[whatwg] iframe sandbox and allow-scripts

2013-04-12 Thread Ian Melven
Hi, Freddy Braun recently noticed that he could do the following in Firefox : (note no allow-scripts) and then in the document containing the iframe: var iframe = document.getElementById('foo'); iframe.contentWindow.eval("alert(document.location)"); and the alert will fire, which he found s

Re: [whatwg] Why is the replacement encoding called "replacement" and not "x-replacement"?

2013-04-12 Thread Anne van Kesteren
On Fri, Apr 12, 2013 at 12:17 PM, Peter Occil wrote: > Why is the replacement encoding called "replacement" and not "x-replacement"? > > As far as I can tell there is no character set or alias called "replacement" > in the IANA character > sets list, so accordingly, the replacement encoding shoul

[whatwg] Why is the replacement encoding called "replacement" and not "x-replacement"?

2013-04-12 Thread Peter Occil
Why is the replacement encoding called "replacement" and not "x-replacement"? As far as I can tell there is no character set or alias called "replacement" in the IANA character sets list, so accordingly, the replacement encoding should begin with "x-", as in "x-user-defined", also in the Encodin