<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"

"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />

<title>[205136] trunk</title>

</head>

<body>

<style type="text/css"><!--

#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }

#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }

#msg dt:after { content:':';}

#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }

#msg dl a { font-weight: bold}

#msg dl a:link    { color:#fc3; }

#msg dl a:active  { color:#ff0; }

#msg dl a:visited { color:#cc6; }

h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }

#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }

#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }

#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }

#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }

#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }

#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }

#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }

#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }

#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }

#logmsg pre { background: #eee; padding: 1em; }

#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}

#logmsg dl { margin: 0; }

#logmsg dt { font-weight: bold; }

#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }

#logmsg dd:before { content:'\00bb';}

#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }

#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }

#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }

#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }

#logmsg table th.Corner { text-align: left; }

#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }

#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }

#patch { width: 100%; }

#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}

#patch .propset h4, #patch .binary h4 {margin:0;}

#patch pre {padding:0;line-height:1.2em;margin:0;}

#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}

#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}

#patch span {display:block;padding:0 10px;}

#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}

#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}

#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}

#patch .lines, .info {color:#888;background:#fff;}

--></style>

<div id="msg">

<dl class="meta">

<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/205136">205136</a></dd>

<dt>Author</dt> <dd>cdumez@apple.com</dd>

<dt>Date</dt> <dd>2016-08-29 12:37:01 -0700 (Mon, 29 Aug 2016)</dd>

</dl>

<h3>Log Message</h3>

<pre>We should throw a SecurityError when denying access to cross-origin Window properties

https://bugs.webkit.org/show_bug.cgi?id=161316

Reviewed by Darin Adler.

LayoutTests/imported/w3c:

Rebaseline existing tests to reflect behavior change.

* web-platform-tests/domparsing/innerhtml-05-expected.txt:

* web-platform-tests/html/semantics/forms/form-submission-0/getactionurl-expected.txt:

Source/WebCore:

We should throw a SecurityError when denying access to cross-origin Window properties:

- https://html.spec.whatwg.org/#crossorigingetownpropertyhelper-(-o,-p-)

- https://html.spec.whatwg.org/#crossoriginproperties-(-o-)

Firefox and Chrome already throw.

No new tests, updated existing tests.

* bindings/js/JSDOMWindowCustom.cpp:

(WebCore::jsDOMWindowGetOwnPropertySlotRestrictedAccess):

LayoutTests:

Update / rebaselined existing tests to reflect behavior change.

* fast/frames/sandboxed-iframe-history-denied-expected.txt:

* fast/xmlhttprequest/xmlhttprequest-no-file-access-expected.txt:

* fast/xmlhttprequest/xmlhttprequest-no-file-access.html:

* http/tests/dom/window-open-about-webkit-org-and-access-document-expected.txt:

* http/tests/dom/window-open-about-webkit-org-and-access-document.html:

* http/tests/history/cross-origin-replace-history-object-child-expected.txt:

* http/tests/history/cross-origin-replace-history-object-child.html:

* http/tests/plugins/cross-frame-object-access-expected.txt:

* http/tests/security/aboutBlank/xss-DENIED-navigate-opener-document-write-expected.txt:

* http/tests/security/aboutBlank/xss-DENIED-navigate-opener-javascript-url-expected.txt:

* http/tests/security/aboutBlank/xss-DENIED-set-opener-expected.txt:

* http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-expected.txt:

* http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html:

* http/tests/security/cross-frame-access-call-expected.txt:

* http/tests/security/cross-frame-access-call.html:

* http/tests/security/cross-frame-access-child-explicit-domain-expected.txt:

* http/tests/security/cross-frame-access-custom-expected.txt:

* http/tests/security/cross-frame-access-first-time-expected.txt:

* http/tests/security/cross-frame-access-first-time.html:

* http/tests/security/cross-frame-access-get-custom-property-cached-expected.txt:

* http/tests/security/cross-frame-access-get-custom-property-cached.html:

* http/tests/security/cross-frame-access-get-expected.txt:

* http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt:

* http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html:

* http/tests/security/cross-frame-access-history-get-expected.txt:

* http/tests/security/cross-frame-access-history-get-override-expected.txt:

* http/tests/security/cross-frame-access-history-prototype-expected.txt:

* http/tests/security/cross-frame-access-name-getter-expected.txt:

* http/tests/security/cross-frame-access-object-getPrototypeOf-expected.txt:

* http/tests/security/cross-frame-access-object-getPrototypeOf.html:

* http/tests/security/cross-frame-access-object-prototype-expected.txt:

* http/tests/security/cross-frame-access-object-prototype.html:

* http/tests/security/cross-frame-access-parent-explicit-domain-expected.txt:

* http/tests/security/cross-frame-access-port-expected.txt:

* http/tests/security/cross-frame-access-protocol-expected.txt:

* http/tests/security/cross-frame-access-protocol-explicit-domain-expected.txt:

* http/tests/security/cross-frame-access-selection-expected.txt:

* http/tests/security/cross-frame-access-selection.html:

* http/tests/security/cross-origin-reified-window-property-access-expected.txt:

* http/tests/security/cross-origin-window-property-access-expected.txt:

* http/tests/security/dataURL/resources/foreign-domain-data-url-accessor-iframe.html:

* http/tests/security/dataURL/resources/foreign-domain-data-url-accessor-opened-frame.html:

* http/tests/security/dataURL/xss-DENIED-from-data-url-in-foreign-domain-subframe-expected.txt:

* http/tests/security/dataURL/xss-DENIED-from-data-url-in-foreign-domain-window-open-expected.txt:

* http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-2-level-expected.txt:

* http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-2-level.html:

* http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-expected.txt:

* http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-to-data-url-sub-frame-expected.txt:

* http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-to-data-url-sub-frame.html:

* http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame.html:

* http/tests/security/dataURL/xss-DENIED-from-data-url-to-data-url-expected.txt:

* http/tests/security/dataURL/xss-DENIED-from-data-url-to-data-url.html:

* http/tests/security/dataURL/xss-DENIED-from-javascript-url-window-open-expected.txt:

* http/tests/security/dataURL/xss-DENIED-from-javascript-url-window-open.html:

* http/tests/security/dataURL/xss-DENIED-to-data-url-from-data-url-expected.txt:

* http/tests/security/dataURL/xss-DENIED-to-data-url-from-data-url.html:

* http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe-expected.txt:

* http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe-location-change-expected.txt:

* http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe-location-change.html:

* http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe.html:

* http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-window-open-expected.txt:

* http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-window-open.html:

