Should we throw SecurityError when document.write() is used cross-origin?
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 9.4k
- Forks
- 3.2k
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 38
Description
Right now, document write steps have roughly the same checks and bailouts as document open steps. A notable exception is the same-origin check in document open steps that is not in document write steps. Maybe we could add that check to the document write steps as well?
Chrome already implements that check, though it doesn't seem like anyone else does.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the document write steps and document open steps in the linked HTML Standard sections, focusing on the same-origin check mentioned in the issue. Review the linked Chromium implementation and the discussion to determine whether the standard should align with it; done means the specification decision and any affected algorithm text are settled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html
- Domain
- web-dev
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100