- From: Michal Zalewski <lcamtuf@coredump.cx>
- Date: Mon, 12 Sep 2011 12:47:12 -0700
What about javascript: URLs?
Right now, every browser seems to treat javascript:alert('#') in an
"intuitive" manner.
This likely goes beyond data: and javascript:, so I think it would be
useful to look at it more holistically.
/mz
Received on Monday, 12 September 2011 12:47:12 UTC