* http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-2-level-expected.txt:

* http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-2-level.html:

* http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-expected.txt:

* http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-uppercase-expected.txt:

* http/tests/security/dataURL/xss-DENIED-to-data-url-window-open-expected.txt:

* http/tests/security/dataURL/xss-DENIED-to-data-url-window-open.html:

* http/tests/security/document-all-expected.txt:

* http/tests/security/document-all.html:

* http/tests/security/javascriptURL/resources/foreign-domain-javascript-url-accessor-iframe.html:

* http/tests/security/javascriptURL/resources/foreign-domain-javascript-url-accessor-opened-frame.html:

* http/tests/security/javascriptURL/xss-DENIED-from-javascript-url-in-foreign-domain-subframe-expected.txt:

* http/tests/security/javascriptURL/xss-DENIED-from-javascript-url-in-foreign-domain-window-open-expected.txt:

* http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-subframe-expected.txt:

* http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-subframe.html:

* http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-window-open-expected.txt:

* http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-window-open.html:

* http/tests/security/listener/resources/targetChild-JSTargetNode-onclick-addEventListener.html:

* http/tests/security/listener/resources/targetChild-JSTargetNode-onclick-shortcut.html:

* http/tests/security/listener/resources/targetChild-XMLHttpRequest-addEventListener.html:

* http/tests/security/listener/resources/targetChild-XMLHttpRequest-shortcut.html:

* http/tests/security/listener/resources/targetChild-window-onclick-addEventListener.html:

* http/tests/security/listener/resources/targetChild-window-onclick-shortcut.html:

* http/tests/security/listener/xss-JSTargetNode-onclick-addEventListener-expected.txt:

* http/tests/security/listener/xss-JSTargetNode-onclick-shortcut-expected.txt:

* http/tests/security/listener/xss-XMLHttpRequest-addEventListener-expected.txt:

* http/tests/security/listener/xss-XMLHttpRequest-shortcut-expected.txt:

* http/tests/security/listener/xss-window-onclick-addEventListener-expected.txt:

* http/tests/security/listener/xss-window-onclick-shortcut-expected.txt:

* http/tests/security/resources/cross-frame-access.js:

(test):

(cannotAccessFrame):

* http/tests/security/resources/cross-frame-history-prototype-iframe.html:

* http/tests/security/resources/iframe-for-synchronous-form.html:

* http/tests/security/resources/sandboxed-iframe-origin-add-step1.html:

* http/tests/security/resources/sandboxed-iframe-origin-remove-step2.html:

* http/tests/security/sandboxed-iframe-modify-self-expected.txt:

* http/tests/security/sandboxed-iframe-origin-add-expected.txt:

* http/tests/security/sandboxed-iframe-origin-remove-expected.txt:

* http/tests/security/srcdoc-in-sandbox-cannot-access-parent-expected.txt:

* http/tests/security/xss-DENIED-defineProperty-expected.txt:

* http/tests/security/xss-DENIED-frame-name-expected.txt:

* http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto-expected.txt:

* http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto.html:

* http/tests/security/xss-DENIED-invalid-domain-change-expected.txt:

* http/tests/security/xss-DENIED-invalid-domain-change.html:

* http/tests/security/xss-DENIED-method-with-iframe-proto-expected.txt:

* http/tests/security/xss-DENIED-sandboxed-iframe-expected.txt:

* http/tests/security/xss-DENIED-synchronous-form-expected.txt:

* http/tests/security/xss-DENIED-window-name-navigator-expected.txt:

* http/tests/security/xss-DENIED-xsl-document-securityOrigin-expected.txt:

* http/tests/security/xss-DENIED-xsl-document-securityOrigin.xml:

* http/tests/security/xss-eval-expected.txt:

* http/tests/security/xss-eval.html:</pre>

<h3>Modified Paths</h3>

<ul>

<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>

<li><a href="#trunkLayoutTestsfastframessandboxediframehistorydeniedexpectedtxt">trunk/LayoutTests/fast/frames/sandboxed-iframe-history-denied-expected.txt</a></li>

<li><a href="#trunkLayoutTestsfastxmlhttprequestxmlhttprequestnofileaccessexpectedtxt">trunk/LayoutTests/fast/xmlhttprequest/xmlhttprequest-no-file-access-expected.txt</a></li>

<li><a href="#trunkLayoutTestsfastxmlhttprequestxmlhttprequestnofileaccesshtml">trunk/LayoutTests/fast/xmlhttprequest/xmlhttprequest-no-file-access.html</a></li>

<li><a href="#trunkLayoutTestshttptestsdomwindowopenaboutwebkitorgandaccessdocumentexpectedtxt">trunk/LayoutTests/http/tests/dom/window-open-about-webkit-org-and-access-document-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestsdomwindowopenaboutwebkitorgandaccessdocumenthtml">trunk/LayoutTests/http/tests/dom/window-open-about-webkit-org-and-access-document.html</a></li>

<li><a href="#trunkLayoutTestshttptestshistorycrossoriginreplacehistoryobjectchildexpectedtxt">trunk/LayoutTests/http/tests/history/cross-origin-replace-history-object-child-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestshistorycrossoriginreplacehistoryobjectchildhtml">trunk/LayoutTests/http/tests/history/cross-origin-replace-history-object-child.html</a></li>

