On Mon, Jun 2, 2014 at 3:03 PM, Boris Zbarsky <bzbar...@mit.edu> wrote:
> On 6/2/14, 9:00 AM, Anne van Kesteren wrote:
>> You're not persuaded by the attack scenario?
> Correct.  I mean, the same scenario applies to srcdoc, document.write() into
> an iframe, etc.  Why are data urls special?

The attack is the URL. A developer has to specifically consider data
URLs and realize their implications. Other URLs will do the right
thing and not run potentially hostile code stealing same-origin data.

>> Provided we agree that it is always unset after any redirect, yes.
> We agree on that.



Reply via email to