On Mon, Jun 2, 2014 at 3:03 PM, Boris Zbarsky <bzbar...@mit.edu> wrote: > On 6/2/14, 9:00 AM, Anne van Kesteren wrote: >> You're not persuaded by the attack scenario? > > Correct. I mean, the same scenario applies to srcdoc, document.write() into > an iframe, etc. Why are data urls special?
The attack is the URL. A developer has to specifically consider data URLs and realize their implications. Other URLs will do the right thing and not run potentially hostile code stealing same-origin data. >> Provided we agree that it is always unset after any redirect, yes. > > We agree on that. Great! -- http://annevankesteren.nl/