29183 2015-10-07 20:06:07 +0000 Objects that implement an [Unforgeable] interface should have a non-configurable @@toPrimitive method 2016-01-29 01:59:26 +0000 1 1 1 Unclassified WebAppsWG WebIDL unspecified PC Linux RESOLVED FIXED P2 normal --- 29383 1 jorendorff cam allen annevk bzbarsky mike public-script-coord public-webapps-bugzilla oldest_to_newest 123598 0 jorendorff 2015-10-07 20:06:07 +0000 There's a platform security invariant is that `location + ""` must not be spoofable, but ES6 adds a new way to spoof ToPrimitive(obj): it now looks for a method obj[@@toPrimitive]. http://www.ecma-international.org/ecma-262/6.0/index.html#sec-toprimitive So unless an innocuous @@toPrimitive method is defined as non-configurable and non-writable on the location object itself (not a prototype), `location + ""` can be spoofed by defining a custom @@toPrimitive method on it. 123600 1 allen 2015-10-07 20:59:16 +0000 Note that it is sufficent to define a non-configurable, readonly own data property whose value is undefined 123707 2 bzbarsky 2015-10-14 13:12:57 +0000 Non-configurable, readonly data property with value undefined is what we're implementing in Gecko. 124739 3 annevk 2016-01-29 01:59:26 +0000 Fixed in https://github.com/annevk/html-cross-origin-objects/issues/19. This will move out of IDL and by defined through prose since Location is the only object that needs this.