Disallowing setting document.domain in sandboxed iframes
Boris Zbarsky <[email protected]> Fri, 09 Aug 2013 00:38:35 -0400
| Newsgroups | gmane.comp.mozilla.devel.dom |
|---|---|
| Message-ID | <[email protected]> |
Would we be willing to disallow setting document.domain in sandboxed iframes? Seems like there should no content depending on that so far, and it would mean that sandboxed iframes could have better task/process/whatever isolation from the parent... Hixie is looking for some sort of implementor commitment, but I figured I should check here before saying anything on the whatwg list. -Boris