Bureaucrats, canmove, Confirmed users
647
edits
Firefox 3.6/PushState Security Review: Difference between revisions
Firefox 3.6/PushState Security Review (view source)
Revision as of 18:20, 27 August 2009
, 27 August 2009→Review comments
| Line 83: | Line 83: | ||
* file:// uris have odd origin rules. We certainly don't want to allow a file to pushState() to some URL it can't otherwise load, navigate to a cooperating server which goes back to the inaccessible file. Maybe our current same-origin checks embody the correct rules. | * file:// uris have odd origin rules. We certainly don't want to allow a file to pushState() to some URL it can't otherwise load, navigate to a cooperating server which goes back to the inaccessible file. Maybe our current same-origin checks embody the correct rules. | ||
** jst and dveditz wouldn't mind not supporting the <url> parameter at all for file: uris, sicking thinks the current same-origin rules do the right thing. | ** jst and dveditz wouldn't mind not supporting the <url> parameter at all for file: uris, sicking thinks the current same-origin rules do the right thing. | ||
* popState should not count as a user interaction for allowing popups. | |||