zbraniecki/l20n — pull request #18 by stasm (2012-07-10 14:54:32+00:00)
Title: Add a comment explaining security implications of DOM overlays

Technically, XPath allows to step out of the context node with
`parent`, `ancestor` or `sibling` axes (or a combination of these
axes). There was a security concern that this could allow a malevolent
XPath expression to copy attributes from non-localizable node from the
source DOM tree.

The comment that this commit adds clarifies why this is not possible
that way the code operates right now.