Opened 3 years ago

Closed 2 years ago

#18976 closed defect (fixed)

Permission denied to access property "getComputedStyle"

Reported by: GibboK Owned by: dylan
Priority: high Milestone: 1.12.2
Component: Core Version: 1.12.1
Keywords: Cc:
Blocked By: Blocking:

Description

Bug related to ​https://github.com/dojo/dojo/commit/bfea978ffd6e7a0606ad677e457e7079e42a937d

Bug is thrown on:

  • Firefox 51.0.1 (32-bit)
  • Firefox 53.0a2 (2017-02-16) (32-bit)

On Chrome 56.0.2924.87 no bug is thrown.

Instructions on how to reproduce the bug:

  • Host index.html on a domain example www.a.com
  • Host app.html on a subdomain example sub.a.com or a completely different domain as www.b.com.
  • In index.html change src to point to app.html.
  • Run index.html using Firefox.
  • Click button wihtin the iframe.
  • At click dojo will use getComputedStyle() which will cause bug to appears.

Notes:

  • If index.html and app.html are hosted on the same domain example www.a.com error is not thrown.

Error Stack trace:

`Permission denied to access property "getComputedStyle" Stack trace: dom-style.js:51:1`

File: bower.json 

{
    "name": "bug on fix #18871",
    "description": "Permission denied to access property \"getComputedStyle\"",
    "private": true,
    "dependencies": {
        "dijit": "1.12.1",
        "dojo": "1.12.1"
    },
    "ignore": [
        "**/.*",
        "node_modules",
        "bower_components",
        "",
        "test",
        "tests"
    ]
}

File: index.html 

<!DOCTYPE html>
<html>
<head>
    <title></title>
    <meta charset="utf-8" />
</head>
<body>
    <iframe src="http://sub.a.com/index.html"></iframe>
</body>
</html>

File: app.html 

<!DOCTYPE html>
<html>

<head>
    <meta charset="UTF-8">
    <title></title>
    <link href="dijit/themes/claro/claro.css" rel="stylesheet" />
    <script>
        var dojoConfig = {
            parseOnLoad: true,
            isDebug: true,
            locale: 'en-us',
            async: true
        };
    </script>
    <script src="dojo/dojo.js"></script>
    <script>
        require(['dijit/form/Button', 'dojo/dom', 'dojo/_base/fx', 'dojo/_base/kernel', 'dojo/domReady!'], function (Button, dom, fx, ke

Attachments (1)

18976.zip​ (1.1 KB) - added by GibboK 3 years ago.
Test case 18976

Download all attachments as: .zip

Change History (3)

Changed 3 years ago by GibboK

Attachment: 18976.zip​ added

Test case 18976

comment:1 Changed 3 years ago by dylan

Component: General → Core
Milestone: tbd → 1.12.2
Owner: set to dylan
Priority: undecided → high
Status: new → assigned

As noted in ​https://github.com/dojo/dojo/commit/bfea978ffd6e7a0606ad677e457e7079e42a937d#commitcomment-20930838 , unless I am misunderstanding, I think there are two different issues here. The latter issue is such that I don't believe you should be able to use getComputedStyle across domains. Perhaps this was failing silently before and now it's failing via an error? For the former issue, I'm thinking we may need to do something to detect win.global.window.parent vs. win.global.window and pick one based on permission/existence perhaps? Regardless, we'll investigate again.

comment:2 Changed 2 years ago by dylan

Resolution: → fixed
Status: assigned → closed

I believe this was fixed in ​https://github.com/dojo/dojo/commit/33505b8369bea813f7916cdeda3e86b484f546b4 . If not, please re-open!

Note: See TracTickets for help on using tickets.