3 ms·
And interestingly Firefox was not vulnerable because they sanitise the input (stripping XML) which as the report says, does lose them the features the XML offer
by capitainenemo 3y ago
And interestingly Firefox was not vulnerable because they sanitise the input (stripping XML) which as the report says, does lose them the features the XML offers on Windows.
Personally it seems to me those features should go through a more restricted channel from JS, like an API with a strict data structure and Firefox was right to sanitise it.
- pcwalton 3y agoYes, Firefox did the right thing here, and it's arguably a bug in Chromium that it exposed SAPI to the Web. As a general rule, you shouldn't expose platform-specific APIs to Web content, if for no other reason than to avoid Web content accidentally relying on it and having the platform behavior becoming a de facto part of the spec. The fact that it avoided a 0-day is a nice side effect of that conservatism.
- capitainenemo 3y agoMm. Good point. I wonder if that's why Microsoft has notices that their AI "requires Edge" - I'd assumed they were just trying to get people to switch browsers and a UA spoof did seem to work fine, but I hadn't tried any TTS features. Having platform behaviour be a defacto part of the spec is probably not a downside for them :) It's definitely funny that this article portrays this as Firefox removing functionality.