He's saying yahoo.com is on his whitelist of websites, so he allows JS to run from Yahoo.