- From: Jonas Sicking <jonas@sicking.cc>
- Date: Thu, 17 Jul 2008 14:50:43 -0700
- To: Kartikaya Gupta <lists.webapps@stakface.com>
- CC: Boris Zbarsky <bzbarsky@MIT.EDU>, public-webapps <public-webapps@w3.org>
Kartikaya Gupta wrote: > On Thu, 17 Jul 2008 11:48:52 -0400, Boris Zbarsky <bzbarsky@MIT.EDU> wrote: >>> There are countless other >>> implementations of MutationEvents out in the world >>> (http://google.com/codesearch?hl=en&lr=&q=DOMNodeRemoved+-mozilla+-webcore&sbtn=Search). >>> They exist in more languages and are used in more contexts than I >>> care to enumerate >> That's fine. How many of those contexts have to assume that all DOM >> access is malicious? > > More than zero, I think. There's at least one gtk implementation that (at a quick glance) would have to deal with potentially malicious users. And how well is gtk dealing with this? Has anyone done any extensive testing, such as fuzzing, to try to do evil things inside these mutation listeners? / Jonas
Received on Thursday, 17 July 2008 21:52:12 UTC