[whatwg] idea for .zhtml format #html5 #web

[Eduard Pascual]

On Fri, Apr 2, 2010 at 6:25 PM, Doug Schepers <doug at schepers.cc> wrote:
> I don't think it's defined anywhere, but a browser could choose to save
> bundled resources as a self-contained Widget ("File > Save as Widget..."),
> which would be a great authoring solution for Widgets.

Isn't that the same thing, in essence, as MS did with IE? IIRC, IE had
an choice, on its save dialog, to "Save full page", which packed the
html page + all the CSS, JS, image, and other dependencies within a
".mht" (called meta-HTML) file (which, of course, only IE would be
able to open afterwards).

The fact is that this feature has been removed from the more recent
versions of IE (not sure if it was from IE6 or 7). It would be
interesting to know why MS decided why such a feature should be
removed.

At first glance, the only potential issue I see (both with IE's old
MHT format and with any possible zhtml) is XSS: when a downloaded file
is loaded from the local filesystem into the browser, which is its
domain? It may need some same-directory files, but it may be possible
that it tries to fetch something from its original location that has
not been downloaded, it might be trying to load content from a domain
that is not the local system.
This issue should be addressed if something like that is to be usable:
if we face the choice of broken pages vs. security flaw, the idea will
be already a failure. However, I have no idea of how to approach this.

Regards,
Eduard Pascual