Named access checks on DOMWindow miss navigator
The design of the named access check is very fragile. Instead of doing the
access check at the same time as the access, we need to check access in a
separate operation using different parameters. Worse, we need to implement a
part of the access check as a blacklist of dangerous properties.
This CL expands the blacklist slightly by adding in the real named properties
from the DOMWindow instance to the current list (which included the real named
properties of the shadow object).
In the longer term, we should investigate whether we can change the V8 API to
let us do the access check in the same callback as the property access itself.
BUG=237022
Review URL: https://chromiumcodereview.appspot.com/15346002
git-svn-id: svn://svn.chromium.org/blink/trunk@150616 bbb929c8-8fbe-4397-9dbb-9b2b20218538
5 files changed
