[whatwg] Javascript: URLs as element attributes
Boris Zbarsky
bzbarsky at MIT.EDU
Wed Dec 1 07:24:31 PST 2010
On 12/1/10 3:16 AM, Philip Jägenstedt wrote:
> No, <img> was on the list of inlines where javascript: URL execution was
> explicitly blocked.
Ah, ok. Gotcha.
> Someone who manages to install a working Java plugin might want to test
> this. It doesn't seem like it could be a compat issue to me.
Agreed.
> Do you do that just for inlines, or also when navigating to javascript:
> URLs? If it's both, then that's something we'd need to standardize,
> unless all browsers already do the same.
It's both in Gecko. We really do try to keep the number of
special-cases to a minimum. ;)
I agree that we probably need to standardize this, because I fully
expect web sites to depend on the ISO-8859-1 bit when all the charcodes
are < 255.
> Indeed, so the question is just what the compat constraints are.
Well, no. There's the question of what's least confusing for authors
too; see my other mail about that in this thread.
> Right, these aren't inlines, in Opera terminology at least. As far as I
> can see the spec agrees on this, as frames/iframes have their own
> browsing contexts.
So do <object>s, sometimes, right?
-Boris
More information about the whatwg
mailing list