[20]window や location
のメンバー (一部例外を除きます。) に対するスクリプトからのアクセス
HTML 5
[26] ただし、Webブラウザによっては、 HTML 5 で例外とされているメンバー以外にも異なる起源のスクリプトからアクセスできてしまいます。
(例えば Gecko では name や status にアクセスできます。
name の項を参照。)
[84]Window: HTML Standard ( 版) http://www.whatwg.org/specs/web-apps/current-work/#security-2
[86]Location: HTML Standard ( 版) http://www.whatwg.org/specs/web-apps/current-work/#security-3
[82]frameElement: HTML Standard ( 版) http://www.whatwg.org/specs/web-apps/current-work/#dom-frameelement
[127]contentDocument:
HTML Standard ( 版) http://www.whatwg.org/specs/web-apps/current-work/#dom-iframe-contentdocument
HTML Standard ( 版) http://www.whatwg.org/specs/web-apps/current-work/#dom-object-contentdocument
HTML Standard ( 版) http://www.whatwg.org/specs/web-apps/current-work/#dom-frame-contentdocument
[128]getSVGDocument
[83]navigation: HTML Standard ( 版) http://www.whatwg.org/specs/web-apps/current-work/#allowed-to-navigate
[7]Internet Explorer をはじめとする他ブラウザも同様にこの制限を実装しましたが、
ECMAScript 仕様や DOM 仕様としての標準化の対象外とされ、
長らく明文化された規定が存在していませんでした。
[165] 暗黙の標準だった時期の同一起源ポリシーは、実装ごとに細かな違いがありました。
例えばポートを起源の区別に寄与させるかどうかは、
現在の document.domain やクッキーの適用範囲にも影響を残しています。
Internet Explorer のセキュリティーゾーンのように、
同一起源ポリシーの原則から外れた機能も存在していました。
[172]
Cross-Frame Scripting and Security, InetSDK, , https://web.archive.org/web/20001118034900/http://msdn.microsoft.com/workshop/Author/om/xframe_scripting_security.asp
[8]HTML DOM に関係する部分はようやく2005年頃に WHATWG
によって HTML 5 仕様の一部として仕様の明文化が行われ始めました。
また、 XMLHttpRequest に関しては HTML 5 仕様を参照する形で規定されています。
[5]RFC 6454 - The Web Origin Concept ( 版) http://tools.ietf.org/html/rfc6454
[24]起源に関する基本的な規定は RFC 6454 となりましたが、2014年に
HTML Standard、URL Standard、Fetch Standard により廃止されています。
起源を参照。
[124] Web Applications 1.0 r8272 Change iframe, frame, and object.contentDocument to return null when cross-origin documents are involved. ( 版) http://html5.org/tools/web-apps-tracker?from=8271&to=8272
[125] Web Applications 1.0 r8273 Remove security checks on Document since there should now be no way to get to a Document from another origin. ( 版) http://html5.org/tools/web-apps-tracker?from=8272&to=8273
[2]
JavaScript Security: Same Origin (2008-06-18 04:13:16 +09:00 版) http://www.mozilla.org/projects/security/components/same-origin.html
[1]
Same origin policy - Wikipedia, the free encyclopedia (2008-07-02 01:06:45 +09:00 版) http://en.wikipedia.org/wiki/Same_origin_policy
[35] Same origin policy for JavaScript - MDC ( 版) https://developer.mozilla.org/En/Same_origin_policy_for_JavaScript
[36] The Multi-Principal OS Construction of the Gazelle Web Browser - Microsoft Research ( 版) http://research.microsoft.com/apps/pubs/default.aspx?id=79655
[45] Guidelines for Web Content Transformation Proxies 1.0
( ( 版))
http://www.w3.org/TR/2010/NOTE-ct-guidelines-20101026/#term-same-origin
[46] Web Applications 1.0 r5873 Make sure cross-origin fonts can't leak data via <canvas>.
