[whatwg] postMessage's target origin argument can be a full URL in some implementations
Jonas Sicking
jonas at sicking.cc
Wed Jul 14 16:33:24 PDT 2010
On Wed, Jul 14, 2010 at 3:48 PM, Hallvord R M Steen <hallvors at gmail.com> wrote:
>> My understanding is that this was a requirement from the spec. An
>> unfortunate one at that.
>
> Could you elaborate on why you think it is unfortunate?
I think it's unfortunate that if someone does:
postMessage(..., "http://foo.com/bar/baz.html");
that message can silently go to
http://foo.com/somethingElse.html
The problem here is the 'silently'. If we instead made the above throw
an exception then it would be more obvious for authors how this
worked.
>> However when I found out it was too late to
>> get the spec changed as multiple implementations had already shipped.
>
> Does that mean you intend to fix it to align with the spec?
I didn't realize that the spec now required that there was no path.
Yes, I think we should update to match the spec. There is of course
the risk that it'll break the web, but I think we should at least try.
Would love it if someone attached a patch. I can promise same-day
review if I'm not in travel.
/ Jonas
More information about the whatwg
mailing list