Subj : Re: object serialization
To   : netscape.public.mozilla.jseng
From : Brendan Eich <brendan@meer.net>
Date : Wed Mar 24 2004 12:22 pm

Brendan Eich wrote:

> You can turn on JS_HAS_XDR_FREEZE_THAW via 
> jsconfig.h.  If you want it on by default, you'll be opening up 
> potential (not known) security holes.  It really should be configured on 

*only*

> for embeddings that trust all scripts and the strings they thaw.
> 
> /be

.