Prevent data: URLs from being used for XSS

Re:Prevent data: URLs from being used for XSS by favorited on Monday April 30, 2018 @05:05PM (#16962333)

Ahh the rare self-closing bug. Keep the ticket open long enough, and maybe the standards group will adopt your behavior!

It's cool that the large browsers had standardized on the same non-standard behavior. Makes total sense for WHATWG to adopt it, right?

[ Parent | on HN ]

Re:Prevent data: URLs from being used for XSS by jancsika on Monday April 30, 2018 @05:30PM (#16962585)

> Keep the ticket open long enough, and maybe the standards group will adopt your behavior!

But the description of the spec-fix[1] says it aligns with the behavior of all the browsers except Firefox.

So how exactly did Firefox come into alignment with the behavior of the other browsers without there being a patch associated with this bug?

[1] https://github.com/whatwg/html/commit/00769464e80149368672b8...

[ Parent | on HN ]

Re:Prevent data: URLs from being used for XSS by mjw1007 on Monday April 30, 2018 @05:27PM (#16962556)

As far as I can make out, that isn't what happened in this case.

It seems to me that WHATWG settled on the behaviour that the reporter of 255107 originally asked for, and Firefox recently changed to match. The work just wasn't tracked in the 14-year-old 225107 (looks like it's in 1324406).

[ Parent | on HN ]