<li><a href="#trunkLayoutTestshttptestspluginscrossframeobjectaccessexpectedtxt">trunk/LayoutTests/http/tests/plugins/cross-frame-object-access-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityaboutBlankxssDENIEDnavigateopenerdocumentwriteexpectedtxt">trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-document-write-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityaboutBlankxssDENIEDnavigateopenerjavascripturlexpectedtxt">trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-javascript-url-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityaboutBlankxssDENIEDsetopenerexpectedtxt">trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-set-opener-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycontentSecurityPolicysandboxallowscriptsinhttpheaderexpectedtxt">trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycontentSecurityPolicysandboxallowscriptsinhttpheaderhtml">trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccesscallexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-call-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccesscallhtml">trunk/LayoutTests/http/tests/security/cross-frame-access-call.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccesschildexplicitdomainexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-child-explicit-domain-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccesscustomexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-custom-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessfirsttimeexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-first-time-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessfirsttimehtml">trunk/LayoutTests/http/tests/security/cross-frame-access-first-time.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessgetcustompropertycachedexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-get-custom-property-cached-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessgetcustompropertycachedhtml">trunk/LayoutTests/http/tests/security/cross-frame-access-get-custom-property-cached.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessgetexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-get-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessgetOwnPropertyDescriptorexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessgetOwnPropertyDescriptorhtml">trunk/LayoutTests/http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccesshistorygetexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-history-get-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccesshistorygetoverrideexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-history-get-override-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccesshistoryprototypeexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-history-prototype-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessnamegetterexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-name-getter-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessobjectgetPrototypeOfexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-object-getPrototypeOf-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessobjectgetPrototypeOfhtml">trunk/LayoutTests/http/tests/security/cross-frame-access-object-getPrototypeOf.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessobjectprototypeexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-object-prototype-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessobjectprototypehtml">trunk/LayoutTests/http/tests/security/cross-frame-access-object-prototype.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessparentexplicitdomainexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-parent-explicit-domain-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessportexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-port-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessprotocolexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-protocol-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessprotocolexplicitdomainexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-protocol-explicit-domain-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessselectionexpectedtxt">trunk/LayoutTests/http/tests/security/cross-frame-access-selection-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossframeaccessselectionhtml">trunk/LayoutTests/http/tests/security/cross-frame-access-selection.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossoriginreifiedwindowpropertyaccessexpectedtxt">trunk/LayoutTests/http/tests/security/cross-origin-reified-window-property-access-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritycrossoriginwindowpropertyaccessexpectedtxt">trunk/LayoutTests/http/tests/security/cross-origin-window-property-access-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLresourcesforeigndomaindataurlaccessoriframehtml">trunk/LayoutTests/http/tests/security/dataURL/resources/foreign-domain-data-url-accessor-iframe.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLresourcesforeigndomaindataurlaccessoropenedframehtml">trunk/LayoutTests/http/tests/security/dataURL/resources/foreign-domain-data-url-accessor-opened-frame.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDfromdataurlinforeigndomainsubframeexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-in-foreign-domain-subframe-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDfromdataurlinforeigndomainwindowopenexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-in-foreign-domain-window-open-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDfromdataurlsubframe2levelexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-2-level-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDfromdataurlsubframe2levelhtml">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-2-level.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDfromdataurlsubframeexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDfromdataurlsubframetodataurlsubframeexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-to-data-url-sub-frame-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDfromdataurlsubframetodataurlsubframehtml">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-to-data-url-sub-frame.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDfromdataurlsubframehtml">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDfromdataurltodataurlexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-to-data-url-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDfromdataurltodataurlhtml">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-data-url-to-data-url.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDfromjavascripturlwindowopenexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-javascript-url-window-open-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDfromjavascripturlwindowopenhtml">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-from-javascript-url-window-open.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlfromdataurlexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-from-data-url-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlfromdataurlhtml">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-from-data-url.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlinforeigndomainsubframeexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlinforeigndomainsubframelocationchangeexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe-location-change-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlinforeigndomainsubframelocationchangehtml">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe-location-change.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlinforeigndomainsubframehtml">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlinforeigndomainwindowopenexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-window-open-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlinforeigndomainwindowopenhtml">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-window-open.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlsubframe2levelexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-2-level-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlsubframe2levelhtml">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-2-level.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlsubframeexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlsubframeuppercaseexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-uppercase-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlwindowopenexpectedtxt">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-window-open-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydataURLxssDENIEDtodataurlwindowopenhtml">trunk/LayoutTests/http/tests/security/dataURL/xss-DENIED-to-data-url-window-open.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydocumentallexpectedtxt">trunk/LayoutTests/http/tests/security/document-all-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritydocumentallhtml">trunk/LayoutTests/http/tests/security/document-all.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityjavascriptURLresourcesforeigndomainjavascripturlaccessoriframehtml">trunk/LayoutTests/http/tests/security/javascriptURL/resources/foreign-domain-javascript-url-accessor-iframe.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityjavascriptURLresourcesforeigndomainjavascripturlaccessoropenedframehtml">trunk/LayoutTests/http/tests/security/javascriptURL/resources/foreign-domain-javascript-url-accessor-opened-frame.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityjavascriptURLxssDENIEDfromjavascripturlinforeigndomainsubframeexpectedtxt">trunk/LayoutTests/http/tests/security/javascriptURL/xss-DENIED-from-javascript-url-in-foreign-domain-subframe-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityjavascriptURLxssDENIEDfromjavascripturlinforeigndomainwindowopenexpectedtxt">trunk/LayoutTests/http/tests/security/javascriptURL/xss-DENIED-from-javascript-url-in-foreign-domain-window-open-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityjavascriptURLxssDENIEDtojavascripturlinforeigndomainsubframeexpectedtxt">trunk/LayoutTests/http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-subframe-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityjavascriptURLxssDENIEDtojavascripturlinforeigndomainsubframehtml">trunk/LayoutTests/http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-subframe.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityjavascriptURLxssDENIEDtojavascripturlinforeigndomainwindowopenexpectedtxt">trunk/LayoutTests/http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-window-open-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityjavascriptURLxssDENIEDtojavascripturlinforeigndomainwindowopenhtml">trunk/LayoutTests/http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-window-open.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritylistenerresourcestargetChildJSTargetNodeonclickaddEventListenerhtml">trunk/LayoutTests/http/tests/security/listener/resources/targetChild-JSTargetNode-onclick-addEventListener.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritylistenerresourcestargetChildJSTargetNodeonclickshortcuthtml">trunk/LayoutTests/http/tests/security/listener/resources/targetChild-JSTargetNode-onclick-shortcut.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritylistenerresourcestargetChildXMLHttpRequestaddEventListenerhtml">trunk/LayoutTests/http/tests/security/listener/resources/targetChild-XMLHttpRequest-addEventListener.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritylistenerresourcestargetChildXMLHttpRequestshortcuthtml">trunk/LayoutTests/http/tests/security/listener/resources/targetChild-XMLHttpRequest-shortcut.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritylistenerresourcestargetChildwindowonclickaddEventListenerhtml">trunk/LayoutTests/http/tests/security/listener/resources/targetChild-window-onclick-addEventListener.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritylistenerresourcestargetChildwindowonclickshortcuthtml">trunk/LayoutTests/http/tests/security/listener/resources/targetChild-window-onclick-shortcut.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritylistenerxssJSTargetNodeonclickaddEventListenerexpectedtxt">trunk/LayoutTests/http/tests/security/listener/xss-JSTargetNode-onclick-addEventListener-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritylistenerxssJSTargetNodeonclickshortcutexpectedtxt">trunk/LayoutTests/http/tests/security/listener/xss-JSTargetNode-onclick-shortcut-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritylistenerxssXMLHttpRequestaddEventListenerexpectedtxt">trunk/LayoutTests/http/tests/security/listener/xss-XMLHttpRequest-addEventListener-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritylistenerxssXMLHttpRequestshortcutexpectedtxt">trunk/LayoutTests/http/tests/security/listener/xss-XMLHttpRequest-shortcut-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritylistenerxsswindowonclickaddEventListenerexpectedtxt">trunk/LayoutTests/http/tests/security/listener/xss-window-onclick-addEventListener-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritylistenerxsswindowonclickshortcutexpectedtxt">trunk/LayoutTests/http/tests/security/listener/xss-window-onclick-shortcut-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityresourcescrossframeaccessjs">trunk/LayoutTests/http/tests/security/resources/cross-frame-access.js</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityresourcescrossframehistoryprototypeiframehtml">trunk/LayoutTests/http/tests/security/resources/cross-frame-history-prototype-iframe.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityresourcesiframeforsynchronousformhtml">trunk/LayoutTests/http/tests/security/resources/iframe-for-synchronous-form.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityresourcessandboxediframeoriginaddstep1html">trunk/LayoutTests/http/tests/security/resources/sandboxed-iframe-origin-add-step1.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityresourcessandboxediframeoriginremovestep2html">trunk/LayoutTests/http/tests/security/resources/sandboxed-iframe-origin-remove-step2.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritysandboxediframemodifyselfexpectedtxt">trunk/LayoutTests/http/tests/security/sandboxed-iframe-modify-self-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritysandboxediframeoriginaddexpectedtxt">trunk/LayoutTests/http/tests/security/sandboxed-iframe-origin-add-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritysandboxediframeoriginremoveexpectedtxt">trunk/LayoutTests/http/tests/security/sandboxed-iframe-origin-remove-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecuritysrcdocinsandboxcannotaccessparentexpectedtxt">trunk/LayoutTests/http/tests/security/srcdoc-in-sandbox-cannot-access-parent-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDdefinePropertyexpectedtxt">trunk/LayoutTests/http/tests/security/xss-DENIED-defineProperty-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDframenameexpectedtxt">trunk/LayoutTests/http/tests/security/xss-DENIED-frame-name-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDhtmlelelmentwithiframeprotoexpectedtxt">trunk/LayoutTests/http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDhtmlelelmentwithiframeprotohtml">trunk/LayoutTests/http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDinvaliddomainchangeexpectedtxt">trunk/LayoutTests/http/tests/security/xss-DENIED-invalid-domain-change-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDinvaliddomainchangehtml">trunk/LayoutTests/http/tests/security/xss-DENIED-invalid-domain-change.html</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDmethodwithiframeprotoexpectedtxt">trunk/LayoutTests/http/tests/security/xss-DENIED-method-with-iframe-proto-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDsandboxediframeexpectedtxt">trunk/LayoutTests/http/tests/security/xss-DENIED-sandboxed-iframe-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDsynchronousformexpectedtxt">trunk/LayoutTests/http/tests/security/xss-DENIED-synchronous-form-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDwindownamenavigatorexpectedtxt">trunk/LayoutTests/http/tests/security/xss-DENIED-window-name-navigator-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDxsldocumentsecurityOriginexpectedtxt">trunk/LayoutTests/http/tests/security/xss-DENIED-xsl-document-securityOrigin-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssDENIEDxsldocumentsecurityOriginxml">trunk/LayoutTests/http/tests/security/xss-DENIED-xsl-document-securityOrigin.xml</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssevalexpectedtxt">trunk/LayoutTests/http/tests/security/xss-eval-expected.txt</a></li>

