Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.javascript > #26541
| Path | csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!weretis.net!feeder4.news.weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail |
|---|---|
| From | Thomas 'PointedEars' Lahn <PointedEars@web.de> |
| Newsgroups | comp.lang.javascript |
| Subject | Re: Removing scripts |
| Date | Sun, 11 Jan 2015 14:23:27 +0100 |
| Organization | PointedEars Software (PES) |
| Lines | 32 |
| Message-ID | <15618724.3DthdCSHB2@PointedEars.de> (permalink) |
| References | <100120151843135093%timstreater@greenbee.net> <m8todg$hvs$1@solani.org> |
| Reply-To | Thomas 'PointedEars' Lahn <cljs@PointedEars.de> |
| Mime-Version | 1.0 |
| Content-Type | text/plain; charset="UTF-8" |
| Content-Transfer-Encoding | 8Bit |
| X-Trace | solani.org 1420982629 5725 eJwFwQERADEIAzBLo9ByyGHs8S/hE7pMkyEquNxN8unBkgMBdeZZX7Xhcy9hq2en5jD8HvwSihDE (11 Jan 2015 13:23:49 GMT) |
| X-Complaints-To | abuse@news.solani.org |
| NNTP-Posting-Date | Sun, 11 Jan 2015 13:23:49 +0000 (UTC) |
| User-Agent | KNode/4.14.2 |
| X-User-ID | eJwFwYEBwDAEBMCV4vEYR2j2H6F3rhROGJ3mz189NXLu+m1pdCoqmtxhSu0WcuDXJcMsNuZ0Q8u4Z74Cfk5VFQw= |
| Cancel-Lock | sha1:E+DhZpRImS97ls7iw8eBx6nxCAg= |
| X-NNTP-Posting-Host | eJwNyMEBwCAIA8CVEAjoOAXD/iPYex4sVnR6IByDOe1HU+YKd2XH1j5WLCkFh9+QK90voP2fPSegEZA= |
| Xref | csiph.com comp.lang.javascript:26541 |
Show key headers only | View raw
Christoph M. Becker wrote: > Tim Streater wrote: >> I have some untrusted HTML, so I want to de-activate any <scripts> it >> contains before shoving it into an iframe. Is there any reason not to >> do the following? >> […] >> iframePtr.open (); >> iframePtr.write (new XMLSerializer().serializeToString (newdoc)); >> iframePtr.close (); > > Have you considered event handler attributes? Pardon? > Have you considered to set an appropriate sandbox attribute[1] on the > iframe, instead. > > [1] > [<http://www.w3.org/TR/html5/embedded-content-0.html#attr-iframe-sandbox> Interesting, but equally unreliable on the Web. In general, filtering needs to be done server-side, and ISTM that the above is client-side code because of “iframePtr.open()” (whereas actually “iframePtr” is no pointer variable at all). -- PointedEars FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/> Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix> Please do not cc me. / Bitte keine Kopien per E-Mail.
Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Removing scripts Tim Streater <timstreater@greenbee.net> - 2015-01-10 18:43 +0000
Re: Removing scripts Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-01-10 22:32 +0100
Re: Removing scripts Richard Damon <Richard@Damon-Family.org> - 2015-01-10 22:07 -0500
Re: Removing scripts Tim Streater <timstreater@greenbee.net> - 2015-01-11 09:16 +0000
Re: Removing scripts "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-01-11 12:56 +0100
Re: Removing scripts Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-01-11 14:23 +0100
Re: Removing scripts "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-01-11 14:47 +0100
Re: Removing scripts Tim Streater <timstreater@greenbee.net> - 2015-01-11 15:08 +0000
csiph-web