WICG / sanitizer-api

https://wicg.github.io/sanitizer-api/
Other
228 stars 31 forks source link

(meta) export concepts used in funky element handling #154

Open mozfreddyb opened 2 years ago

mozfreddyb commented 2 years ago

This is a meta bug for a couple of issues, that we need to fix elsewhere before we can resolve on our end.

mozfreddyb commented 6 months ago

Most of the above should be resolved by previous work. What's left is:

The form action is the URL of the document, when empty. Are we OK with this? Do we want to think about the case of javascript documents here? I'd prefer not to, but mentioning for posterity :)

In the meeting, we agreed that we can't help that much once the user is in a javascript: document, given that all relative URLs in e.g., href are similarly dangerous. We should add a note to that effect.