Navigation Menu

Skip to content

Commit

Permalink
[giow] (2) drop support for '/' origins in postMessage(), and require…
Browse files Browse the repository at this point in the history
… that paths be ignored.

git-svn-id: http://svn.whatwg.org/webapps@5277 340c8d12-0b0e-0410-8428-c7bf67bfef74
  • Loading branch information
Hixie committed Aug 11, 2010
1 parent 0a41e0b commit cf05b23
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 45 deletions.
20 changes: 5 additions & 15 deletions complete.html
Expand Up @@ -209,7 +209,7 @@

<header class=head id=head><p><a class=logo href=http://www.whatwg.org/ rel=home><img alt=WHATWG src=/images/logo></a></p>
<hgroup><h1>Web Applications 1.0</h1>
<h2 class="no-num no-toc">Draft Standard &mdash; 10 August 2010</h2>
<h2 class="no-num no-toc">Draft Standard &mdash; 11 August 2010</h2>
</hgroup><p>You can take part in this work. <a href=http://www.whatwg.org/mailing-list>Join the working group's discussion list.</a></p>
<p><strong>Web designers!</strong> We have a <a href=http://blog.whatwg.org/faq/>FAQ</a>, a <a href=http://forums.whatwg.org/>forum</a>, and a <a href=http://www.whatwg.org/mailing-list#help>help mailing list</a> for you!</p>
<!--<p class="impl"><strong>Implementors!</strong> We have a <a href="http://www.whatwg.org/mailing-list#implementors">mailing list</a> for you too!</p>-->
Expand Down Expand Up @@ -75894,7 +75894,7 @@ <h4 id=posting-messages><span class=secno>10.4.3 </span>Posting messages</h4>
send the message to the target regardless of origin, set the
target origin to "<code title="">*</code>". To restrict the
message to same-origin targets only, without needing to explicitly
state the origin, set the target origin to "<code title="">/</code>".</p>
state the origin, pass the <code title=dom-location><a href=#dom-location>window.location</a></code> object.</p>

<p>Throws an <code><a href=#invalid_state_err>INVALID_STATE_ERR</a></code> if the <var title="">ports</var> array is not null and it contains either null
entries or duplicate ports.</p>
Expand Down Expand Up @@ -75922,12 +75922,9 @@ <h4 id=posting-messages><span class=secno>10.4.3 </span>Posting messages</h4>
<ol><li>

<p>If the value of the <var title="">targetOrigin</var> argument
is neither a single U+002A ASTERISK character (*), a single U+002F
SOLIDUS character (/), nor an <a href=#absolute-url>absolute URL</a> with a
<code title=url-host-specific><a href=#url-host-specific>&lt;host-specific&gt;</a></code>
component that is either empty or a single U+002F SOLIDUS
character (/), then throw a <code><a href=#syntax_err>SYNTAX_ERR</a></code> exception and
abort the overall set of steps.</p>
is neither a single U+002A ASTERISK character (*) nor an
<a href=#absolute-url>absolute URL</a>, then throw a <code><a href=#syntax_err>SYNTAX_ERR</a></code>
exception and abort the overall set of steps.</p>

</li>

Expand Down Expand Up @@ -75976,13 +75973,6 @@ <h4 id=posting-messages><span class=secno>10.4.3 </span>Posting messages</h4>

<li>

<p>If the <var title="">targetOrigin</var> argument is a single
literal U+002F SOLIDUS character (/), and the
<code><a href=#document>Document</a></code> of the <code><a href=#window>Window</a></code> object on which
the method was invoked does not have the <a href=#same-origin>same origin</a>
as the <a href=#entry-script>entry script</a>'s <a href="#script's-document" title="script's
document">document</a>, then abort these steps silently.</p>

<p>Otherwise, if the <var title="">targetOrigin</var> argument is
an <a href=#absolute-url>absolute URL</a>, and the <code><a href=#document>Document</a></code> of the
<code><a href=#window>Window</a></code> object on which the method was invoked does
Expand Down
20 changes: 5 additions & 15 deletions index
Expand Up @@ -213,7 +213,7 @@

