Re: [w3ctag/design-reviews] Question: can we better define the intention of the "disable scripting" user preference (Issue #1247)

domfarolino left a comment (w3ctag/design-reviews#1247)

Thanks for filing this. +1 to this question; I can provide some more background as I raised the progenitor of this in the WHATWG Matrix chat.

We (Chromium) got a request to disable declarative [WebMCP](https://github.com/webmachinelearning/webmcp) when scripting is disabled, so that a document with scripting disabled could not register WebMCP tools and expose them to normal documents, which could "run" the tools in the script-less documents. While I'm not opposed to this request, it got us thinking: what should and should not be allowed to happen in a document where scripting is disabled. Should it not be possible to register functionality that is "runnable" from another, colluding document that *has* scripts enabled? Is it about privacy and exfiltration instead?

Having clear criteria to check new features against when determining if they should be enabled or disabled with scripting would clear a lot of this up.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/w3ctag/design-reviews/issues/1247#issuecomment-5170576066
You are receiving this because you are subscribed to this thread.

Message ID: <w3ctag/design-reviews/issues/1247/5170576066@github.com>