<li><a href="#trunkLayoutTestshttptestssecurityxssevalhtml">trunk/LayoutTests/http/tests/security/xss-eval.html</a></li>

<li><a href="#trunkLayoutTestsimportedw3cChangeLog">trunk/LayoutTests/imported/w3c/ChangeLog</a></li>

<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestsdomparsinginnerhtml05expectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/domparsing/innerhtml-05-expected.txt</a></li>

<li><a href="#trunkLayoutTestsimportedw3cwebplatformtestshtmlsemanticsformsformsubmission0getactionurlexpectedtxt">trunk/LayoutTests/imported/w3c/web-platform-tests/html/semantics/forms/form-submission-0/getactionurl-expected.txt</a></li>

<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>

<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp">trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp</a></li>

</ul>

</div>

<div id="patch">

<h3>Diff</h3>

<a id="trunkLayoutTestsChangeLog"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/ChangeLog        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/ChangeLog        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,3 +1,128 @@

</span><ins>+2016-08-29  Chris Dumez  &lt;cdumez@apple.com&gt;

+

+        We should throw a SecurityError when denying access to cross-origin Window properties

+        https://bugs.webkit.org/show_bug.cgi?id=161316

+

+        Reviewed by Darin Adler.

+

+        Update / rebaselined existing tests to reflect behavior change.

+

+        * fast/frames/sandboxed-iframe-history-denied-expected.txt:

+        * fast/xmlhttprequest/xmlhttprequest-no-file-access-expected.txt:

+        * fast/xmlhttprequest/xmlhttprequest-no-file-access.html:

+        * http/tests/dom/window-open-about-webkit-org-and-access-document-expected.txt:

+        * http/tests/dom/window-open-about-webkit-org-and-access-document.html:

+        * http/tests/history/cross-origin-replace-history-object-child-expected.txt:

+        * http/tests/history/cross-origin-replace-history-object-child.html:

+        * http/tests/plugins/cross-frame-object-access-expected.txt:

+        * http/tests/security/aboutBlank/xss-DENIED-navigate-opener-document-write-expected.txt:

+        * http/tests/security/aboutBlank/xss-DENIED-navigate-opener-javascript-url-expected.txt:

+        * http/tests/security/aboutBlank/xss-DENIED-set-opener-expected.txt:

+        * http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-expected.txt:

+        * http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html:

+        * http/tests/security/cross-frame-access-call-expected.txt:

+        * http/tests/security/cross-frame-access-call.html:

+        * http/tests/security/cross-frame-access-child-explicit-domain-expected.txt:

+        * http/tests/security/cross-frame-access-custom-expected.txt:

+        * http/tests/security/cross-frame-access-first-time-expected.txt:

+        * http/tests/security/cross-frame-access-first-time.html:

+        * http/tests/security/cross-frame-access-get-custom-property-cached-expected.txt:

