Code: Select all
<!DOCTYPE html>
<iframe srcdoc="<script type="text/javascript">alert("Cuckoo");</script><div>text</div>"></iframe>
<div id="2">noscript</div>
<script type="text/javascript">document.getElementById("2").innerHTML = "Script";</script>
This is unexpected behavior - it would be better if about:srcdoc is either not shown in the menu (with each srcdoc automatically getting the same permissions as its parent page), or scripts from srcdocs are forbidden until explicitly allowing about:srcdoc. Would it be possible (and reasonable) to make one of those changes?
