Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature Proposal: no [OverrideBuiltins] #16

Open
domenic opened this issue Nov 21, 2018 · 3 comments
Open

Feature Proposal: no [OverrideBuiltins] #16

domenic opened this issue Nov 21, 2018 · 3 comments

Comments

@domenic
Copy link

domenic commented Nov 21, 2018

See whatwg/html#4112. The case people are most concerned about are when you could introduce an element with a name or ID that overrides the built-ins, i.e. the [OverrideBuiltins] cases on Document and HTMLFormElement.

You could imagine various expansions of this, e.g.

  • Turning off named getters/setters entirely. (Although I'm not sure we have replacements in 100% of cases)
  • Turning off "bad legacy DOM and HTML APIs" entirely. (E.g. things like Attr nodes.)
@ojanvafai
Copy link
Member

I wonder if we could generalize it to also remove the global scope polluter? (just thinking out loud, that might by nonsensical)

@domenic
Copy link
Author

domenic commented Nov 21, 2018

Yeah, that's kind of covered under my "turning off named getters/setters entirely" case, although it's a particularly egregious one.

@annevk
Copy link

annevk commented Nov 22, 2018

Entirely would be bad for dataset, but for cases with "fallbacks" (and therefore clashes) this makes a lot of sense.

I'm not convinced optional Attr nodes will help much.

@clelland clelland transferred this issue from w3c/webappsec-permissions-policy Dec 1, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants