Re: text/sandboxed-html from Boris Zbarsky on 2010-01-13 (public-web-security@w3.org from January 2010)

From: Boris Zbarsky <bzbarsky@MIT.EDU>
Date: Tue, 12 Jan 2010 21:29:07 -0500
To: Maciej Stachowiak <mjs@apple.com>
CC: Ian Hickson <ian@hixie.ch>, public-html@w3.org, public-web-security@w3.org
Message-ID: <4B4D2FF3.9020604@mit.edu>

On 1/12/10 9:21 PM, Maciej Stachowiak wrote:
> That does seem like a potential improvement, so long as
> "text/html-sandboxed" has the same effect of load failure in legacy UAs
> (I haven't tested).

In Gecko both types (text/html-sandboxed and text/sandboxed-html) put up 
the helper app prompt.  In Opera they both show an error page with a 
"download default" link.  In Safari both are treated as text/plain.  In 
Chrome they both seem to cause the content to be silently ignored.

The Gecko behavior and possibly the Safari/Opera behavior seems like it 
might be a problem for this approach in the near term, no?

I don't have IE to hand right this second, or anything more interesting 
(amaya, lynx, etc).

-Boris

Received on Wednesday, 13 January 2010 02:29:42 UTC