Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #26540

Re: Removing scripts

Show all headers | View raw

Tim Streater wrote:

> I have some untrusted HTML, so I want to de-activate any <scripts> it
> contains before shoving it into an iframe. Is there any reason not to
> do the following?
> 
> newdoc  = new DOMParser().parseFromString (untrustedHTML, 'text/html');
> scripts = newdoc.querySelectorAll ('script');
> num     = scripts.length;
> 
> for  (i=0;  i<num;  i++)
>     {
>     newdoc.removeChild (scripts[i]);
>     }
> 
> iframePtr.open ();
> iframePtr.write (new XMLSerializer().serializeToString (newdoc));
> iframePtr.close ();

Have you considered event handler attributes?  Have you considered to
set an appropriate sandbox attribute[1] on the iframe, instead.

[1] <http://www.w3.org/TR/html5/embedded-content-0.html#attr-iframe-sandbox>

-- 
Christoph M. Becker

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Removing scripts Tim Streater <timstreater@greenbee.net> - 2015-01-10 18:43 +0000
  Re: Removing scripts Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-01-10 22:32 +0100
  Re: Removing scripts Richard Damon <Richard@Damon-Family.org> - 2015-01-10 22:07 -0500
    Re: Removing scripts Tim Streater <timstreater@greenbee.net> - 2015-01-11 09:16 +0000
  Re: Removing scripts "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-01-11 12:56 +0100
    Re: Removing scripts Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2015-01-11 14:23 +0100
      Re: Removing scripts "Christoph M. Becker" <cmbecker69@arcor.de> - 2015-01-11 14:47 +0100
    Re: Removing scripts Tim Streater <timstreater@greenbee.net> - 2015-01-11 15:08 +0000

csiph-web