Re: Security Recommendations around https://www.w3.org/TR/2010/WD-html5-20100624/the-iframe-element.html

Jason Tsang <tsangtmc@gmail.com>, 2019-10-24 09:22 -0700:
> Archived-At: <https://www.w3.org/mid/CAO4tAOjFJywBMRKWNHdQS-teh+OLVMbgNbU5Dc3tMZekCTJDRA@mail.gmail.com>
> 
> I noted a security flaw in a implementation scenario in iframe sandboxes
> https://www.w3.org/TR/2010/WD-html5-20100624/the-iframe-element.html
> which does not currently appear to be documented as a risk.
> More info:
> https://blog.analyzenothing.com/2019/10/html-sandboxes-restrictions-bypass-forms.html
> 
> Could i recommend adding in a warning into the documentation about such a
> risk?

You should raise an issue at https://github.com/whatwg/html/issues/new

-- 
Michael[tm] Smith https://people.w3.org/mike