Boris Zbarsky [:bzbarsky] Assignee
	Description • 18 years ago

We shouldn't just use the origin principal to make this decision as we do now.

What the attached patch does is to introduce a new interface to control the execution of programs represented as URIs (at the moment, just javascript:).

Hopefully the API comments are clear enough that I don't need to explain the setup.  If they're not, I should fix that.  ;)

At the moment, with this patch, the only time we will execute javascript: URIs is when they're loaded in a docshell (both because that's the only place where they'll have an owner and because that's the only place where we change the policy from NO_EXECUTION).  With this patch, we'll basically be compatible with IE7.

Then, as we propagate our trust labels through the code, we can decide on a case-by-case basis where to change the policy from NO_EXECUTION to something else.

	Boris Zbarsky [:bzbarsky] Assignee
	Comment 1 • 18 years ago

This needs tests, by the way...  Ideally we'd get the tests from previous javascript: bugs checked in... ;)

	Johnny Stenback (:jst)
	Comment 2 • 18 years ago

Comment on attachment 253927 [details] [diff] [review]
Proposed patch

r=jst

	Brendan Eich [:brendan]
	Comment 3 • 18 years ago

Comment on attachment 253927 [details] [diff] [review]
Proposed patch

Looks good, sr=me.

/be

	Boris Zbarsky [:bzbarsky] Assignee
	Comment 4 • 18 years ago

Fixed, but I still need to write those tests.