Don't copy the security origin when creating a document

Don't copy the security origin when creating a document

The spec doesn't say we'd need to do this.

BUG=605203
R=dcheng@chromium.org

Committed: https://crrev.com/bf4336081aeccae3fd46a747fb6cbfeb291e11d1
Cr-Commit-Position: refs/heads/master@{#388754}

[jochen (gone - plz use gerrit), 2016-04-21 11:24:59]

jochen@chromium.org changed reviewers:
+ esprehn@chromium.org, philipj@opera.com

[jochen (gone - plz use gerrit), 2016-04-21 11:24:59]

ptal

This was originally changed to match IE, however, FF and the whatwg spec both
don't copy but share the origin.

[philipj_slow, 2016-04-21 11:40:31]

What are the implications of this? Did the "isolated copy" make some things
cross-origin which now no longer will be?

[jochen (gone - plz use gerrit), 2016-04-21 11:50:25]

On 2016/04/21 at 11:40:31, philipj wrote:
> What are the implications of this? Did the "isolated copy" make some things
cross-origin which now no longer will be?

Well, only when using document.domain.

The actual problem (see bug) is that the change to make document.open require
stuff to be same origin breaks creating a document via createHTMLDocument from a
unique origin (because the isolated copy of a unique origin cannot access
another unique origin), see the referenced bug.

[jochen (gone - plz use gerrit), 2016-04-21 11:57:28]

added corresponding test.

[philipj_slow, 2016-04-21 12:23:56]

Ah, fallout from https://codereview.chromium.org/1611523002 where I also wasn't
sure of the implications :)

LGTM, the does says just "document’s origin is the origin of the context
object’s associated document" and I can't think of a reason why this should
break things.

https://codereview.chromium.org/1911493004/diff/40001/third_party/WebKit/Layo...
File
third_party/WebKit/LayoutTests/http/tests/security/create-document-unique-origin.html
(right):

https://codereview.chromium.org/1911493004/diff/40001/third_party/WebKit/Layo...
third_party/WebKit/LayoutTests/http/tests/security/create-document-unique-origin.html:6:
<iframe sandbox='allow-scripts' srcdoc='<script>var d =
document.implementation.createHTMLDocument("");d.open();console.log("SUCCESS");</script>'></iframe>
Also test createDocument? Could be done in the same test I suppose.

[jochen (gone - plz use gerrit), 2016-04-21 12:47:06]

On 2016/04/21 at 12:23:56, philipj wrote:
> Ah, fallout from https://codereview.chromium.org/1611523002 where I also
wasn't sure of the implications :)
> 
> LGTM, the does says just "document’s origin is the origin of the context
object’s associated document" and I can't think of a reason why this should
break things.
> 
>
https://codereview.chromium.org/1911493004/diff/40001/third_party/WebKit/Layo...
> File
third_party/WebKit/LayoutTests/http/tests/security/create-document-unique-origin.html
(right):
> 
>
https://codereview.chromium.org/1911493004/diff/40001/third_party/WebKit/Layo...
>
third_party/WebKit/LayoutTests/http/tests/security/create-document-unique-origin.html:6:
<iframe sandbox='allow-scripts' srcdoc='<script>var d =
document.implementation.createHTMLDocument("");d.open();console.log("SUCCESS");</script>'></iframe>
> Also test createDocument? Could be done in the same test I suppose.

i can't document.open() an xml doc. not sure how to otherwise check the
condition

[philipj_slow, 2016-04-21 12:48:47]

On 2016/04/21 12:47:06, jochen wrote:
> On 2016/04/21 at 12:23:56, philipj wrote:
> > Ah, fallout from https://codereview.chromium.org/1611523002 where I also
> wasn't sure of the implications :)
> > 
> > LGTM, the does says just "document’s origin is the origin of the context
> object’s associated document" and I can't think of a reason why this should
> break things.
> > 
> >
>
https://codereview.chromium.org/1911493004/diff/40001/third_party/WebKit/Layo...
> > File
>
third_party/WebKit/LayoutTests/http/tests/security/create-document-unique-origin.html
> (right):
> > 
> >
>
https://codereview.chromium.org/1911493004/diff/40001/third_party/WebKit/Layo...
> >
>
third_party/WebKit/LayoutTests/http/tests/security/create-document-unique-origin.html:6:
> <iframe sandbox='allow-scripts' srcdoc='<script>var d =
>
document.implementation.createHTMLDocument("");d.open();console.log("SUCCESS");</script>'></iframe>
> > Also test createDocument? Could be done in the same test I suppose.
> 
> i can't document.open() an xml doc. not sure how to otherwise check the
> condition

Ah, right, never mind then.

[jochen (gone - plz use gerrit), 2016-04-21 12:49:26]

The CQ bit was checked by jochen@chromium.org

[commit-bot: I haz the power, 2016-04-21 12:49:32]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1911493004/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1911493004/40001

[commit-bot: I haz the power, 2016-04-21 13:07:03]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-04-22 19:34:04]

Description was changed from

==========
Don't copy the security origin when creating a document

The spec doesn't say we'd need to do this.

BUG=605203
R=dcheng@chromium.org
==========

to

==========
Don't copy the security origin when creating a document

The spec doesn't say we'd need to do this.

BUG=605203
R=dcheng@chromium.org

Committed: https://crrev.com/bf4336081aeccae3fd46a747fb6cbfeb291e11d1
Cr-Commit-Position: refs/heads/master@{#388754}
==========

[commit-bot: I haz the power, 2016-04-22 19:34:05]

Patchset 3 (id:??) landed as
https://crrev.com/bf4336081aeccae3fd46a747fb6cbfeb291e11d1
Cr-Commit-Position: refs/heads/master@{#388754}