This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.
This recent entry does not have universal acceptance, and the group was still discussing it when the editor added it to the specification. The supposed use case for this attribute is weblog comments, but concerns about HTML security have been resolved with weblog and other application comments years ago. In addition, support for this attribute could give the impression that online sites don't need any other security, which is false. Script injection is only one aspect of security related to weblog comments, and considered a fairly trivial one at that. This needs to be removed from the specification.
EDITOR'S RESPONSE: This is an Editor's Response to your comment. If you are satisfied with this response, please change the state of this bug to CLOSED. If you have additional information and would like the editor to reconsider, please reopen this bug. If you would like to escalate the issue to the full HTML Working Group, please add the TrackerRequest keyword to this bug, and suggest title and text for the tracker issue; or you may create a tracker issue yourself, if you are able to do so. For more details, see this document: http://dev.w3.org/html5/decision-policy/decision-policy.html Status: Rejected Change Description: no spec change Rationale: I'm happy to remove this attribute from the W3C HTML5 specification if that's what the working group wants. The last time I removed a feature based on a bug report such as this, I started a minor war, however, so I suggest that you raise this via the change proposal process if you really feel this way.
Since you were the one putting srcdoc into the HTML5 specification, and the change wasn't based on any use case or requirement put forward by any other individual, I'm assuming you had a good reason for doing so. Evidently not, since you're not incorporating the reason into the WONTFIX rationale.
Opened as Tracker Issue 100: http://www.w3.org/html/wg/tracker/issues/100
There is additional unrelated issue with srcdoc which was not mentioned previously in this bug. Content of srcdoc contains unescaped markup. This is not compatible with XML serialization of HTML5. So if there ever should be something like srcdoc, then it should be subelement of iframe not attribute.
Please file a new bug for new issues. (I don't think that comment 4 makes sense, though; XML supports escaping content in attributes just like in element contents.)