commit | 1d2509fc2ebc7c9848726c1b208483e1e1efc485 | [log] [tgz] |
---|---|---|
author | Yuki Yamada <yukiy@google.com> | Fri Oct 12 09:45:43 2018 |
committer | Commit Bot <commit-bot@chromium.org> | Fri Oct 12 09:45:43 2018 |
tree | f6141b1f9114c8d4549ea6eba16aacdc3e3257ad | |
parent | fe100b299e7bc889ccafc03cf8854efe64020679 [diff] |
Added security check for cross origin This CL adds a security check for cross origin with BindingSecurity::ShouldAllowAccessToCreationContext(). |js_event|, a V8 wrapper object for event object, must be created in the relevant realm of the event target, but it is possible that listener's relevant context cannnot access the relevant realm of event target (ex. when Document.origin is changed). We have to check this before invoking event listener. Bug: 872138, 884516 Change-Id: Ic5d0c8e6cda4db57a2097ce230e75cc59905b350 Reviewed-on: https://chromium-review.googlesource.com/c/1270300 Commit-Queue: Yuki Yamada <yukiy@google.com> Reviewed-by: Kentaro Hara <haraken@chromium.org> Reviewed-by: Hitoshi Yoshida <peria@chromium.org> Reviewed-by: Yuki Shiino <yukishiino@chromium.org> Cr-Commit-Position: refs/heads/master@{#599154}
Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web.
The project's web site is https://www.chromium.org.
Documentation in the source is rooted in docs/README.md.
Learn how to Get Around the Chromium Source Code Directory Structure .