W3C home > Mailing lists > Public > public-webapps@w3.org > July to September 2008

Re: [D3E] Possible Changes to Mutation Events

From: Jonas Sicking <jonas@sicking.cc>
Date: Thu, 17 Jul 2008 14:50:43 -0700
Message-ID: <487FBEB3.6010305@sicking.cc>
To: Kartikaya Gupta <lists.webapps@stakface.com>
CC: Boris Zbarsky <bzbarsky@MIT.EDU>, public-webapps <public-webapps@w3.org>

Kartikaya Gupta wrote:
> On Thu, 17 Jul 2008 11:48:52 -0400, Boris Zbarsky <bzbarsky@MIT.EDU> wrote:
>>> There are countless other
>>> implementations of MutationEvents out in the world
>>> (http://google.com/codesearch?hl=en&lr=&q=DOMNodeRemoved+-mozilla+-webcore&sbtn=Search).
>>> They exist in more languages and are used in more contexts than I
>>> care to enumerate
>> That's fine.  How many of those contexts have to assume that all DOM
>> access is malicious?
> 
> More than zero, I think. There's at least one gtk implementation that (at a quick glance) would have to deal with potentially malicious users.

And how well is gtk dealing with this? Has anyone done any extensive 
testing, such as fuzzing, to try to do evil things inside these mutation 
listeners?

/ Jonas
Received on Thursday, 17 July 2008 21:52:12 GMT

This archive was generated by hypermail 2.3.1 : Tuesday, 26 March 2013 18:49:27 GMT