javascript urls aren't sanitized about caja HOT 5 CLOSED

Comment #1 originally posted by metaweta on 2008-01-18T00:45:35.000Z:

Also, the easier
blah
does get translated to
blah
but still ought to be sanitized

from caja.

Comment #2 originally posted by mikesamuel on 2008-01-18T05:08:11.000Z:

Yep. We need to settle on a URI rewriting policy.

GxpCompiler requires all URIs to be relative and not to have .. that escapes to a
parent directory.

Ryan's HtmlCompiler applies no such policy, but we can probably use the UriCallback
policy.

from caja.

Comment #3 originally posted by erights on 2008-01-28T20:01:29.000Z:

<empty>

from caja.

Comment #4 originally posted by erights on 2008-01-28T20:25:16.000Z:

<empty>

from caja.

Comment #5 originally posted by mikesamuel on 2008-03-09T02:51:29.000Z:

This code gets passed through the url callback properly.

from caja.