20285 2012-12-07 07:22:23 +0000 document.open() should probably be ignored on documents that are not the current document in a browsing context 2012-12-31 05:16:39 +0000 1 1 1 Unclassified WHATWG HTML unspecified Other other RESOLVED FIXED http://www.whatwg.org/specs/web-apps/current-work/#opening-the-input-stream P3 normal Unsorted 1 contributor ian bzbarsky ian mike yuhongbao_386 contributor oldest_to_newest 79619 0 contributor 2012-12-07 07:22:23 +0000 Specification: http://www.whatwg.org/specs/web-apps/current-work/multipage/elements.html Multipage: http://www.whatwg.org/C#opening-the-input-stream Complete: http://www.whatwg.org/c#opening-the-input-stream Comment: document.open() should probably be ignored on documents that are not the current document in a browsing context Posted from: 173.48.81.109 by bzbarsky@mit.edu User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:20.0) Gecko/20121203 Firefox/20.0 79620 1 bzbarsky 2012-12-07 07:24:43 +0000 Gecko certainly ignores open() calls on random documents that have already been unloaded or are the result of a DOMParser parse invocation or whatnot. Not sure what other UAs do. 79675 2 ian 2012-12-07 22:05:18 +0000 The spec has some efforts at doing this already (e.g. not allowing it during unload); but I'm happy to add more. Do you have any test cases showing this? 79677 3 bzbarsky 2012-12-07 22:18:59 +0000 var doc = new DOMParser().parseFromString("<span>", "text/html") alert(doc.open()); alert(doc.querySelector("span")); Or: var ifr = document.createElement("iframe"); document.documentElement.appendChild(ifr); var doc = ifr.contentDocument; doc.open(); doc.write("<span>"); doc.close(); ifr.parentNode.removeChild(ifr); alert(doc.open()); alert(doc.querySelector("span")); Or: var ifr = document.createElement("iframe"); document.documentElement.appendChild(ifr); var doc = ifr.contentDocument; doc.open(); doc.write("<span>"); doc.close(); setTimeout(function(){ ifr.onload = function() { alert(doc.querySelector("span")); alert(doc.open()); alert(doc.querySelector("span")); }; ifr.contentWindow.location = "http://w3.org"; }, 100); Note that for all three of these the current spec makes no sense, since it talks about navigating and whatnot, but that assumes a browsing context. In particular, navigating in the third testcase would be pretty odd. Note also that UA interop might not be great here. ;) In particular, I think Opera throws on the open() in all three cases, Gecko returns null and does nothing, WebKit clears out the DOM but doesn't do any obvious navigating. 79717 4 ian 2012-12-08 00:22:55 +0000 Yeah, the spec makes no sense here. It assumes the doc is active. Looking at tests: Wow, there's just no interop here. e.g. http://software.hixie.ch/utilities/js/live-dom-viewer/saved/2006 Opera: replaces the currently rendered page with the new text (!) WebKit: nukes the doc, writes to it off-screen Gecko: does nothing (ignores .open and .write calls) Should I just abort if the doc is not the active document of its browsing context, or if it has no browsing context? Or just wrap the stuff that only makes sense for active docs with a check that the doc is active? I should probably test IE before deciding, based on the total lack of interop I've seen so far. 79727 5 yuhongbao_386 2012-12-08 01:03:41 +0000 IE10RP Win7: log: object "[object Document]" (259 props: doctype="null", documentElement="null", implementation="[object DOMImplementation]", inputEncoding="UTF-8"...) log: undefined log: object "null" (0 props) log: object "[object HTMLPhraseElement]" (272 props: cite="", dateTime="", currentStyle="[object MSCurrentStyleCSSProperties]", runtimeStyle="[object MSStyleCSSProperties]"...) IFRAME says "hello!". 79728 6 yuhongbao_386 2012-12-08 01:04:12 +0000 In IE10 mode. 79729 7 yuhongbao_386 2012-12-08 01:06:19 +0000 For http://software.hixie.ch/utilities/js/live-dom-viewer/?saved=2007 79730 8 yuhongbao_386 2012-12-08 01:10:57 +0000 Just tried this again in the same browser and it says "error: Permission denied on line 10". 79731 9 yuhongbao_386 2012-12-08 01:12:46 +0000 And / is displayed. 79732 10 bzbarsky 2012-12-08 01:15:42 +0000 > Should I just abort if the doc is not the active document of its browsing > context, or if it has no browsing context? That's my preference, obviously, but I might be biased by that being what Gecko does and simple to implement. > Or just wrap the stuff that only makes sense for active docs with a check that > the doc is active? That would probably be OK too, but implementing in practice might be a pain. 79738 11 ian 2012-12-08 03:28:57 +0000 IE apparently does what Opera does. I don't understand how that happens. 79739 12 yuhongbao_386 2012-12-08 03:43:29 +0000 It seems to depend on timing. 80768 13 contributor 2012-12-31 05:16:39 +0000 Checked in as WHATWG revision r7626. Check-in comment: Make document.open() do nothing on non-active documents http://html5.org/tools/web-apps-tracker?from=7625&to=7626