Syndication of javascript: urls as a security window?

[burton@openprivacy.org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


OK...

I don't think a lot of people are checking for this.

If someone were to create an RSS item of

<item>

    <title>something shocking has happened</title>
    <link>javascript:somethingBad()</title>

</item>

This somethingBad() could be a one line Javascript to get cookes and to create a
URL with this info an post to a site.

We should document this somewhere and incourage aggregators to remote
javascript: urls.

Thoughts?

- -- 
Kevin A. Burton ( burton@apache.org, burton@openprivacy.org, burtonator@acm.org )
             Location - San Francisco, CA, Cell - 415.595.9965
        Jabber - burtonator@jabber.org,  Web - http://relativity.yi.org/

Calm your fury, oh mighty lord.  Whatever you may be, god or demon, please leave
us in peace.



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: Get my public key at: http://relativity.yi.org/pgpkey.txt

iD8DBQE8fWdJAwM6xb2dfE0RAvNzAJ9Mt27ipxEGWA9tk1d+JjmcH2+hdwCgutAq
w1e/VUjYLHYb8xTpyPPA3oM=
=QilR
-----END PGP SIGNATURE-----