From 3bc328b234cc4cba2cc64ec64850dfa1d7c4d508 Mon Sep 17 00:00:00 2001
From: Ian Hickson <ian@hixie.ch>
Date: Tue, 12 Nov 2013 21:50:40 +0000
Subject: [PATCH] [giow] (3) Change iframe, frame, and object.contentDocument
 to return null when cross-origin documents are involved. Fixing
 https://www.w3.org/Bugs/Public/show_bug.cgi?id=23219 Affected topics: HTML

git-svn-id: http://svn.whatwg.org/webapps@8272 340c8d12-0b0e-0410-8428-c7bf67bfef74
---
 complete.html | 14 ++++++++++----
 index         | 14 ++++++++++----
 source        | 14 ++++++++++----
 3 files changed, 30 insertions(+), 12 deletions(-)

diff --git a/complete.html b/complete.html
index e501c29c448..9cf48d1ffee 100644
--- a/complete.html
+++ b/complete.html
@@ -23170,7 +23170,9 @@ <h4 id=the-iframe-element><span class=secno>4.7.2 </span>The <dfn><code>iframe</
 
   <p>The <dfn id=dom-iframe-contentdocument title=dom-iframe-contentDocument><code>contentDocument</code></dfn> IDL attribute
   must return the <code><a href=#document>Document</a></code> object of the <a href=#active-document>active document</a> of the
-  <code><a href=#the-iframe-element>iframe</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>, if any, or null otherwise.</p>
+  <code><a href=#the-iframe-element>iframe</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>, if any and if its
+  <a href=#effective-script-origin>effective script origin</a> is the <a href=#same-origin>same origin</a> as the <a href=#effective-script-origin>effective script
+  origin</a> specified by the <a href=#incumbent-settings-object>incumbent settings object</a>, or null otherwise.</p>
 
   <p>The <dfn id=dom-iframe-contentwindow title=dom-iframe-contentWindow><code>contentWindow</code></dfn> IDL attribute must
   return the <code><a href=#windowproxy>WindowProxy</a></code> object of the <code><a href=#the-iframe-element>iframe</a></code> element's <a href=#nested-browsing-context>nested
@@ -24141,8 +24143,9 @@ <h4 id=the-object-element><span class=secno>4.7.4 </span>The <dfn><code>object</
 
   <p>The <dfn id=dom-object-contentdocument title=dom-object-contentDocument><code>contentDocument</code></dfn> IDL attribute
   must return the <code><a href=#document>Document</a></code> object of the <a href=#active-document>active document</a> of the
-  <code><a href=#the-object-element>object</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>, if it has one; otherwise, it
-  must return null.</p>
+  <code><a href=#the-object-element>object</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>, if any and if its
+  <a href=#effective-script-origin>effective script origin</a> is the <a href=#same-origin>same origin</a> as the <a href=#effective-script-origin>effective script
+  origin</a> specified by the <a href=#incumbent-settings-object>incumbent settings object</a>, or null otherwise.</p>
 
   <p>The <dfn id=dom-object-contentwindow title=dom-object-contentWindow><code>contentWindow</code></dfn> IDL attribute must
   return the <code><a href=#windowproxy>WindowProxy</a></code> object of the <code><a href=#the-object-element>object</a></code> element's <a href=#nested-browsing-context>nested
@@ -96075,7 +96078,10 @@ <h4 id=frames><span class=secno>15.3.3 </span>Frames</h4>
 
   <p>The <dfn id=dom-frame-contentdocument title=dom-frame-contentDocument><code>contentDocument</code></dfn> IDL attribute of
   the <code><a href=#frame>frame</a></code> element must return the <code><a href=#document>Document</a></code> object of the <a href=#active-document>active
-  document</a> of the <code><a href=#frame>frame</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>.</p>
+  document</a> of the <code><a href=#frame>frame</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>, if any
+  and if its <a href=#effective-script-origin>effective script origin</a> is the <a href=#same-origin>same origin</a> as the
+  <a href=#effective-script-origin>effective script origin</a> specified by the <a href=#incumbent-settings-object>incumbent settings object</a>, or
+  null otherwise.</p>
 
   <p>The <dfn id=dom-frame-contentwindow title=dom-frame-contentWindow><code>contentWindow</code></dfn> IDL attribute must
   return the <code><a href=#windowproxy>WindowProxy</a></code> object of the <code><a href=#frame>frame</a></code> element's <a href=#nested-browsing-context>nested
diff --git a/index b/index
index e501c29c448..9cf48d1ffee 100644
--- a/index
+++ b/index
@@ -23170,7 +23170,9 @@ href="?audio"&gt;audio&lt;/a&gt; test instead.)&lt;/p&gt;</pre>
 
   <p>The <dfn id=dom-iframe-contentdocument title=dom-iframe-contentDocument><code>contentDocument</code></dfn> IDL attribute
   must return the <code><a href=#document>Document</a></code> object of the <a href=#active-document>active document</a> of the
-  <code><a href=#the-iframe-element>iframe</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>, if any, or null otherwise.</p>
+  <code><a href=#the-iframe-element>iframe</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>, if any and if its
+  <a href=#effective-script-origin>effective script origin</a> is the <a href=#same-origin>same origin</a> as the <a href=#effective-script-origin>effective script
+  origin</a> specified by the <a href=#incumbent-settings-object>incumbent settings object</a>, or null otherwise.</p>
 
