Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.datemas.de!weretis.net!feeder1.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups: comp.lang.javascript
Subject: Re: Removing scripts
Date: Sat, 10 Jan 2015 22:32:07 +0100
Organization: PointedEars Software (PES)
Lines: 26
Message-ID: <8264719.4vhzObLhlZ@PointedEars.de>
References: <100120151843135093%timstreater@greenbee.net>
Reply-To: Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7Bit
X-Trace: solani.org 1420925550 26674 eJwFwYEBwCAIA7CXrNKWnTMZ/H/CEh5B5RAVHE7zofo9TBA71x74dtXqxA43xrAvwjn6In8I6xBQ (10 Jan 2015 21:32:30 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Sat, 10 Jan 2015 21:32:30 +0000 (UTC)
User-Agent: KNode/4.14.2
X-User-ID: eJwNy7kBACAIBLCVVDiecQBh/xG0SReQbCllgTAGI9oAp6H0JLVhJ50P1IpsIbAdVBF+oYPVWR4/1R1nXf0ANzQVRQ==
Cancel-Lock: sha1:HU2cE5RyKjVSuU12UK3O0iqcByQ=
X-NNTP-Posting-Host: eJwFwYEBwCAIA7CXBkip5yCu/59gkgHD1EJipVI9NaD/bRH34htOF4XjEuwOwzuTe7eCOv4ALaYRng==
Xref: csiph.com comp.lang.javascript:26527

Tim Streater wrote:

> I have some untrusted HTML, so I want to de-activate any <scripts> it
> contains before shoving it into an iframe. Is there any reason not to
> do the following?
> 
> newdoc  = new DOMParser().parseFromString (untrustedHTML, 'text/html');
> scripts = newdoc.querySelectorAll ('script');
> num     = scripts.length;
> 
> for  (i=0;  i<num;  i++)
>      {
>      newdoc.removeChild (scripts[i]);
>      }
> 
> iframePtr.open ();
> iframePtr.write (new XMLSerializer().serializeToString (newdoc));
> iframePtr.close ();

Yes.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | SVN: <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | ES Matrix: <http://PointedEars.de/es-matrix>
Please do not cc me. / Bitte keine Kopien per E-Mail.