bitovi/funcunit

F.open() doesn't throw when violating same-origin

Open

#156 创建于 2016年8月11日

在 GitHub 查看
 (0 评论) (0 反应) (0 负责人)JavaScript (575 star) (395 fork)batch import
bughelp wantedp3

描述

You can't, for example, load google.com from localhost. This fails, but does so silently.

We do catch the error in a try/catch here. We could improve this by checking the error in the catch and if it is a SecurityError, rethrow so the user can see the error.

Chrome and Firefox give a different error message, so detecting this might be tricky.

贡献者指南

技术栈
javascript
领域
testing
议题类型
bug
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
2
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
under 1 hour
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
stale
清晰度议题是否清楚说明期望改动、验收标准和下一步。
clear
前置要求
basic JavaScriptunderstanding of same origin policy
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
75
研究方向
The issue points to the catch block in browser/open.js at line 274. To fix, inspect the caught error object inside catch. In Chrome, SecurityError has name 'SecurityError'; in Firefox, it may have different properties. Use error.name or error.code to detect security violations. Once detected, rethrow the error so the user sees it. Test with a same origin violation scenario (e.g., loading google.com from localhost). No linked PRs or comments exist, so implementation is straightforward.
F.open() doesn't throw when violating same-origin · bitovi/funcunit#156 | Good First Issue