22102 2013-05-21 04:24:49 +0000 Enumeration of cross-origin objects should silently return nothing 2013-06-26 17:45:54 +0000 1 1 1 Unclassified WHATWG HTML unspecified PC All RESOLVED FIXED P2 normal Unsorted 1 bobbyholley ian cam ian mike contributor oldest_to_newest 87951 0 bobbyholley 2013-05-21 04:24:49 +0000 See https://bugzilla.mozilla.org/show_bug.cgi?id=862380#c4 89026 1 ian 2013-06-10 21:47:08 +0000 heycam, any input on how I should specify this from WebIDL's perspective? 89043 2 cam 2013-06-10 23:58:16 +0000 I don't even know if there's a good way to specify that from the perspective of the ES spec. I think you'll just need to state the requirement about enumeration somewhere in your spec. If you feel that the "Property enumeration" section in Web IDL needs some rework to "allow" your overriding it, let me know. 89342 3 ian 2013-06-14 23:53:14 +0000 I don't really understand how I would specify this. 89766 4 ian 2013-06-24 20:18:06 +0000 http://software.hixie.ch/utilities/js/live-dom-viewer/saved/2362 WebKit/Blink enumerate nothing. Firefox enumerates nothing and bars access to .document for some reason. IE throws an exception. I've tried to specify what Webkit/Blink do here. Hopefully I didn't use terminology in a bogus fashion. As usual, reopen if I'm being silly... 89767 5 contributor 2013-06-24 20:28:57 +0000 Checked in as WHATWG revision r7997. Check-in comment: Block enumeration of cross-origin objects, and clean up the language around those objects to be more consistent so that differences can more easily be seen. http://html5.org/tools/web-apps-tracker?from=7996&to=7997 89768 6 bobbyholley 2013-06-24 20:45:57 +0000 (In reply to comment #4) > WebKit/Blink enumerate nothing. > Firefox enumerates nothing and bars access to .document for some reason. Window.document is not cross-origin accessible per-spec, right? AFAICT Gecko's behavior here is spec-correct: http://www.whatwg.org/specs/web-apps/current-work/multipage/browsers.html#security-window 89769 7 bobbyholley 2013-06-24 20:48:50 +0000 Also, why the localStorage changes? That's not cross-origin accessible, right? 89905 8 bobbyholley 2013-06-26 17:45:54 +0000 (In reply to comment #6) > (In reply to comment #4) > > WebKit/Blink enumerate nothing. > > Firefox enumerates nothing and bars access to .document for some reason. > > Window.document is not cross-origin accessible per-spec, right? AFAICT > Gecko's behavior here is spec-correct: Hixie confirmed on IRC that this is correct. (In reply to comment #7) > Also, why the localStorage changes? That's not cross-origin accessible, > right? I've filed bug 22481 for this.