document.open() security origin aliasing fix

cbbbc03

Source/WebCore/dom/Document.cpp

SecurityOrigin is WebKit's authoritative object for same-origin policy enforcement — it determines what resources a document can access. SecurityOriginPolicy wraps and owns a SecurityOrigin and is attached to each document. Normally, every document has its own independent SecurityOriginPolicy. document.open() reinitializes a document's content but is not supposed to change origin ownership.

The bug was that Document::open() called setSecurityOriginPolicy() with the caller document's policy object, creating a shared reference. Because document.domain writes mutate the underlying SecurityOrigin in place, changes on the caller silently reflected on the callee — without any explicit cross-document operation.

Before:
  CallerDoc ──► SecurityOriginPolicy ◄── CalleeDoc   (shared object)
                      │
               SecurityOrigin
          document.domain = 'x'   ← mutation visible through BOTH handles

After:
  CallerDoc ──► SecurityOriginPolicy     CalleeDoc ──► SecurityOriginPolicy
                      │                                       │
               SecurityOrigin (A)                    SecurityOrigin (B)
          document.domain = 'x'                  (unaffected, independent)

The fix is a one-line removal: the setSecurityOriginPolicy() call is deleted. Same-origin enforcement relies on the check at the top of Document::open(), not on sharing the origin object. This matches the HTML spec and the behavior of Gecko and Blink.

Significance

This was a same-origin policy boundary violation: a caller could mutate its own document.domain and have that mutation silently propagate to a document it had opened, because they shared a single SecurityOrigin instance. The aliasing meant that document.domain relaxation — already a deprecated and dangerous feature — had an even wider blast radius than intended, crossing document boundaries through a shared mutable reference.

Audit directions