Thus spake mikeperry@xxxxxxxx (mikeperry@xxxxxxxx):
> Author: mikeperry
> Date: 2008-02-24 19:39:44 -0500 (Sun, 24 Feb 2008)
> New Revision: 13714
>
> Modified:
> torbutton/trunk/src/components/cssblocker.js
> Log:
>
> Err, actually, this is a bad idea. Jars can be non-local, and
> the vector for history disclosure actually undergoes a url
err s/history disclosure/chrome disclosure
> rewrite before being re-sent to the content policy.
>
>
>
> Modified: torbutton/trunk/src/components/cssblocker.js
> ===================================================================
> --- torbutton/trunk/src/components/cssblocker.js 2008-02-25 00:30:35 UTC (rev 13713)
> +++ torbutton/trunk/src/components/cssblocker.js 2008-02-25 00:39:44 UTC (rev 13714)
> @@ -93,7 +93,7 @@
> "pippki":true};
>
> var hostFreeSchemes = { "resource":true, "data":true, "cid":true,
> - "javascript":true, "file":true, "jar":true};
> + "javascript":true, "file":true};
>
> var safeOriginSchemes = { "about":true, "chrome":true, "file":true};
>
--
Mike Perry
Mad Computer Scientist
fscked.org evil labs
Attachment:
pgpp1WRJicIHS.pgp
Description: PGP signature