Another bitch is about the general practice of assuming that security is something to be patched onto a finished grand design. In this case the patch was to removed the feature. What were they thinking? The only thing that I can imagine is that the field is writable by the hardware and to deny the JavaScript program the ability to write it would be somehow demeaning, ungeneral, or otherwise objectionable. Never mind that the field had been invented to tell the user the origin of the page. Who ever invented the field was not in a position to keep subsequent system ‘enhancers’ from breaking the purpose of the field. I claim this is a bug in our process of collective design.
Below is the yield of some JavaScript that invokes the vestigial functionality.
Different browsers behave differently.
||
Some browsers treat the property as an initially empty per window mutable string. Other as an immutable empty string.