so far.
Comment 5 Yuhong Bao 2012-12-08 01:03:41 UTC
IE10RP Win7:
log: object "[object Document]" (259 props: doctype="null", documentElement="null", implementation="[object DOMImplementation]", inputEncoding="UTF-8"...)
log: undefined
log: object "null" (0 props)
log: object "[object HTMLPhraseElement]" (272 props: cite="", dateTime="", currentStyle="[object MSCurrentStyleCSSProperties]", runtimeStyle="[object MSStyleCSSProperties]"...)
IFRAME says "hello!".
Comment 6 Yuhong Bao 2012-12-08 01:04:12 UTC
In IE10 mode.
Comment 8 Yuhong Bao 2012-12-08 01:10:57 UTC
Just tried this again in the same browser and it says "error: Permission denied on line 10".
Comment 9 Yuhong Bao 2012-12-08 01:12:46 UTC
And / is displayed.
Comment 10 Boris Zbarsky 2012-12-08 01:15:42 UTC
> Should I just abort if the doc is not the active document of its browsing
> context, or if it has no browsing context?

That's my preference, obviously, but I might be biased by that being what Gecko does and simple to implement.

> Or just wrap the stuff that only makes sense for active docs with a check that
> the doc is active?

That would probably be OK too, but implementing in practice might be a pain.
Comment 11 Ian 'Hixie' Hickson 2012-12-08 03:28:57 UTC
IE apparently does what Opera does. I don't understand how that happens.
Comment 12 Yuhong Bao 2012-12-08 03:43:29 UTC
It seems to depend on timing.
Comment 13 contributor 2012-12-31 05:16:39 UTC
Checked in as WHATWG revision r7626.
Check-in comment: Make document.open() do nothing on non-active documents
http://html5.org/tools/web-apps-tracker?from=7625&to=7626