[html5] r3857 - [e] (0) clarify that data: and javascript: don't work as worker scripts

[whatwg at whatwg.org]

Author: ianh
Date: 2009-09-15 01:35:03 -0700 (Tue, 15 Sep 2009)
New Revision: 3857

Modified:
   source
Log:
[e] (0) clarify that data: and javascript: don't work as worker scripts

Modified: source
===================================================================
--- source	2009-09-15 08:22:04 UTC (rev 3856)
+++ source	2009-09-15 08:35:03 UTC (rev 3857)
@@ -70955,12 +70955,22 @@
    <li><p>If this fails, throw a <code>SYNTAX_ERR</code>
    exception.</p></li>
 
-   <li><p>If the <span>origin</span> of the resulting <span>absolute
-   URL</span> is not the <span title="same origin">same</span> as the
-   origin of the <span title="concept-script">script</span> that
-   invoked the constructor, then throw a <span>security
-   exception</span>.</p></li>
+   <li>
 
+    <p>If the <span>origin</span> of the resulting <span>absolute
+    URL</span> is not the <span title="same origin">same</span> as the
+    origin of the <span title="concept-script">script</span> that
+    invoked the constructor, then throw a <span>security
+    exception</span>.</p>
+
+    <p class="note">Thus, scripts must be external files with the same
+    scheme as the original page: you can't load a script from a <code
+    title="">data:</code> URL or <code title="">javascript:</code>
+    URL, and a <code>https:</code> page couldn't start workers using
+    scripts with <code>http:</code> URLs.</p>
+
+   </li>
+
    <li><p><span>Create a new <code>DedicatedWorkerGlobalScope</code>
    object</span>. Let <var title="">worker global scope</var> be this
    new object.</p></li>
@@ -71079,11 +71089,21 @@
    argument, or the empty string if the second argument was
    omitted.</p></li>
 
-   <li><p>If the <span>origin</span> of <var title="">scriptURL</var>
-   is not the <span title="same origin">same</span> as the origin of
-   the script that invoked the constructor, then throw a
-   <span>security exception</span>.</p></li>
+   <li>
 
+    <p>If the <span>origin</span> of <var title="">scriptURL</var> is
+    not the <span title="same origin">same</span> as the origin of the
+    script that invoked the constructor, then throw a <span>security
+    exception</span>.</p>
+
+    <p class="note">Thus, scripts must be external files with the same
+    scheme as the original page: you can't load a script from a <code
+    title="">data:</code> URL or <code title="">javascript:</code>
+    URL, and a <code>https:</code> page couldn't start workers using
+    scripts with <code>http:</code> URLs.</p>
+
+   </li>
+
    <li>
 
     <p>Let <var title="">docs</var> be the <span>list of relevant