+        * http/tests/security/cross-frame-access-get-custom-property-cached.html:

+        * http/tests/security/cross-frame-access-get-expected.txt:

+        * http/tests/security/cross-frame-access-getOwnPropertyDescriptor-expected.txt:

+        * http/tests/security/cross-frame-access-getOwnPropertyDescriptor.html:

+        * http/tests/security/cross-frame-access-history-get-expected.txt:

+        * http/tests/security/cross-frame-access-history-get-override-expected.txt:

+        * http/tests/security/cross-frame-access-history-prototype-expected.txt:

+        * http/tests/security/cross-frame-access-name-getter-expected.txt:

+        * http/tests/security/cross-frame-access-object-getPrototypeOf-expected.txt:

+        * http/tests/security/cross-frame-access-object-getPrototypeOf.html:

+        * http/tests/security/cross-frame-access-object-prototype-expected.txt:

+        * http/tests/security/cross-frame-access-object-prototype.html:

+        * http/tests/security/cross-frame-access-parent-explicit-domain-expected.txt:

+        * http/tests/security/cross-frame-access-port-expected.txt:

+        * http/tests/security/cross-frame-access-protocol-expected.txt:

+        * http/tests/security/cross-frame-access-protocol-explicit-domain-expected.txt:

+        * http/tests/security/cross-frame-access-selection-expected.txt:

+        * http/tests/security/cross-frame-access-selection.html:

+        * http/tests/security/cross-origin-reified-window-property-access-expected.txt:

+        * http/tests/security/cross-origin-window-property-access-expected.txt:

+        * http/tests/security/dataURL/resources/foreign-domain-data-url-accessor-iframe.html:

+        * http/tests/security/dataURL/resources/foreign-domain-data-url-accessor-opened-frame.html:

+        * http/tests/security/dataURL/xss-DENIED-from-data-url-in-foreign-domain-subframe-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-from-data-url-in-foreign-domain-window-open-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-2-level-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-2-level.html:

+        * http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-to-data-url-sub-frame-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame-to-data-url-sub-frame.html:

+        * http/tests/security/dataURL/xss-DENIED-from-data-url-sub-frame.html:

+        * http/tests/security/dataURL/xss-DENIED-from-data-url-to-data-url-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-from-data-url-to-data-url.html:

+        * http/tests/security/dataURL/xss-DENIED-from-javascript-url-window-open-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-from-javascript-url-window-open.html:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-from-data-url-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-from-data-url.html:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe-location-change-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe-location-change.html:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-subframe.html:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-window-open-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-in-foreign-domain-window-open.html:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-2-level-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-2-level.html:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-sub-frame-uppercase-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-window-open-expected.txt:

+        * http/tests/security/dataURL/xss-DENIED-to-data-url-window-open.html:

+        * http/tests/security/document-all-expected.txt:

+        * http/tests/security/document-all.html:

+        * http/tests/security/javascriptURL/resources/foreign-domain-javascript-url-accessor-iframe.html:

+        * http/tests/security/javascriptURL/resources/foreign-domain-javascript-url-accessor-opened-frame.html:

+        * http/tests/security/javascriptURL/xss-DENIED-from-javascript-url-in-foreign-domain-subframe-expected.txt:

+        * http/tests/security/javascriptURL/xss-DENIED-from-javascript-url-in-foreign-domain-window-open-expected.txt:

+        * http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-subframe-expected.txt:

+        * http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-subframe.html:

+        * http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-window-open-expected.txt:

+        * http/tests/security/javascriptURL/xss-DENIED-to-javascript-url-in-foreign-domain-window-open.html:

+        * http/tests/security/listener/resources/targetChild-JSTargetNode-onclick-addEventListener.html:

+        * http/tests/security/listener/resources/targetChild-JSTargetNode-onclick-shortcut.html:

+        * http/tests/security/listener/resources/targetChild-XMLHttpRequest-addEventListener.html:

+        * http/tests/security/listener/resources/targetChild-XMLHttpRequest-shortcut.html:

+        * http/tests/security/listener/resources/targetChild-window-onclick-addEventListener.html:

+        * http/tests/security/listener/resources/targetChild-window-onclick-shortcut.html:

+        * http/tests/security/listener/xss-JSTargetNode-onclick-addEventListener-expected.txt:

+        * http/tests/security/listener/xss-JSTargetNode-onclick-shortcut-expected.txt:

+        * http/tests/security/listener/xss-XMLHttpRequest-addEventListener-expected.txt:

+        * http/tests/security/listener/xss-XMLHttpRequest-shortcut-expected.txt:

+        * http/tests/security/listener/xss-window-onclick-addEventListener-expected.txt:

+        * http/tests/security/listener/xss-window-onclick-shortcut-expected.txt:

+        * http/tests/security/resources/cross-frame-access.js:

+        (test):

+        (cannotAccessFrame):

+        * http/tests/security/resources/cross-frame-history-prototype-iframe.html:

+        * http/tests/security/resources/iframe-for-synchronous-form.html:

+        * http/tests/security/resources/sandboxed-iframe-origin-add-step1.html:

+        * http/tests/security/resources/sandboxed-iframe-origin-remove-step2.html:

+        * http/tests/security/sandboxed-iframe-modify-self-expected.txt:

+        * http/tests/security/sandboxed-iframe-origin-add-expected.txt:

+        * http/tests/security/sandboxed-iframe-origin-remove-expected.txt:

+        * http/tests/security/srcdoc-in-sandbox-cannot-access-parent-expected.txt:

+        * http/tests/security/xss-DENIED-defineProperty-expected.txt:

+        * http/tests/security/xss-DENIED-frame-name-expected.txt:

+        * http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto-expected.txt:

+        * http/tests/security/xss-DENIED-htmlelelment-with-iframe-proto.html:

+        * http/tests/security/xss-DENIED-invalid-domain-change-expected.txt:

+        * http/tests/security/xss-DENIED-invalid-domain-change.html:

+        * http/tests/security/xss-DENIED-method-with-iframe-proto-expected.txt:

+        * http/tests/security/xss-DENIED-sandboxed-iframe-expected.txt:

+        * http/tests/security/xss-DENIED-synchronous-form-expected.txt:

+        * http/tests/security/xss-DENIED-window-name-navigator-expected.txt:

+        * http/tests/security/xss-DENIED-xsl-document-securityOrigin-expected.txt:

+        * http/tests/security/xss-DENIED-xsl-document-securityOrigin.xml:

+        * http/tests/security/xss-eval-expected.txt:

+        * http/tests/security/xss-eval.html:

+

</ins><span class="cx"> 2016-08-29  Youenn Fablet  &lt;youenn@apple.com&gt;

</span><span class="cx"> 

</span><span class="cx">         Image Loader should use FetchOptions::mode according its crossOrigin attribute

</span></span></pre></div>

<a id="trunkLayoutTestsfastframessandboxediframehistorydeniedexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/frames/sandboxed-iframe-history-denied-expected.txt (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/fast/frames/sandboxed-iframe-history-denied-expected.txt        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/fast/frames/sandboxed-iframe-history-denied-expected.txt        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,5 +1,4 @@

<del>-CONSOLE MESSAGE: line 1: Sandbox access violation: Blocked a frame at &quot;null&quot; from accessing a frame at &quot;&quot;.  The frame requesting access is sandboxed and lacks the &quot;allow-same-origin&quot; flag.

