- From: Anne van Kesteren <annevk@annevk.nl>
- Date: Mon, 2 Jun 2014 16:15:22 +0200
- To: Boris Zbarsky <bzbarsky@mit.edu>
- Cc: WHATWG <whatwg@lists.whatwg.org>
On Mon, Jun 2, 2014 at 3:03 PM, Boris Zbarsky <bzbarsky@mit.edu> wrote: > On 6/2/14, 9:00 AM, Anne van Kesteren wrote: >> You're not persuaded by the attack scenario? > > Correct. I mean, the same scenario applies to srcdoc, document.write() into > an iframe, etc. Why are data urls special? The attack is the URL. A developer has to specifically consider data URLs and realize their implications. Other URLs will do the right thing and not run potentially hostile code stealing same-origin data. >> Provided we agree that it is always unset after any redirect, yes. > > We agree on that. Great! -- http://annevankesteren.nl/
Received on Monday, 2 June 2014 14:15:49 UTC