[whatwg] Javascript: URLs as element attributes

Darin Adler darin at apple.com
Tue Nov 30 11:37:53 PST 2010

In WebKit, we have treated the javascript URL scheme as a special case, with explicit code in the loader, and not handled by general purpose resource protocol machinery. Maciej Stachowiak suggested this approach, back in 2002, and one of the reasons he gave me at the time is that thought WebKit would be more likely to get the security policy right if code paths opted in to JavaScript execution rather than opting out of javascript URL scheme handling.

    -- Darin

More information about the whatwg mailing list