[w3c/IndexedDB] Implementor's note: Escape the database name? (#207)

I was reviewing the current editor's draft for security issues and didn't find anything substantial (yay). That said, you may want to add an implementation note:

The algorithm for opening a database leaves unspecified how a user agent should store the database, but permits an arbitrary database name. Implementations should be careful that the database name, if converted into some kind of disk path, be appropriately escaped so an adversary can't use `../` or similar to violate the same-origin policy.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/IndexedDB/issues/207