This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.

Bug 11105 - Prevent execution of scripts in documents that don't have a browsing context after 'already started' has been set
Summary: Prevent execution of scripts in documents that don't have a browsing context ...
Status: RESOLVED FIXED
Alias: None
Product: HTML WG
Classification: Unclassified
Component: LC1 HTML5 spec (show other bugs)
Version: unspecified
Hardware: All All
: P1 critical
Target Milestone: ---
Assignee: Ian 'Hixie' Hickson
QA Contact: HTML WG Bugzilla archive list
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-10-20 10:45 UTC by Henri Sivonen
Modified: 2011-08-04 05:15 UTC (History)
5 users (show)

See Also:

Attachments

Description Henri Sivonen 2010-10-20 10:45:39 UTC 
In http://www.whatwg.org/specs/web-apps/current-work/#running-a-script before the step "If scripting is disabled for the script element, then the user agent must abort these steps at this point. The script is not executed.", please add a step:
"If the Document the element is in is not the active document of a browsing context, then the user agent must abort these steps at this point. The script is not executed."

Please also add a note saying that this means scripts in XHR responseXML, scripts in DOMParser-created documents, scripts in documents created by XSLTProcessor::transformToDocument and scripts that are first inserted by a script into a document that has been created with document.implementation.createDocument.

Note that what's being proposed here is 2 vs. 1 majority behavior for responseXML, DOMParser and XSLTProcessor::transformToDocument but 1 vs. 2 minority behavior for document.implementation.createDocument. (In the set Gecko, Presto, WebKit that is.)
Comment 1 Henri Sivonen 2010-10-20 10:46:42 UTC 
Demos in http://hsivonen.iki.fi/test/moz/scripts/
Comment 2 Ian 'Hixie' Hickson 2010-12-26 20:20:33 UTC 
IIRC the spec already says that scripts in documents without browsing contexts don't run, but that happens later (in the same place that tries to run event handler attributes, e.g.).
Comment 3 Henri Sivonen 2011-01-03 11:45:40 UTC 
(In reply to comment #2)
> IIRC the spec already says that scripts in documents without browsing contexts
> don't run, but that happens later (in the same place that tries to run event
> handler attributes, e.g.).

I tried to find this in the spec but failed. If this indeed is already in the spec, please add a note to the "run" algorithm highlighting this. Furthermore, I think external scripts should fail after their "already started" flag has been set but before a fetch is initiated if there's no browsing context.
Comment 4 Ian 'Hixie' Hickson 2011-02-08 21:27:46 UTC 
EDITOR'S RESPONSE: This is an Editor's Response to your comment. If you are satisfied with this response, please change the state of this bug to CLOSED. If you have additional information and would like the editor to reconsider, please reopen this bug. If you would like to escalate the issue to the full HTML Working Group, please add the TrackerRequest keyword to this bug, and suggest title and text for the tracker issue; or you may create a tracker issue yourself, if you are able to do so. For more details, see this document:
   http://dev.w3.org/html5/decision-policy/decision-policy.html

Status: Partially Accepted
Change Description: see diff given below
Rationale: 

I looked this up. "Scripting is disabled" if there is no browsing context, so the current normative requirements seem to exactly match the intent of the proposal in comment 0, and seems to match the sentiment in the last sentence of comment 3.

I've added a note.
Comment 5 contributor 2011-02-08 21:31:29 UTC 
Checked in as WHATWG revision r5856.
Check-in comment: Add a note about cases where scripts won't run. Also, update some references (unrelated to the bug below).
http://html5.org/tools/web-apps-tracker?from=5855&to=5856
Comment 6 Michael[tm] Smith 2011-08-04 05:15:27 UTC 
mass-move component to LC1