On 2011-09-12 21:47, Michal Zalewski wrote:
What about javascript: URLs?
Right now, every browser seems to treat javascript:alert('#') in an
"intuitive" manner.
This likely goes beyond data: and javascript:, so I think it would be
useful to look at it more holistically.
Maybe. Or it makes sense to do it one at a time :-).
Observation: javascript: IMHO isn't a URI scheme (it just occupies a
place in the same lexical space), so maybe the right thing to do is to
document it as historic exception that only exists in browsers.
Best regards, Julian