-CONSOLE MESSAGE: line 1: TypeError: undefined is not an object (evaluating 'top.history.back')

</del><ins>+CONSOLE MESSAGE: line 1: SecurityError (DOM Exception 18): Sandbox access violation: Blocked a frame at &quot;null&quot; from accessing a frame at &quot;&quot;.  The frame requesting access is sandboxed and lacks the &quot;allow-same-origin&quot; flag.

</ins><span class="cx"> ALERT: PASS

<span class="cx"> This test verifies that a sandboxed IFrame cannot navigate the top-level frame using the history API.

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkLayoutTestsfastxmlhttprequestxmlhttprequestnofileaccessexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/xmlhttprequest/xmlhttprequest-no-file-access-expected.txt (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/fast/xmlhttprequest/xmlhttprequest-no-file-access-expected.txt        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/fast/xmlhttprequest/xmlhttprequest-no-file-access-expected.txt        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,4 +1,20 @@

<span class="cx"> CONSOLE MESSAGE: line 23: XMLHttpRequest cannot load xmlhttprequest-no-file-access-expected.txt. Cross origin requests are only supported for HTTP.

<del>-CONSOLE MESSAGE: line 40: Blocked a frame with origin &quot;null&quot; from accessing a frame with origin &quot;&quot;. Protocols, domains, and ports must match.

</del><span class="cx"> 

<span class="cx"> The child iframe cannot paste its textual results into this iframe because it is considered a different domain - that's the point of this test! Therefore, success is denoted by the child iframe calling notifyDone. The test will hang if something goes amiss with the access control checks.

</span><ins>+

+--------

+Frame: '&lt;!--framePath //&lt;!--frame0--&gt;--&gt;'

+--------

+

+We're checking we can't read an arbitrary file when we set each file:// URI to have a unique domain.

+

+Checking that same-origin iframes work.

+Doing an XHR to an existing file.

+Exception: A network error occurred.

+Exception: Blocked a frame with origin &quot;null&quot; from accessing a frame with origin &quot;file://&quot;. Protocols, domains, and ports must match.

+

+

+--------

+Frame: 'f'

+--------

+Successful write into iframe

</ins></span></pre></div>

<a id="trunkLayoutTestsfastxmlhttprequestxmlhttprequestnofileaccesshtml"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/fast/xmlhttprequest/xmlhttprequest-no-file-access.html (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/fast/xmlhttprequest/xmlhttprequest-no-file-access.html        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/fast/xmlhttprequest/xmlhttprequest-no-file-access.html        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -4,6 +4,7 @@

</span><span class="cx"> if (window.testRunner) {

</span><span class="cx">     testRunner.dumpAsText();

</span><span class="cx">     testRunner.waitUntilDone();

</span><ins>+    testRunner.dumpChildFramesAsText();

</ins><span class="cx">     testRunner.setAllowUniversalAccessFromFileURLs(false);

</span><span class="cx">     testRunner.setAllowFileAccessFromFileURLs(false);

</span><span class="cx"> }

</span></span></pre></div>

<a id="trunkLayoutTestshttptestsdomwindowopenaboutwebkitorgandaccessdocumentexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/dom/window-open-about-webkit-org-and-access-document-expected.txt (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/dom/window-open-about-webkit-org-and-access-document-expected.txt        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/dom/window-open-about-webkit-org-and-access-document-expected.txt        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,6 +1,5 @@

<del>-CONSOLE MESSAGE: line 34: Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;null&quot;.  The frame requesting access has a protocol of &quot;http&quot;, the frame being accessed has a protocol of &quot;about&quot;. Protocols must match.

</del><ins>+CONSOLE MESSAGE: line 29: SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;null&quot;.  The frame requesting access has a protocol of &quot;http&quot;, the frame being accessed has a protocol of &quot;about&quot;. Protocols must match.

</ins><span class="cx"> 

<del>-CONSOLE MESSAGE: line 526: Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;null&quot;.  The frame requesting access has a protocol of &quot;http&quot;, the frame being accessed has a protocol of &quot;about&quot;. Protocols must match.

</del><ins>+PASS newWindow.document threw exception SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;null&quot;.  The frame requesting access has a protocol of &quot;http&quot;, the frame being accessed has a protocol of &quot;about&quot;. Protocols must match.

+.

</ins><span class="cx"> 

<del>-PASS newWindow.document is undefined.

-

</del></span></pre></div>

<a id="trunkLayoutTestshttptestsdomwindowopenaboutwebkitorgandaccessdocumenthtml"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/dom/window-open-about-webkit-org-and-access-document.html (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/dom/window-open-about-webkit-org-and-access-document.html        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/dom/window-open-about-webkit-org-and-access-document.html        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -13,7 +13,7 @@

</span><span class="cx">         }

</span><span class="cx"> 

</span><span class="cx">         function checkNewWindowDocumentIsUndefined () {

</span><del>-            shouldBeUndefined(&quot;newWindow.document&quot;);

</del><ins>+            shouldThrowErrorName(&quot;newWindow.document&quot;, &quot;SecurityError&quot;);

</ins><span class="cx">             if (window.testRunner)

</span><span class="cx">                 testRunner.notifyDone();

</span><span class="cx">         }

</span><span class="lines">@@ -26,6 +26,7 @@

</span><span class="cx">                 if (window.testRunner)

</span><span class="cx">                     testRunner.notifyDone();

</span><span class="cx">             } catch (e) {

</span><ins>+                console.log(e);

</ins><span class="cx">                 setTimeout(checkNewWindowDocumentIsUndefined, 500);

