Mark S. Miller wrote:
On Sun, Feb 19, 2012 at 11:49 AM, Brendan Eich <[email protected]
<mailto:[email protected]>> wrote:
[...]
Not all engines mediate cross-same-origin-window accesses. I hear
IE9+ may, indeed rumor is it remotes to another process sometimes
(breaking run-to-completion a bit; something we should explore
breaking in the future for window=vat). SpiderMonkey just recently
(not sure if this is in a Firefox channel yet) went to compartment
per global, for good savings once things were refactored to
maximize sharing of internal immutables.
Other than the origin truncation issue that I am still confused about,
Do you mean document.domain setting? That allows code in an origin to
join its origin's super-domain (but not a dotless top level). See
http://www.w3.org/TR/2009/WD-html5-20090212/browsers.html#dom-document-domain
and
http://www.w3.org/TR/2009/WD-html5-20090212/browsers.html#effective-script-origin
what other benefits are there to mediating interframe access within
the same origin?
The WindowProxy in HTML5 reflects a de-facto standard developed by
browser implementors to avoid
closure-survives-navigation-to-other-origin attacks. See
http://www.w3.org/TR/html5/browsers.html#the-windowproxy-object
Demons from the First Age included attacks that loaded a document
containing a script defining a closure from evil.org into a subframe,
then stuck a ref to the closure in the super-frame, then navigated the
sub-frame to victim.com. Guess whose scope the closure saw, with only
Window objects and no WindowProxy wrappers for the named (not implicit
in identifier resolution) window/frame objects?
My R2 resolution is not specific to any engine, but I have hopes
it can be accepted. It is concrete enough to help overcome
large-yet-vague doubts about implementation impact (at least
IMHO). Recall that document.domain setting may have to split a
merged same-origin window/frame graph, at any time. Again
implementation solutions vary, but this suggests cross-window
mediation can be interposed lazily.
How? By doing a full walk of the object graph and doing surgery on it?
This sounds more painful than imposing mediation up front.
No, by indirection, of course ;-). The details vary among browsers.
But I'm still hoping that objects same origin iframes can communicate
directly, without mediation.
Why? Anyway, it's unsafe, wherefore WindowProxy. No big deal. There's no
mediation for identifier resolution (i.e., scope chain lookup) and
indeed JITting VMs optimize the heck out of local global accesses already.
/be
_______________________________________________
es-discuss mailing list
[email protected]
https://mail.mozilla.org/listinfo/es-discuss
