Re: Removing scripts

From	Tim Streater <timstreater@greenbee.net>
Newsgroups	comp.lang.javascript
Subject	Re: Removing scripts
Date	2015-01-11 15:08 +0000
Message-ID	<110120151508245787%timstreater@greenbee.net> (permalink)
References	<100120151843135093%timstreater@greenbee.net> <m8todg$hvs$1@solani.org>

Show all headers | View raw

In article <m8todg$hvs$1@solani.org>, Christoph M. Becker
<cmbecker69@arcor.de> wrote:

>Tim Streater wrote:
>
>> I have some untrusted HTML, so I want to de-activate any <scripts> it
>> contains before shoving it into an iframe. Is there any reason not to
>> do the following?
>> 
>> newdoc  = new DOMParser().parseFromString (untrustedHTML, 'text/html');
>> scripts = newdoc.querySelectorAll ('script');
>> num     = scripts.length;
>> 
>> for  (i=0;  i<num;  i++)
>>     {
>>     newdoc.removeChild (scripts[i]);
>>     }
>> 
>> iframePtr.open ();
>> iframePtr.write (new XMLSerializer().serializeToString (newdoc));
>> iframePtr.close ();
>
>Have you considered event handler attributes?

These are still a problem, even doing the above.

>Have you considered to
>set an appropriate sandbox attribute[1] on the iframe, instead.

Yes, I did that and then gave up. The reason is that I want to set two
event handlers on the iframe (drop and dragover), to prevent someone
dropping something on it. But with the iframe sandboxed, such event
handlers won't run.

-- 
"Freedom is sloppy. But since tyranny's the only guaranteed byproduct of
those who insist on a perfect world, freedom will have to do." -- Bigby Wolf

Back to comp.lang.javascript | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Removing scripts Tim Streater <timstreater@greenbee.net> - 2015-01-10 18:43 +0000
  Re: Removing scripts Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-01-10 22:32 +0100
  Re: Removing scripts Richard Damon <Richard@Damon-Family.org> - 2015-01-10 22:07 -0500
    Re: Removing scripts Tim Streater <timstreater@greenbee.net> - 2015-01-11 09:16 +0000
  Re: Removing scripts "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-01-11 12:56 +0100
    Re: Removing scripts Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-01-11 14:23 +0100
      Re: Removing scripts "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-01-11 14:47 +0100
    Re: Removing scripts Tim Streater <timstreater@greenbee.net> - 2015-01-11 15:08 +0000

csiph-web