187
edits
Firefox 3.6/PushState Security Review: Difference between revisions
Jump to navigation
Jump to search
Firefox 3.6/PushState Security Review (view source)
Revision as of 22:43, 6 August 2009
, 6 August 2009→Security and Privacy
| Line 19: | Line 19: | ||
<li>We also have to try and prevent a site from DOSing the browser by pushing many large objects.</li> | <li>We also have to try and prevent a site from DOSing the browser by pushing many large objects.</li> | ||
<li>I'm not sure whether the spec's same-origin check is sufficient for file:// URIs.</li> | <li>I'm not sure whether the spec's same-origin check is sufficient for file:// URIs.</li> | ||
<li>If we save pushStated data to disk (say for crash restore purposes), then we're allowing webpages to write arbitrarily large data do disk. We should probably put a limit on this. Additionally, if we allow serialization of binary-like objects (images?), we may be allowing pages to write truly arbitrary, potentially executable data to disk.</li> | |||
</ul> | </ul> | ||