Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(104)

Unified Diff: third_party/WebKit/Source/bindings/core/v8/BindingSecurity.h

Issue 2706923002: Rework security checks to be based on Window rather than Frame. (Closed)
Patch Set: Do not hardcode V8Window::wrapperTypeInfo Created 3 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/WebKit/Source/bindings/core/v8/BindingSecurity.h
diff --git a/third_party/WebKit/Source/bindings/core/v8/BindingSecurity.h b/third_party/WebKit/Source/bindings/core/v8/BindingSecurity.h
index 92d907c22075a9aa506c2494147a4d1507ef90b8..ca383ffb33f9bf356e72e0ceb67d561a8b67344d 100644
--- a/third_party/WebKit/Source/bindings/core/v8/BindingSecurity.h
+++ b/third_party/WebKit/Source/bindings/core/v8/BindingSecurity.h
@@ -38,7 +38,6 @@
namespace blink {
class DOMWindow;
-class EventTarget;
class ExceptionState;
class Frame;
class LocalDOMWindow;
@@ -59,10 +58,8 @@ class CORE_EXPORT BindingSecurity {
// receiver object (|target|), where the receiver object is the JS object
// for which the DOM attribute or DOM operation is being invoked (in the
// form of receiver.domAttr or receiver.domOp()).
- // Note that only Window and Location objects are cross-origin accessible
- // and that EventTarget interface is the parent interface of Window
- // interface. So the receiver object must be of type DOMWindow,
- // EventTarget, or Location.
+ // Note that only Window and Location objects are cross-origin accessible, so
+ // the receiver object must be of type DOMWindow or Location.
//
// DOMWindow
static bool ShouldAllowAccessTo(const LocalDOMWindow* accessing_window,
@@ -71,11 +68,7 @@ class CORE_EXPORT BindingSecurity {
static bool ShouldAllowAccessTo(const LocalDOMWindow* accessing_window,
const DOMWindow* target,
ErrorReportOption);
- // EventTarget (as the parent of DOMWindow)
- static bool ShouldAllowAccessTo(
- const LocalDOMWindow* accessing_window,
- const EventTarget* target,
- ExceptionState&); // NOLINT(readability/parameter_name)
+
// Location
static bool ShouldAllowAccessTo(const LocalDOMWindow* accessing_window,
const Location* target,
@@ -111,13 +104,10 @@ class CORE_EXPORT BindingSecurity {
static bool ShouldAllowAccessToFrame(const LocalDOMWindow* accessing_window,
const Frame* target,
ErrorReportOption);
- // This overload must be used only for detached windows.
- static bool ShouldAllowAccessToDetachedWindow(
- const LocalDOMWindow* accessing_window,
- const DOMWindow* target,
- ExceptionState&);
- static void FailedAccessCheckFor(v8::Isolate*, const Frame* target);
+ static void FailedAccessCheckFor(v8::Isolate*,
+ const WrapperTypeInfo*,
+ v8::Local<v8::Object> holder);
// The following two functions were written to be called by
// V8WrapperInstantiationScope before entering and after exiting an object's

Powered by Google App Engine
This is Rietveld 408576698