Subject: [websec] Test of XHR in HTML mail

From: "Richard Barnes" <[email-masked]>
Date: Mon, 12 Dec 2011 15:01:41 -0500

The plain text form of this message isn't very interesting.

---

From: "Richard L. Barnes" <[email-masked]>
Date: Mon, 12 Dec 2011 15:04:30 -0500

Figured it might be interesting to have an empirical test of how MUAs handle origin-bound things like XHRs.  

In my tests (Mail.app, Thunderbird, Gmail), none of the MUAs seemed to do anything; they didn't even display the failure message.  My guess is that they just don't support XHR, but I haven't looked into it.

--Richard

On Dec 12, 2011, at 3:01 PM, Richard Barnes wrote:

>  test web 
> _______________________________________________
> websec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/websec

---

From: "Richard L. Barnes" <[email-masked]>
Date: Mon, 12 Dec 2011 15:07:01 -0500

In fact, it doesn't look like they're even processing the onload handler for the <body> element (except for Gmail).  That black line you see is a collapsed <div>, and it should be hidden on load.  Maybe MUAs just aren't supporting Javascript?
--Richard

---

From: Gervase Markham <[email-masked]>
Date: Tue, 13 Dec 2011 10:12:38 +0000

On 12/12/11 20:07, Richard L. Barnes wrote:
> In fact, it doesn't look like they're even processing the onload
> handler for the <body> element (except for Gmail).  That black line
> you see is a collapsed <div>, and it should be hidden on load.  Maybe
> MUAs just aren't supporting Javascript? --Richard

It's not that they don't support it (Thunderbird is half-written in
JavaScript!), it's that they turn it off. It's been disabled by default
since at least Thunderbird 2. Doing so leads to a large reduction in
attack surface.

Gerv