</span><span class="cx">             }

</span><span class="cx">         }

</span></span></pre></div>

<a id="trunkLayoutTestshttptestshistorycrossoriginreplacehistoryobjectchildexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/history/cross-origin-replace-history-object-child-expected.txt (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/history/cross-origin-replace-history-object-child-expected.txt        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/history/cross-origin-replace-history-object-child-expected.txt        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,7 +1,7 @@

<del>-CONSOLE MESSAGE: line 30: Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

</del><ins>+CONSOLE MESSAGE: line 15: SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

</ins><span class="cx"> ALERT: Child window's history object before attempt to clear: undefined

</span><span class="cx"> ALERT: About to shadow child window's history object: [object History]

</span><span class="cx"> ALERT: PASS: Could not shadow child window's history object: [object History]

<del>-CONSOLE MESSAGE: line 18: Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

</del><ins>+CONSOLE MESSAGE: line 15: SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

</ins><span class="cx"> ALERT: Child window's history object after attempt to clear: undefined

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkLayoutTestshttptestshistorycrossoriginreplacehistoryobjectchildhtml"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/history/cross-origin-replace-history-object-child.html (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/history/cross-origin-replace-history-object-child.html        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/history/cross-origin-replace-history-object-child.html        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -7,6 +7,15 @@

</span><span class="cx">     testRunner.waitUntilDone();

</span><span class="cx"> }

</span><span class="cx"> 

</span><ins>+function getSubframeHistory()

+{

+    try {

+      return window.frames[0].history;

+    } catch (e) {

+      console.log(e);

+    }

+}

+

</ins><span class="cx"> window.onmessage = function(evt)

</span><span class="cx"> {

</span><span class="cx">     if (evt.data != &quot;done&quot;) {

</span><span class="lines">@@ -15,13 +24,13 @@

</span><span class="cx">         return;

</span><span class="cx">     }

</span><span class="cx"> 

</span><del>-    alert(&quot;Child window's history object after attempt to clear: &quot; + window.frames[0].history);

</del><ins>+    alert(&quot;Child window's history object after attempt to clear: &quot; + getSubframeHistory());

</ins><span class="cx">     testRunner.notifyDone();

</span><span class="cx"> }

</span><span class="cx"> 

</span><span class="cx"> function setHistoryLength()

</span><span class="cx"> {

</span><del>-    alert(&quot;Child window's history object before attempt to clear: &quot; + window.frames[0].history);

</del><ins>+    alert(&quot;Child window's history object before attempt to clear: &quot; + getSubframeHistory());

</ins><span class="cx">     window.frames[0].postMessage(&quot;setHistoryLength&quot;, &quot;*&quot;);

</span><span class="cx"> }

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkLayoutTestshttptestspluginscrossframeobjectaccessexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/plugins/cross-frame-object-access-expected.txt (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/plugins/cross-frame-object-access-expected.txt        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/plugins/cross-frame-object-access-expected.txt        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,7 +1,5 @@

<span class="cx"> CONSOLE MESSAGE: line 22: SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://localhost:8000&quot; from accessing a frame with origin &quot;http://127.0.0.1:8000&quot;. Protocols, domains, and ports must match.

<del>-CONSOLE MESSAGE: line 55: Blocked a frame with origin &quot;http://localhost:8000&quot; from accessing a frame with origin &quot;http://127.0.0.1:8000&quot;. Protocols, domains, and ports must match.

-CONSOLE MESSAGE: line 62: Blocked a frame with origin &quot;http://localhost:8000&quot; from accessing a frame with origin &quot;http://127.0.0.1:8000&quot;. Protocols, domains, and ports must match.

</del><span class="cx"> 

</span><span class="cx"> 

</span><span class="cx"> --------

</span></span></pre></div>

<a id="trunkLayoutTestshttptestssecurityaboutBlankxssDENIEDnavigateopenerdocumentwriteexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-document-write-expected.txt (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-document-write-expected.txt        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-document-write-expected.txt        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,5 +1,4 @@

<del>-CONSOLE MESSAGE: line 1: Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

-CONSOLE MESSAGE: line 1: TypeError: undefined is not an object (evaluating 'target.document.body')

</del><ins>+CONSOLE MESSAGE: line 1: SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

</ins><span class="cx"> This page opens a window to &quot;&quot;, injects malicious code, and then navigates its opener to the victim. The opened window then tries to scripts its opener after document.writeing a new document.

</span><span class="cx"> Code injected into window:

</span><span class="cx"> &lt;script&gt;document.write('&lt;script&gt;function write(target, message) { target.document.body.innerHTML = message; }setTimeout(function() {write(window.opener, \'FAIL: XSS was allowed.\');}, 100);setTimeout(function() {write(window.opener.top.frames[1], \'SUCCESS: Window remained in original SecurityOrigin.\');}, 200);setTimeout(function() { if (window.testRunner) testRunner.globalFlag = true; }, 300);&lt;\/script&gt;');&lt;/script&gt;

</span></span></pre></div>

<a id="trunkLayoutTestshttptestssecurityaboutBlankxssDENIEDnavigateopenerjavascripturlexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-javascript-url-expected.txt (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-javascript-url-expected.txt        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-navigate-opener-javascript-url-expected.txt        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,5 +1,4 @@

<del>-CONSOLE MESSAGE: line 1: Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

-CONSOLE MESSAGE: line 1: TypeError: undefined is not an object (evaluating 'target.document.body')

</del><ins>+CONSOLE MESSAGE: line 1: SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

</ins><span class="cx"> This page opens a window to &quot;&quot;, injects malicious code, and then navigates its opener to the victim. The opened window then tries to scripts its opener after reloading itself as a javascript URL.

</span><span class="cx"> Code injected into window:

</span><span class="cx"> &lt;script&gt;window.location = 'javascript:\'&lt;script&gt;function write(target, message) { target.document.body.innerHTML = message; }setTimeout(function() {write(window.opener, \\\'FAIL: XSS was allowed.\\\');}, 100);setTimeout(function() {write(window.opener.top.frames[1], \\\'SUCCESS: Window remained in original SecurityOrigin.\\\');}, 200);setTimeout(function() { if (window.testRunner) testRunner.globalFlag = true; }, 300);&lt;\\\/script&gt;\''&lt;/script&gt;

</span></span></pre></div>

<a id="trunkLayoutTestshttptestssecurityaboutBlankxssDENIEDsetopenerexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-set-opener-expected.txt (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-set-opener-expected.txt        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/security/aboutBlank/xss-DENIED-set-opener-expected.txt        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,6 +1,5 @@

<span class="cx"> CONSOLE MESSAGE: line 55: SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

<del>-CONSOLE MESSAGE: line 2: Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

-CONSOLE MESSAGE: line 1: TypeError: undefined is not an object (evaluating 'target.document.body')

</del><ins>+CONSOLE MESSAGE: line 1: SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

</ins><span class="cx"> This page opens a window to &quot;&quot;, injects malicious code, and then uses window.open.call to set its opener to the victim. The opened window then tries to scripts its opener.

