[Webkit-unassigned] [Bug 12234] Using createContextualFragment to insert a <script> does not cause the script to execute

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Sat Nov 27 09:37:53 PST 2010


https://bugs.webkit.org/show_bug.cgi?id=12234





--- Comment #10 from Ryosuke Niwa <rniwa at webkit.org>  2010-11-27 09:37:53 PST ---
I'm concerned about security implication of enabling scripts.  I can't convince myself that there aren't any websites that rely on the fact WebKit does not execute scripts coming from createContextualFragment.  

While not running scripts expected to run will break the websites, running scripts not expected to run will create a XSS security vulnerability.

I do understand that a fragment created by createContextualFragment is no different than the fragment created by other means and Firefox folks want WebKit to be compatible with Firefox, however, I would avoid the risk of creating a XSS vulnerability at all cost.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list