[whatwg] Sandboxing ideas

On 5/14/07, Michel Fortin <michel.fortin at michelf.com> wrote:
>
> Le 2007-05-14 ? 11:35, Alexey Feldgendler a ?crit :
>
> > I'd treat these two problems as equally important. A separate HTTP
> > request per forum comment on the page is completely unacceptable.
>
> What about encoding the content of each comment iframe in a "data:" URI?


The contents of an iframe with a data: URI source should be trusted, unlike
an iframe with an http: URI source from another domain.  A script in an
iframe with a data: URI source should, by default, be able to communicate
with the parent window.  So, that alone doesn't solve the problem.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.whatwg.org/pipermail/whatwg-whatwg.org/attachments/20070514/1f0a2a14/attachment.htm>

Received on Monday, 14 May 2007 13:02:42 UTC