[whatwg] Javascript: URLs as element attributes

On 12/1/10 3:16 AM, Philip J?genstedt wrote:
> No, <img> was on the list of inlines where javascript: URL execution was
> explicitly blocked.

Ah, ok.  Gotcha.

> Someone who manages to install a working Java plugin might want to test
> this. It doesn't seem like it could be a compat issue to me.

Agreed.

> Do you do that just for inlines, or also when navigating to javascript:
> URLs? If it's both, then that's something we'd need to standardize,
> unless all browsers already do the same.

It's both in Gecko.  We really do try to keep the number of 
special-cases to a minimum.  ;)

I agree that we probably need to standardize this, because I fully 
expect web sites to depend on the ISO-8859-1 bit when all the charcodes 
are < 255.

> Indeed, so the question is just what the compat constraints are.

Well, no.  There's the question of what's least confusing for authors 
too; see my other mail about that in this thread.

> Right, these aren't inlines, in Opera terminology at least. As far as I
> can see the spec agrees on this, as frames/iframes have their own
> browsing contexts.

So do <object>s, sometimes, right?

-Boris

Received on Wednesday, 1 December 2010 07:24:31 UTC