   <p>The <dfn id=dom-iframe-contentwindow title=dom-iframe-contentWindow><code>contentWindow</code></dfn> IDL attribute must
   return the <code><a href=#windowproxy>WindowProxy</a></code> object of the <code><a href=#the-iframe-element>iframe</a></code> element's <a href=#nested-browsing-context>nested
@@ -24141,8 +24143,9 @@ href="?audio"&gt;audio&lt;/a&gt; test instead.)&lt;/p&gt;</pre>
 
   <p>The <dfn id=dom-object-contentdocument title=dom-object-contentDocument><code>contentDocument</code></dfn> IDL attribute
   must return the <code><a href=#document>Document</a></code> object of the <a href=#active-document>active document</a> of the
-  <code><a href=#the-object-element>object</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>, if it has one; otherwise, it
-  must return null.</p>
+  <code><a href=#the-object-element>object</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>, if any and if its
+  <a href=#effective-script-origin>effective script origin</a> is the <a href=#same-origin>same origin</a> as the <a href=#effective-script-origin>effective script
+  origin</a> specified by the <a href=#incumbent-settings-object>incumbent settings object</a>, or null otherwise.</p>
 
   <p>The <dfn id=dom-object-contentwindow title=dom-object-contentWindow><code>contentWindow</code></dfn> IDL attribute must
   return the <code><a href=#windowproxy>WindowProxy</a></code> object of the <code><a href=#the-object-element>object</a></code> element's <a href=#nested-browsing-context>nested
@@ -96075,7 +96078,10 @@ if (s = prompt('What is your name?')) {
 
   <p>The <dfn id=dom-frame-contentdocument title=dom-frame-contentDocument><code>contentDocument</code></dfn> IDL attribute of
   the <code><a href=#frame>frame</a></code> element must return the <code><a href=#document>Document</a></code> object of the <a href=#active-document>active
-  document</a> of the <code><a href=#frame>frame</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>.</p>
+  document</a> of the <code><a href=#frame>frame</a></code> element's <a href=#nested-browsing-context>nested browsing context</a>, if any
+  and if its <a href=#effective-script-origin>effective script origin</a> is the <a href=#same-origin>same origin</a> as the
+  <a href=#effective-script-origin>effective script origin</a> specified by the <a href=#incumbent-settings-object>incumbent settings object</a>, or
+  null otherwise.</p>
 
   <p>The <dfn id=dom-frame-contentwindow title=dom-frame-contentWindow><code>contentWindow</code></dfn> IDL attribute must
   return the <code><a href=#windowproxy>WindowProxy</a></code> object of the <code><a href=#frame>frame</a></code> element's <a href=#nested-browsing-context>nested
diff --git a/source b/source
index 1be8beed418..5f5d52cd6f7 100644
--- a/source
+++ b/source
@@ -24389,7 +24389,9 @@ href="?audio">audio&lt;/a> test instead.)&lt;/p></pre>
 
   <p>The <dfn data-x="dom-iframe-contentDocument"><code>contentDocument</code></dfn> IDL attribute
   must return the <code>Document</code> object of the <span>active document</span> of the
-  <code>iframe</code> element's <span>nested browsing context</span>, if any, or null otherwise.</p>
+  <code>iframe</code> element's <span>nested browsing context</span>, if any and if its
+  <span>effective script origin</span> is the <span>same origin</span> as the <span>effective script
+  origin</span> specified by the <span>incumbent settings object</span>, or null otherwise.</p>
 
   <p>The <dfn data-x="dom-iframe-contentWindow"><code>contentWindow</code></dfn> IDL attribute must
   return the <code>WindowProxy</code> object of the <code>iframe</code> element's <span>nested
@@ -25468,8 +25470,9 @@ href="?audio">audio&lt;/a> test instead.)&lt;/p></pre>
 
   <p>The <dfn data-x="dom-object-contentDocument"><code>contentDocument</code></dfn> IDL attribute
   must return the <code>Document</code> object of the <span>active document</span> of the
-  <code>object</code> element's <span>nested browsing context</span>, if it has one; otherwise, it
-  must return null.</p>
+  <code>object</code> element's <span>nested browsing context</span>, if any and if its
+  <span>effective script origin</span> is the <span>same origin</span> as the <span>effective script
+  origin</span> specified by the <span>incumbent settings object</span>, or null otherwise.</p>
 
   <p>The <dfn data-x="dom-object-contentWindow"><code>contentWindow</code></dfn> IDL attribute must
   return the <code>WindowProxy</code> object of the <code>object</code> element's <span>nested
@@ -106867,7 +106870,10 @@ if (s = prompt('What is your name?')) {
 
   <p>The <dfn data-x="dom-frame-contentDocument"><code>contentDocument</code></dfn> IDL attribute of
   the <code>frame</code> element must return the <code>Document</code> object of the <span>active
-  document</span> of the <code>frame</code> element's <span>nested browsing context</span>.</p>
+  document</span> of the <code>frame</code> element's <span>nested browsing context</span>, if any
+  and if its <span>effective script origin</span> is the <span>same origin</span> as the
+  <span>effective script origin</span> specified by the <span>incumbent settings object</span>, or
+  null otherwise.</p>
 
   <p>The <dfn data-x="dom-frame-contentWindow"><code>contentWindow</code></dfn> IDL attribute must
   return the <code>WindowProxy</code> object of the <code>frame</code> element's <span>nested