Weirdness with iframe srcdocs
Posted: Mon Dec 30, 2013 7:27 pm
SeaMonkey 2.23, NS 2.6.8.9rc5. If I Allow file://, then open a file with this contents:
I get an alert even though about:srcdoc is listed as forbidden in the menu 
This is unexpected behavior - it would be better if about:srcdoc is either not shown in the menu (with each srcdoc automatically getting the same permissions as its parent page), or scripts from srcdocs are forbidden until explicitly allowing about:srcdoc. Would it be possible (and reasonable) to make one of those changes?
Code: Select all
<!DOCTYPE html>
<iframe srcdoc="<script type="text/javascript">alert("Cuckoo");</script><div>text</div>"></iframe>
<div id="2">noscript</div>
<script type="text/javascript">document.getElementById("2").innerHTML = "Script";</script>
This is unexpected behavior - it would be better if about:srcdoc is either not shown in the menu (with each srcdoc automatically getting the same permissions as its parent page), or scripts from srcdocs are forbidden until explicitly allowing about:srcdoc. Would it be possible (and reasonable) to make one of those changes?