Re: [whatwg/fetch] Block requests for suspected dangling markup. (#519) from Dominic Farolino on 2022-05-29 (public-webapps-github@w3.org from May 2022)

From: Dominic Farolino <notifications@github.com>
Date: Sun, 29 May 2022 08:54:34 -0700
To: whatwg/fetch <fetch@noreply.github.com>
Cc: Subscribed <subscribed@noreply.github.com>
Message-ID: <whatwg/fetch/pull/519/c1140476430@github.com>

I know it has been awhile, but is there any chance of revisiting this? Strictly speaking, if [fenced frames](https://github.com/WICG/fenced-frame) were to follow the spec we'd be vulnerable to the dangling markup [attacks](https://bugs.chromium.org/p/chromium/issues/detail?id=1301333) that Chrome has since mitigated against for other kinds of requests. With that, I think we'll stop fenced frame navigations when the `src` attribute contains dangling markup, but I'd feel less bad about implementing this (and adding web platform tests for this) if the spec accounted for this behavior too.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/519#issuecomment-1140476430
You are receiving this because you are subscribed to this thread.

Message ID: <whatwg/fetch/pull/519/c1140476430@github.com>

Received on Sunday, 29 May 2022 15:54:46 UTC