Re: type parameter of Document.open() (detailed review of the DOM)

Ian Hickson wrote:
> * Firefox treats text/html as HTML, and everything else as text/plain. It 
> ignores leading and trailing spaces, and ignores everything after the 
> first non-leading space or the first semicolon. It is case-insensitive.

If anyone is interested as to the reasons:

1) We added the text/plain support when someone complained about script 
injection issues in content they were document.writing as text/plain and 
which we at the time treated as HTML.  Given that, we decided that 
unknown types should be either treated as text/plain or throw, with 
text/plain being marginally more useful.

2) The type parsing (the whitespace/semicolon thing) is covered by 
<https://bugzilla.mozilla.org/show_bug.cgi?id=295652>.  Basically, some 
pages pass "text/html; charset=ISO-8859-1" and expect it to be treated 
as HTML.

> I've gone with the simplest subset behaviour -- case-insensitive literal 
> string match against "text/plain", with everything else being treated as 
> HTML.

That doesn't match Simon's quote from the spec, and I wouldn't be 
willing to implement this for the security reasons mentioned above.

-Boris

Received on Wednesday, 13 August 2008 02:59:44 UTC