I am looking for the official javascript security specification for web
browsers. EMCAScript and DM spec does not seem to contain a section on
security, so I assume none exists and the security policies are
implemented as the vendor pleases. If so, do security specs for IE and
Mozilla exist?
Any pointers would be greatly appreciated.
Christian
dev-security mailing list
dev-security (AT) lists (DOT) mozilla.org

cs5b (AT) yahoo (DOT) com wrote:
so I assume none exists and the security policies are
implemented as the vendor pleases.

More or less, yes.

If so, do security specs for IE and
Mozilla exist?
Any pointers would be greatly appreciated.

Funny you should ask there is no such spec for Mozilla yet, but we're working
on one. The initial thought-dump Brendan wrote up is at
<>. of these days I'm going
to post a response to it in this newsgroup, in the "Semi-formally specifying the
JavaScript security model" thread.
-Boris

dev-security mailing list
dev-security (AT) lists (DOT) mozilla.org