@taviso's bug is one of the best web vulnerabilities in recent years. @mikewest, time to kill DOM clobbering?https://twitter.com/tehjh/status/847990952346218496 …
-
-
: Feature Policy seems like a good option, and forcing it for isolated worlds seems totally reasonable. File a bug?
@taviso -
Sounds good, I'll file one. It seems impossible anyone is relying on it for content scripts, and too easy mistake to make imo.
-
@zetafuncti0n already filed https://bugs.chromium.org/p/chromium/issues/detail?id=707486 …, maybe use it for discussions of all possible ideas?
-
Feature policy opt-in + wholly disabling it in isolated worlds is what I was thinking as well.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.