W3C home > Mailing lists > Public > whatwg@whatwg.org > June 2014

Re: [whatwg] Stricter data URL policy

From: Anne van Kesteren <annevk@annevk.nl>
Date: Mon, 2 Jun 2014 16:15:22 +0200
Message-ID: <CADnb78i13NBJ_uuctqE8h6wP-4C1mW2vmq862GU8Mmi6skKhMw@mail.gmail.com>
To: Boris Zbarsky <bzbarsky@mit.edu>
Cc: WHATWG <whatwg@lists.whatwg.org>
On Mon, Jun 2, 2014 at 3:03 PM, Boris Zbarsky <bzbarsky@mit.edu> wrote:
> On 6/2/14, 9:00 AM, Anne van Kesteren wrote:
>> You're not persuaded by the attack scenario?
> Correct.  I mean, the same scenario applies to srcdoc, document.write() into
> an iframe, etc.  Why are data urls special?

The attack is the URL. A developer has to specifically consider data
URLs and realize their implications. Other URLs will do the right
thing and not run potentially hostile code stealing same-origin data.

>> Provided we agree that it is always unset after any redirect, yes.
> We agree on that.


Received on Monday, 2 June 2014 14:15:49 UTC

This archive was generated by hypermail 2.4.0 : Wednesday, 22 January 2020 17:00:21 UTC