11105 2010-10-20 10:45:39 +0000 Prevent execution of scripts in documents that don't have a browsing context after 'already started' has been set 2011-08-04 05:15:27 +0000 1 1 1 Unclassified HTML WG LC1 HTML5 spec unspecified All All RESOLVED FIXED P1 critical --- 1 hsivonen ian ian mike Ms2ger public-html-admin public-html-wg-issue-tracking public-html-bugzilla oldest_to_newest 41602 0 hsivonen 2010-10-20 10:45:39 +0000 In http://www.whatwg.org/specs/web-apps/current-work/#running-a-script before the step "If scripting is disabled for the script element, then the user agent must abort these steps at this point. The script is not executed.", please add a step: "If the Document the element is in is not the active document of a browsing context, then the user agent must abort these steps at this point. The script is not executed." Please also add a note saying that this means scripts in XHR responseXML, scripts in DOMParser-created documents, scripts in documents created by XSLTProcessor::transformToDocument and scripts that are first inserted by a script into a document that has been created with document.implementation.createDocument. Note that what's being proposed here is 2 vs. 1 majority behavior for responseXML, DOMParser and XSLTProcessor::transformToDocument but 1 vs. 2 minority behavior for document.implementation.createDocument. (In the set Gecko, Presto, WebKit that is.) 41603 1 hsivonen 2010-10-20 10:46:42 +0000 Demos in http://hsivonen.iki.fi/test/moz/scripts/ 43557 2 ian 2010-12-26 20:20:33 +0000 IIRC the spec already says that scripts in documents without browsing contexts don't run, but that happens later (in the same place that tries to run event handler attributes, e.g.). 43778 3 hsivonen 2011-01-03 11:45:40 +0000 (In reply to comment #2) > IIRC the spec already says that scripts in documents without browsing contexts > don't run, but that happens later (in the same place that tries to run event > handler attributes, e.g.). I tried to find this in the spec but failed. If this indeed is already in the spec, please add a note to the "run" algorithm highlighting this. Furthermore, I think external scripts should fail after their "already started" flag has been set but before a fetch is initiated if there's no browsing context. 45296 4 ian 2011-02-08 21:27:46 +0000 EDITOR'S RESPONSE: This is an Editor's Response to your comment. If you are satisfied with this response, please change the state of this bug to CLOSED. If you have additional information and would like the editor to reconsider, please reopen this bug. If you would like to escalate the issue to the full HTML Working Group, please add the TrackerRequest keyword to this bug, and suggest title and text for the tracker issue; or you may create a tracker issue yourself, if you are able to do so. For more details, see this document: http://dev.w3.org/html5/decision-policy/decision-policy.html Status: Partially Accepted Change Description: see diff given below Rationale: I looked this up. "Scripting is disabled" if there is no browsing context, so the current normative requirements seem to exactly match the intent of the proposal in comment 0, and seems to match the sentiment in the last sentence of comment 3. I've added a note. 45297 5 contributor 2011-02-08 21:31:29 +0000 Checked in as WHATWG revision r5856. Check-in comment: Add a note about cases where scripts won't run. Also, update some references (unrelated to the bug below). http://html5.org/tools/web-apps-tracker?from=5855&to=5856 53592 6 mike 2011-08-04 05:15:27 +0000 mass-move component to LC1