Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!weretis.net!feeder4.news.weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups: comp.lang.javascript
Subject: Re: Removing scripts
Date: Sun, 11 Jan 2015 14:23:27 +0100
Organization: PointedEars Software (PES)
Lines: 32
Message-ID: <15618724.3DthdCSHB2@PointedEars.de>
References: <100120151843135093%timstreater@greenbee.net> <m8todg$hvs$1@solani.org>
Reply-To: Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8Bit
X-Trace: solani.org 1420982629 5725 eJwFwQERADEIAzBLo9ByyGHs8S/hE7pMkyEquNxN8unBkgMBdeZZX7Xhcy9hq2en5jD8HvwSihDE (11 Jan 2015 13:23:49 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Sun, 11 Jan 2015 13:23:49 +0000 (UTC)
User-Agent: KNode/4.14.2
X-User-ID: eJwFwYEBwDAEBMCV4vEYR2j2H6F3rhROGJ3mz189NXLu+m1pdCoqmtxhSu0WcuDXJcMsNuZ0Q8u4Z74Cfk5VFQw=
Cancel-Lock: sha1:E+DhZpRImS97ls7iw8eBx6nxCAg=
X-NNTP-Posting-Host: eJwNyMEBwCAIA8CVEAjoOAXD/iPYex4sVnR6IByDOe1HU+YKd2XH1j5WLCkFh9+QK90voP2fPSegEZA=
Xref: csiph.com comp.lang.javascript:26541

Christoph M. Becker wrote:

> Tim Streater wrote:
>> I have some untrusted HTML, so I want to de-activate any <scripts> it
>> contains before shoving it into an iframe. Is there any reason not to
>> do the following?
>> […]
>> iframePtr.open ();
>> iframePtr.write (new XMLSerializer().serializeToString (newdoc));
>> iframePtr.close ();
> 
> Have you considered event handler attributes?

Pardon?

> Have you considered to set an appropriate sandbox attribute[1] on the 
> iframe, instead.
> 
> [1]
> [<http://www.w3.org/TR/html5/embedded-content-0.html#attr-iframe-sandbox>

Interesting, but equally unreliable on the Web.

In general, filtering needs to be done server-side, and ISTM that the above 
is client-side code because of “iframePtr.open()” (whereas actually 
“iframePtr” is no pointer variable at all).

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.