Re: [w3c/webcomponents] Make JavaScript Files a Valid Entry Point to a Web Page (#807)

> There is a long history of vulnerabilities that involve socially engineering users into going to a URL via ads, URL shortneners, open redirectors, and `<a href="//cdn.org/people-dont-consistently-read-urls.js">Cute kittens</a>`.

I have great respect for you Mike Samuel, because for your contributions to the standards, specifically: Tagged Template Literals.

With that said, I'd like to respectfully point out, that:
<a href="//cdn.org/people-dont-consistently-read-urls.js">Cute kittens</a>

Is very similar to:
<a href="//cdn.org/people-dont-consistently-read-urls.html">Cute kittens</a>

My point is, that malicious javascript is that "is navigated to directly" is no more malicious that javascript that automatically runs from the prision of an html file.



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webcomponents/issues/807#issuecomment-488328048