</span><span class="cx"> Code injected into window:

</span><span class="cx"> &lt;script&gt;function write(target, message) { target.document.body.innerHTML = message; }

</span></span></pre></div>

<a id="trunkLayoutTestshttptestssecuritycontentSecurityPolicysandboxallowscriptsinhttpheaderexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-expected.txt (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-expected.txt        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header-expected.txt        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,4 +1,4 @@

<span class="cx"> ALERT: Script executed in iframe.

<del>-CONSOLE MESSAGE: line 9: Sandbox access violation: Blocked a frame at &quot;http://127.0.0.1:8000&quot; from accessing a frame at &quot;http://127.0.0.1:8000&quot;.  The frame being accessed is sandboxed and lacks the &quot;allow-same-origin&quot; flag.

</del><ins>+CONSOLE MESSAGE: line 13: SecurityError (DOM Exception 18): Sandbox access violation: Blocked a frame at &quot;http://127.0.0.1:8000&quot; from accessing a frame at &quot;http://127.0.0.1:8000&quot;.  The frame being accessed is sandboxed and lacks the &quot;allow-same-origin&quot; flag.

</ins><span class="cx"> ALERT: PASS: Iframe was in a unique origin

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkLayoutTestshttptestssecuritycontentSecurityPolicysandboxallowscriptsinhttpheaderhtml"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-in-http-header.html        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -6,7 +6,12 @@

</span><span class="cx"> 

</span><span class="cx"> window.onload = function() {

</span><span class="cx">     var frame = document.getElementsByTagName(&quot;iframe&quot;)[0];

</span><del>-    var secret = frame.contentWindow.secret;

</del><ins>+    var secret;

+    try {

+        secret = frame.contentWindow.secret;

+    } catch (e) {

+        console.log(e);

+    }

</ins><span class="cx">     if (secret)

</span><span class="cx">         alert(&quot;FAIL: Iframe was not in a unique origin: &quot; + secret);

</span><span class="cx">     else

</span></span></pre></div>

<a id="trunkLayoutTestshttptestssecuritycrossframeaccesscallexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/cross-frame-access-call-expected.txt (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/security/cross-frame-access-call-expected.txt        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/security/cross-frame-access-call-expected.txt        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,4 +1,3 @@

<del>-CONSOLE MESSAGE: line 10: Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

</del><span class="cx"> 

</span><span class="cx"> Tests for calling methods of another frame using Function.call

</span><span class="cx"> 

</span><span class="lines">@@ -35,7 +34,7 @@

<span class="cx"> PASS window.showModalDialog.call(targetWindow); threw exception SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match..

<span class="cx"> PASS: window.eval.call(targetWindow, '1+2'); should be '3' and is.

<span class="cx"> PASS window.location.toString.call(targetWindow.location) threw exception SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match..

<del>-PASS: targetWindow.history should be 'undefined' and is.

</del><ins>+PASS targetWindow.history threw exception SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match..

</ins><span class="cx"> PASS: successfullyParsed should be 'true' and is.

</span><span class="cx"> 

</span><span class="cx"> TEST COMPLETE

</span></span></pre></div>

<a id="trunkLayoutTestshttptestssecuritycrossframeaccesscallhtml"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/cross-frame-access-call.html (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/security/cross-frame-access-call.html        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/security/cross-frame-access-call.html        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -64,7 +64,7 @@

</span><span class="cx">     shouldThrowErrorName(&quot;window.location.toString.call(targetWindow.location)&quot;, &quot;SecurityError&quot;);

</span><span class="cx"> 

</span><span class="cx">     // - Tests for the History object -

</span><del>-    shouldBeUndefined(&quot;targetWindow.history&quot;);

</del><ins>+    shouldThrowErrorName(&quot;targetWindow.history&quot;, &quot;SecurityError&quot;);

</ins><span class="cx"> 

<span class="cx">     // Work around DRT bug that causes subsequent tests to fail.

</span><span class="cx">     window.stop();

</span></span></pre></div>

<a id="trunkLayoutTestshttptestssecuritycrossframeaccesschildexplicitdomainexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/cross-frame-access-child-explicit-domain-expected.txt (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/security/cross-frame-access-child-explicit-domain-expected.txt        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/security/cross-frame-access-child-explicit-domain-expected.txt        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,4 +1,4 @@

<del>-CONSOLE MESSAGE: line 172: Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://127.0.0.1:8000&quot;. The frame being accessed set &quot;document.domain&quot; to &quot;127.0.0.1&quot;, but the frame requesting access did not. Both must set &quot;document.domain&quot; to the same value to allow access.

</del><ins>+CONSOLE MESSAGE: line 194: SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://127.0.0.1:8000&quot;. The frame being accessed set &quot;document.domain&quot; to &quot;127.0.0.1&quot;, but the frame requesting access did not. Both must set &quot;document.domain&quot; to the same value to allow access.

</ins><span class="cx"> 

<span class="cx"> PASS: Cross frame access to frame explicitly setting document.domain was denied.

</span><span class="cx"> 

</span></span></pre></div>

<a id="trunkLayoutTestshttptestssecuritycrossframeaccesscustomexpectedtxt"></a>

<div class="modfile"><h4>Modified: trunk/LayoutTests/http/tests/security/cross-frame-access-custom-expected.txt (205135 => 205136)</h4>

<pre class="diff"><span>

<span class="info">--- trunk/LayoutTests/http/tests/security/cross-frame-access-custom-expected.txt        2016-08-29 19:36:36 UTC (rev 205135)

+++ trunk/LayoutTests/http/tests/security/cross-frame-access-custom-expected.txt        2016-08-29 19:37:01 UTC (rev 205136)

</span><span class="lines">@@ -1,27 +1,24 @@

<del>-CONSOLE MESSAGE: line 55: Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

</del><ins>+CONSOLE MESSAGE: line 57: SecurityError (DOM Exception 18): Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.

</ins><span class="cx"> CONSOLE MESSAGE: line 83: Blocked a frame with origin &quot;http://127.0.0.1:8000&quot; from accessing a frame with origin &quot;http://localhost:8000&quot;. Protocols, domains, and ports must match.