42170 2010-07-13 09:19:51 -0700 postMessage() second argument should not accept full URL 2010-08-10 22:41:58 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) All All RESOLVED INVALID javascript:var url="http://www.example.com/test",win=window.open(url);try{win.postMessage("test",url);alert("FAIL")}catch(e){alert("PASS")} P2 Normal --- 1 annevk webkit-unassigned ap ian mike shadow2531 oldest_to_newest 250549 0 annevk 2010-07-13 09:19:51 -0700 Per HTML5 http://www.whatwg.org/specs/web-apps/current-work/complete/web-messaging.html#dom-window-postmessage postMessage() should throw if targetOrigin contains a path component. 250553 1 annevk 2010-07-13 09:23:39 -0700 See also: https://bugzilla.mozilla.org/show_bug.cgi?id=578380 250575 2 ap 2010-07-13 09:45:43 -0700 Anne, do you know if there is a good reason for this requirement? Ignoring unnecessary components seems cleaner in general. 250582 3 annevk 2010-07-13 09:54:47 -0700 Authors might otherwise mistakenly believe they get more protection than they actually do. To me it seems cleaner to reject everything that is not an origin. 250591 4 ap 2010-07-13 10:14:08 -0700 In general, we strongly dislike raising exceptions where they weren't raised before, since that tends to transform minor/potential mistakes into serious breakage of functionality on existing pages. 262934 5 ian 2010-08-10 18:11:28 -0700 The spec has changed. 263026 6 ap 2010-08-10 22:41:58 -0700 Thanks. This seems invalid per the new spec.