A Note on Restricted Pseudo-URLs
The somewhat quirky behavior of the three aforementioned classes of URLs—about:blank, javascript:, and data:—are all that most websites need to be concerned with. Nevertheless, browsers use a range of other documents with no inherent, clearly defined origin (e.g., about:config in Firefox, a privileged JavaScript page that can be used to tweak the browser’s various under-the-hood settings, or chrome://downloads in Chrome, which lists the recently downloaded documents with links to open any of them). These documents are a continued source of security problems, even if they are not reachable directly from the Internet.
Because of the incompatibility of these URLs with the boundaries controlled by the same-origin policy, ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access