Removing scripts

From	Tim Streater <timstreater@greenbee.net>
Newsgroups	comp.lang.javascript
Subject	Removing scripts
Date	2015-01-10 18:43 +0000
Message-ID	<100120151843135093%timstreater@greenbee.net> (permalink)

Show all headers | View raw

I have some untrusted HTML, so I want to de-activate any <scripts> it
contains before shoving it into an iframe. Is there any reason not to
do the following?

newdoc  = new DOMParser().parseFromString (untrustedHTML, 'text/html');
scripts = newdoc.querySelectorAll ('script');
num     = scripts.length;

for  (i=0;  i<num;  i++)
     {
     newdoc.removeChild (scripts[i]);
     }

iframePtr.open ();
iframePtr.write (new XMLSerializer().serializeToString (newdoc));
iframePtr.close ();


Of course it's a bit heavy to have the string parsed once so I can
reliably remove script elements, only to then have to serialise it so
that I can write it into the iframe (where it gets parsed again). But
it seems that once written into the iframe, the browser starts doing
speculative downloading in parallel with the rest of my javascript
thread execution - making it too late to prevent the remote end from
being aware that I have received their HTML.

-- 
"That excessive bail ought not to be required, nor excessive fines imposed,
nor cruel and unusual punishments inflicted"  --  Bill of Rights 1689

Back to comp.lang.javascript | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Removing scripts Tim Streater <timstreater@greenbee.net> - 2015-01-10 18:43 +0000
  Re: Removing scripts Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-01-10 22:32 +0100
  Re: Removing scripts Richard Damon <Richard@Damon-Family.org> - 2015-01-10 22:07 -0500
    Re: Removing scripts Tim Streater <timstreater@greenbee.net> - 2015-01-11 09:16 +0000
  Re: Removing scripts "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-01-11 12:56 +0100
    Re: Removing scripts Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-01-11 14:23 +0100
      Re: Removing scripts "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-01-11 14:47 +0100
    Re: Removing scripts Tim Streater <timstreater@greenbee.net> - 2015-01-11 15:08 +0000

csiph-web