[e] (0) clarify that data: and javascript: don't work as worker scripts

git-svn-id: http://svn.whatwg.org/webapps@3857 340c8d12-0b0e-0410-8428-c7bf67bfef74
whatwg · Sep 15, 2009 · c592cc4 · c592cc4
1 parent 9a3c0e0
commit c592cc4
Showing 1 changed file with 29 additions and 9 deletions.
diff --git a/source b/source
@@ -70955,11 +70955,21 @@ interface <dfn>Worker</dfn> : <span>AbstractWorker</span> {
    <li><p>If this fails, throw a <code>SYNTAX_ERR</code>
    exception.</p></li>
 
-   <li><p>If the <span>origin</span> of the resulting <span>absolute
-   URL</span> is not the <span title="same origin">same</span> as the
-   origin of the <span title="concept-script">script</span> that
-   invoked the constructor, then throw a <span>security
-   exception</span>.</p></li>
+   <li>
+
+    <p>If the <span>origin</span> of the resulting <span>absolute
+    URL</span> is not the <span title="same origin">same</span> as the
+    origin of the <span title="concept-script">script</span> that
+    invoked the constructor, then throw a <span>security
+    exception</span>.</p>
+
+    <p class="note">Thus, scripts must be external files with the same
+    scheme as the original page: you can't load a script from a <code
+    title="">data:</code> URL or <code title="">javascript:</code>
+    URL, and a <code>https:</code> page couldn't start workers using
+    scripts with <code>http:</code> URLs.</p>
+
+   </li>
 
    <li><p><span>Create a new <code>DedicatedWorkerGlobalScope</code>
    object</span>. Let <var title="">worker global scope</var> be this
@@ -71079,10 +71089,20 @@ interface <dfn>SharedWorker</dfn> : <span>AbstractWorker</span> {
    argument, or the empty string if the second argument was
    omitted.</p></li>
 
-   <li><p>If the <span>origin</span> of <var title="">scriptURL</var>
-   is not the <span title="same origin">same</span> as the origin of
-   the script that invoked the constructor, then throw a
-   <span>security exception</span>.</p></li>
+   <li>
+
+    <p>If the <span>origin</span> of <var title="">scriptURL</var> is
+    not the <span title="same origin">same</span> as the origin of the
+    script that invoked the constructor, then throw a <span>security
+    exception</span>.</p>
+
+    <p class="note">Thus, scripts must be external files with the same
+    scheme as the original page: you can't load a script from a <code
+    title="">data:</code> URL or <code title="">javascript:</code>
+    URL, and a <code>https:</code> page couldn't start workers using
+    scripts with <code>http:</code> URLs.</p>
+
+   </li>
 
    <li>