<header class=head id=head><p><a class=logo href=http://www.whatwg.org/ rel=home><img alt=WHATWG src=/images/logo></a></p>
<hgroup><h1>HTML5 (including next generation additions still in development)</h1>
<h2 class="no-num no-toc">Draft Standard &mdash; 10 August 2010</h2>
<h2 class="no-num no-toc">Draft Standard &mdash; 11 August 2010</h2>
</hgroup><p>You can take part in this work. <a href=http://www.whatwg.org/mailing-list>Join the working group's discussion list.</a></p>
<p><strong>Web designers!</strong> We have a <a href=http://blog.whatwg.org/faq/>FAQ</a>, a <a href=http://forums.whatwg.org/>forum</a>, and a <a href=http://www.whatwg.org/mailing-list#help>help mailing list</a> for you!</p>
<!--<p class="impl"><strong>Implementors!</strong> We have a <a href="http://www.whatwg.org/mailing-list#implementors">mailing list</a> for you too!</p>-->
Expand Down Expand Up @@ -69729,7 +69729,7 @@ function receiver(e) {
send the message to the target regardless of origin, set the
target origin to "<code title="">*</code>". To restrict the
message to same-origin targets only, without needing to explicitly
state the origin, set the target origin to "<code title="">/</code>".</p>
state the origin, pass the <code title=dom-location><a href=#dom-location>window.location</a></code> object.</p>

<p>Throws an <code><a href=#invalid_state_err>INVALID_STATE_ERR</a></code> if the <var title="">ports</var> array is not null and it contains either null
entries or duplicate ports.</p>
Expand Down Expand Up @@ -69757,12 +69757,9 @@ function receiver(e) {
<ol><li>

<p>If the value of the <var title="">targetOrigin</var> argument
is neither a single U+002A ASTERISK character (*), a single U+002F
SOLIDUS character (/), nor an <a href=#absolute-url>absolute URL</a> with a
<code title=url-host-specific><a href=#url-host-specific>&lt;host-specific&gt;</a></code>
component that is either empty or a single U+002F SOLIDUS
character (/), then throw a <code><a href=#syntax_err>SYNTAX_ERR</a></code> exception and
abort the overall set of steps.</p>
is neither a single U+002A ASTERISK character (*) nor an
<a href=#absolute-url>absolute URL</a>, then throw a <code><a href=#syntax_err>SYNTAX_ERR</a></code>
exception and abort the overall set of steps.</p>

</li>

Expand Down Expand Up @@ -69811,13 +69808,6 @@ function receiver(e) {

<li>

<p>If the <var title="">targetOrigin</var> argument is a single
literal U+002F SOLIDUS character (/), and the
<code><a href=#document>Document</a></code> of the <code><a href=#window>Window</a></code> object on which
the method was invoked does not have the <a href=#same-origin>same origin</a>
as the <a href=#entry-script>entry script</a>'s <a href="#script's-document" title="script's
document">document</a>, then abort these steps silently.</p>

<p>Otherwise, if the <var title="">targetOrigin</var> argument is
an <a href=#absolute-url>absolute URL</a>, and the <code><a href=#document>Document</a></code> of the
<code><a href=#window>Window</a></code> object on which the method was invoked does
Expand Down
20 changes: 5 additions & 15 deletions source
Expand Up @@ -85452,8 +85452,8 @@ function receiver(e) {
send the message to the target regardless of origin, set the
target origin to "<code title="">*</code>". To restrict the
message to same-origin targets only, without needing to explicitly
state the origin, set the target origin to "<code
title="">/</code>".</p>
state the origin, pass the <code
title="dom-location">window.location</code> object.</p>

<p>Throws an <code>INVALID_STATE_ERR</code> if the <var
title="">ports</var> array is not null and it contains either null
Expand Down Expand Up @@ -85489,12 +85489,9 @@ function receiver(e) {
<li>

<p>If the value of the <var title="">targetOrigin</var> argument
is neither a single U+002A ASTERISK character (*), a single U+002F
SOLIDUS character (/), nor an <span>absolute URL</span> with a
<code title="url-host-specific">&lt;host-specific&gt;</code>
component that is either empty or a single U+002F SOLIDUS
character (/), then throw a <code>SYNTAX_ERR</code> exception and
abort the overall set of steps.</p>
is neither a single U+002A ASTERISK character (*) nor an
<span>absolute URL</span>, then throw a <code>SYNTAX_ERR</code>
exception and abort the overall set of steps.</p>

</li>

Expand Down Expand Up @@ -85547,13 +85544,6 @@ function receiver(e) {

<li>

<p>If the <var title="">targetOrigin</var> argument is a single
literal U+002F SOLIDUS character (/), and the
<code>Document</code> of the <code>Window</code> object on which
the method was invoked does not have the <span>same origin</span>
as the <span>entry script</span>'s <span title="script's
document">document</span>, then abort these steps silently.</p>

<p>Otherwise, if the <var title="">targetOrigin</var> argument is
an <span>absolute URL</span>, and the <code>Document</code> of the
<code>Window</code> object on which the method was invoked does
Expand Down

0 comments on commit cf05b23

Please sign in to comment.