Bug 256241 - setAppBadge() should reject with SecurityError if child iframe is not same origin-domain as top-origin
Summary: setAppBadge() should reject with SecurityError if child iframe is not same or...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Misc. (show other bugs)
Version: Other
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Marcos Caceres
URL: https://wpt.live/badging/setAppBadge_...
Keywords: InRadar, WPTImpact
Depends on:
Blocks:
 
Reported: 2023-05-02 18:52 PDT by Marcos Caceres
Modified: 2024-01-29 19:53 PST (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcos Caceres 2023-05-02 18:52:16 PDT 
As per spec, setAppBadge() should reject with SecurityError if child iframe is not same origin-domain as top-origin.

Updated spec change:
https://github.com/w3c/badging/pull/107

Relevant test: 
LayoutTests/imported/w3c/web-platform-tests/badging/setAppBadge_cross_origin.sub.html
Comment 1 Marcos Caceres 2023-05-02 18:53:29 PDT 
<rdar://problem/107109904>
Comment 2 Marcos Caceres 2023-05-02 18:55:21 PDT 
Pull request: https://github.com/WebKit/WebKit/pull/13389