[Webkit-unassigned] [Bug 132945] Don't sanitize window.onerror information on crossorigin-enabled scripts

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=132945

--- Comment #5 from youenn fablet <youennf at gmail.com> ---
ScriptExecutionContext::dispatchErrorEvent checks for CORS.
If a CachedScript is provided, it works as expected.

If the error is thrown synchronously when executing a script, I think sanitization will work as expected.

In the particular stackoverflow case, the exception is thrown in an event handler so we do not have any CachedScript at hand.
In that case, we rely on the sourceURL which is cross-origin.

One option is to continue relying on the existing mechanism and ensure we pass a CachedScript& everywhere.
Another option is to try to retrieve the sanitization information directly from the Exception, like we are retrieving the sourceURL/line... from it. It seems to me the latter would scale better.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190118/450aefcd/attachment-0001.html>