( ( 版))
http://html5.org/tools/web-apps-tracker?from=5872&to=5873
[110] [whatwg] Need to define same-origin policy for WebIDL operations/getters/setters
( ( 版))
http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2013-January/038529.html
[117] Web Applications 1.0 r7975 Make showModalDialog()'s dialogArguments and returnValue only be useful same-origin, to avoid origins attacking each other
( ( 版))
http://html5.org/tools/web-apps-tracker?from=7974&to=7975
[118] Web Applications 1.0 r7975 Make showModalDialog()'s dialogArguments and returnValue only be useful same-origin, to avoid origins attacking each other
( ( 版))
http://html5.org/tools/web-apps-tracker?from=7974&to=7975
[119] [whatwg] Adding crossorigin="" to more elements
( ( 版))
http://lists.whatwg.org/pipermail/whatwg-whatwg.org/2013-June/039752.html
[120] Web Applications 1.0 r7997 Block enumeration of cross-origin objects, and clean up the language around those objects to be more consistent so that differences can more easily be seen.
( ( 版))
http://html5.org/tools/web-apps-tracker?from=7996&to=7997
[121] Web Applications 1.0 r8090 Remove the weird stuff around document.domain and localStorage. It doesn't really do anything anyway.
( ( 版))
http://html5.org/tools/web-apps-tracker?from=8089&to=8090
[122] Web Applications 1.0 r8196 Add warning notes to the Security sections of Location and Window since they are in flux with no end in sight.
( ( 版))
http://html5.org/tools/web-apps-tracker?from=8195&to=8196
[134] From the Aether to the Ethernet – Attacking the Internet using Broadcast Digital Television | the morning paper
( 版)
http://blog.acolyer.org/2015/04/23/from-the-aether-to-the-ethernet-attacking-the-internet-using-broadcast-digital-television/
What’s the origin if you provide content over the broadcast transport though?
The HbbTV specification suggests that in this case the broadcast stream should explicitly define its own web origin by setting the simple_application_boundary_descriptor property in the AIT to any desired domain name.
Yes, you can be anyone you want to be.
[135] HbbTV and Web origins
(Mark Nottingham 著, 版)
https://lists.w3.org/Archives/Public/www-tag/2015Apr/0052.html
[91] Abusing HTTP status codes to deanonymize web users
(Ahmed Elsobky 著, 版)
https://lists.w3.org/Archives/Public/public-webappsec/2015May/0043.html
[92] Re: Abusing HTTP status codes to deanonymize web users
(Anne van Kesteren 著, 版)
https://lists.w3.org/Archives/Public/public-webappsec/2015May/0047.html
[141] Introduction to DHTML Behaviors
( 版)
https://msdn.microsoft.com/ja-jp/library/ms531079(v=vs.85).aspx
Behaviors are subject to the About Cross-Frame Scripting and Security rules of Internet Explorer. In other words, a Web page that refers to a behavior located on another server in another domain results in an "access denied" error in the page's onerror event handler. In the same way, a Web page that refers to a behavior of a different security protocol than the referring page will result in the same error. For example, a Web page on http://server1/page.htm might not refer to a behavior on https://server1/hilite.htc.
[143] Mozilla XForms Specials - Archive of obsolete content | MDN
( 版)
https://developer.mozilla.org/en-US/docs/Archive/Web/XForms/Mozilla_XForms_Specials
Not exactly either a limitation, or an extension, but it is worth mentioning here. For security reasons, it is not per default possible for an XForms to submit data to another domain. This is due to security reasons. Information about how to whitelist domain can be found in the Release Notes
The cross domain check also includes forms loaded from file://. Forms loaded from that URL should be local files, and thus trusted, but it is not always the case. So there is not automatic "whitelisting" of local files.
[146] Add some more parameters to the "perform a security check" hook (for … · heycam/webidl@adf3772
( 版)
https://github.com/heycam/webidl/commit/adf37720bd92138f9f1627a214330287550c0004
[154] Cross-origin objects: do not wrap JavaScript functions
( (annevk著, ))
https://github.com/whatwg/html/commit/db361b608157b5cf9fd0d491d7dc76cdce80380b
[155] Remove unnecessary and unimplemented canvas tainting when painting text
(domenic著, )
https://github.com/whatwg/html/commit/6c76b617d2b45326afea2625d174ce2fd5ab6423
[169] Take tainted origin flag into account for the same origin check
(annevk著, )
https://github.com/whatwg/fetch/commit/986618a62b2d7d31f93177ed178f0cb21b570d85
[171] Take tainted origin flag into account for the same origin check by annevk · Pull Request #834 · whatwg/fetch
()
https://github.com/whatwg/fetch/pull/834