On 7/23/2010 6:35 AM, Luke Hutchison wrote:
On Thu, Jul 22, 2010 at 5:39 PM, Boris Zbarsky<[email protected]> wrote:
I can see the security benefits of disallowing all cross-origin application
of javascript: (if you don't know where it came from, don't apply it).
Yes, that is actually a really good way to put things -- javascript
typed into the URL bar is cross-origin. (And dragging bookmarklets to
the address bar or bookmarks bar is also cross-origin, that's the
reason that a security check should be applied and/or user warning
given.)
Facebook already disallows the execution of arbitrary js code on a fan
page, of course, which is why these viruses require you to manually
copy/paste into the addressbar.
In whatever security mechanism is worked out, besides preserving the
ability for people to be able to use the URL bar for potentially
privileged bookmarklets if they wish (even if they must give permission
after receiving a specific warning), I would actually like to see the
privileges available to bookmarklets expanded, upon explicit warnings
and user permission. For example, it would be of enormous use to be able
to link someone to a specific site, while manipulating the view of that
page such as to mash over the data with tooltips mash down some data
from it to a smaller set, mash up the data with additional notes/sources
(whether from other sites or text found on the source page), or mash
under the data with semantic markup changes or highlighting of specific
text.
I know this is absolutely dangerous, but if people can install
extensions which can wipe out hard-drives with a two clicks and a
restart (and thank God that such power exists in browsers like Firefox
so people can make extensions which do access the file system for
positive uses), there should be a way, such as with dead-serious
warnings (and I'll concede disallowing https), that people can mash an
existing source and still work in its scope (just as I think there
should be the ability to run cross-domain Ajax after getting user
permission). Greasemonkey is great, but it would be nice for there to be
a standard, especially for uses as referring people immediately to a
specific subset of content on another page.
Brett
